Data Processing Addendum
Effective Date: September 28, 2026
This Data Processing Addendum (“DPA”) supplements and forms part of the agreement governing the Customer’s access to and use of the Be Informed Digital Services (the “Agreement”). The Agreement may consist of the Be Informed Terms of Service, an Order, a separate enterprise or customer agreement, or a combination of those documents.
This DPA applies where and to the extent Be Informed processes Customer Personal Data on behalf of the Customer in connection with the Digital Services. It is intended to satisfy the requirements applicable to processor agreements under Article 28 of the GDPR.
For self-service customers, acceptance of the Terms of Service, an Order or a Subscription incorporates this DPA. For customers operating under a separate written agreement, this DPA applies when that agreement references this DPA or a copy is attached to it. A signature is not required unless the applicable Agreement or mandatory law expressly requires one.
1. Scope and applicability
1.1. This DPA applies only to Customer Personal Data processed by Be Informed as part of the standard Digital Services covered by the Agreement, including hosted software-as-a-service, customer and documentation portals, online training and enablement services, support services and associated online functionality.
1.2. This DPA does not automatically apply to bespoke customer-specific applications, dedicated managed-service solutions, customer-specific hosting arrangements, customized implementations or project-specific platforms that materially deviate from the standard Digital Services. Those engagements may require a separate DPA, processing description, security schedule or transfer arrangement.
1.3. If documents forming the Agreement conflict, the order of precedence stated in the Terms of Service or applicable customer agreement applies. Under the standard Terms of Service, the Order and expressly incorporated service-specific terms prevail, followed by this DPA solely for processing of personal data, then the Terms of Service and the Documentation.
1.4. Except as modified by this DPA, the Agreement remains unchanged and in full force. This DPA does not govern personal data that Be Informed processes as an independent Controller, which is described in the Be Informed Privacy Notice.
1.5. Headings are for convenience only. Words such as “including” and “for example” are illustrative and do not limit the words that precede them.
2. Definitions
2.1. Capitalized terms not defined in this DPA have the meanings given in the Agreement. The terms Controller, Processor, Processing, Personal Data, Data Subject and Supervisory Authority have the meanings given in the GDPR or, where applicable, equivalent meanings under Applicable Data Protection Law.
2.2. Applicable Data Protection Law means the GDPR and any national law implementing or supplementing it, and any other data protection law that applies to Be Informed’s Processing of Customer Personal Data under the Agreement.
2.3. Customer means the person or entity that entered into the Agreement with Be Informed. For the purposes of this DPA, Customer includes an authorized affiliate only where that affiliate is permitted to use the Services under the Agreement and the contracting Customer coordinates all instructions, requests and remedies on its behalf.
2.4. Customer Personal Data means Personal Data contained in Customer Content that Be Informed Processes on behalf of Customer. Customer Personal Data includes Personal Data contained in prompts, models, files, comments, generated outputs and support materials submitted by or for Customer.
2.5. Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by Be Informed or its Subprocessors.
2.6. Subprocessor means a third party engaged by Be Informed to Process Customer Personal Data on behalf of Customer.
3. Roles and responsibilities
3.1. Customer acts as Controller of Customer Personal Data or, where Customer Processes Personal Data on behalf of another Controller, as Processor and Be Informed acts as its Subprocessor. Be Informed acts as Processor or Subprocessor, as applicable.
3.2. Customer determines the purposes and lawful grounds of the Processing, the Customer Content submitted to the Services, the persons permitted to use the Services and the configurations selected by Customer. Customer is responsible for the legality, accuracy and quality of Customer Personal Data and for providing required notices and obtaining required rights, permissions or consents.
3.3. Customer will ensure that its instructions and use of the Services comply with Applicable Data Protection Law. Customer is responsible for determining whether the Services and the available security, configuration and access controls are appropriate for its intended Processing.
3.4. Be Informed may Process Service Data as an independent Controller for the purposes described in the Agreement and Privacy Notice, including account, subscription, billing, security, telemetry, support administration and service-operation purposes. Service Data does not become Customer Personal Data merely because it relates to Customer’s use of the Services.
4. Processing instructions
4.1. The Agreement, this DPA, Customer’s use and configuration of the Services, and documented requests submitted through agreed support or administrative channels constitute Customer’s documented instructions to Be Informed.
4.2. Be Informed will Process Customer Personal Data only on documented instructions from Customer and only as necessary to provide, maintain, secure, support and improve the Services for Customer, to comply with the Agreement, or as required by applicable law.
4.3. If applicable law requires Be Informed to Process Customer Personal Data other than on Customer’s instructions, Be Informed will inform Customer of that legal requirement before Processing unless the law prohibits such information on important grounds of public interest.
4.4. Be Informed will promptly inform Customer if, in its opinion, a documented instruction infringes Applicable Data Protection Law. Be Informed may suspend the affected Processing until the parties agree on a lawful instruction, without assuming responsibility for monitoring Customer’s compliance generally.
4.5. Be Informed will not use Customer Personal Data for independent advertising, sale of personal data or an unrelated commercial purpose. Customer Content, customer models and customer prompts will not be used to train a shared or general-purpose AI model for the benefit of other customers unless Customer separately and expressly agrees in writing or through a specific opt-in mechanism that clearly describes that use.
5. Intended data profile and restricted use
5.1. The Digital Services are designed primarily for regulatory and legal modeling, knowledge representation, collaboration around public legal and regulatory sources, and Customer internal policies, procedures, models and configurations.
5.2. The Services are not intended for the routine Processing of special categories of Personal Data under Article 9 GDPR, criminal-offense data, health records, large-scale employee records, Customer CRM databases, Customer end-customer datasets, highly confidential trade secrets, classified information or sector-specific regulated datasets requiring additional safeguards, unless Be Informed expressly agrees otherwise in writing.
5.3. Customer will not submit the categories described in Article 5.2 unless it has first assessed the suitability of the Services, implemented appropriate safeguards and obtained any additional written agreement required by Be Informed. The absence of active content inspection by Be Informed does not constitute acceptance of such Processing.
5.4. The general description of Processing is set out in Annex A. Customer controls the specific Customer Personal Data submitted through the Services and is responsible for maintaining any more detailed internal processing record required for its own compliance.
6. Confidentiality and access
6.1. Be Informed will keep Customer Personal Data confidential and will not disclose it except as permitted by the Agreement, this DPA, Customer’s instructions or applicable law.
6.2. Be Informed will ensure that personnel authorized to Process Customer Personal Data are subject to appropriate contractual or statutory confidentiality obligations and receive relevant security and privacy awareness training.
6.3. Access to Customer Personal Data will be limited to personnel and Subprocessors that require access to provide, secure, maintain or support the Services and will be governed by role-based and least-privilege principles.
6.4. If Be Informed receives a legally binding request from a public authority or other third party to disclose Customer Personal Data, Be Informed will, where legally permitted, inform Customer before disclosure and seek to limit the disclosure to what is legally required.
7. Security of Processing
7.1. Be Informed will implement and maintain appropriate technical and organizational measures designed to protect the confidentiality, integrity, availability and resilience of Customer Personal Data, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of Processing and associated risks.
7.2. The contractual summary of the technical and organizational measures is set out in Annex B.
7.3. Be Informed may update the measures to reflect technical progress, changes in risk or improvements to the Services, provided that an update does not materially reduce the overall level of protection during an applicable Subscription Term.
7.4. Upon reasonable request, Be Informed may provide additional security documentation, certifications, audit information, assurance statements or supporting evidence where available and reasonably required for Customer’s due diligence or compliance. Such information may be subject to confidentiality obligations, a non-disclosure agreement and restrictions needed to protect security-sensitive information and the rights of other customers and suppliers.
7.5. Customer remains responsible for its endpoint security, user lifecycle, credentials, authentication settings, access configuration, lawful use of the Services, and review of security-relevant notifications and administrator permissions.
8. Subprocessors
8.1. Customer grants Be Informed general written authorization to engage Subprocessors to Process Customer Personal Data in connection with the Services.
8.2. The current Subprocessor List is published at https://www.beinformed.com/list-of-subprocessors/. The list will identify the Subprocessor, the relevant processing activity and, where applicable, the principal processing location or transfer information.
8.3. Be Informed will provide at least thirty (30) days’ advance notice of an intended addition or replacement of a Subprocessor through the published subscription mechanism, registered email address or another reasonable electronic channel.
8.4. Customer may object in writing within ten (10) days after notice on reasonable grounds relating to data protection or information security. Customer’s objection must explain the specific concerns and supporting grounds.
8.5. The parties will discuss a timely objection in good faith. Be Informed may address the objection by providing additional information, implementing appropriate safeguards, making a commercially reasonable change, offering an alternative where reasonably available, or deciding not to use the affected Subprocessor for the relevant Processing.
8.6. If Be Informed reasonably determines that the objection cannot be resolved through such measures and that continued use of the affected Subprocessor is necessary to provide the affected Service, and Customer reasonably determines that continued use of that affected Service would no longer be acceptable from a data-protection perspective, Customer may terminate the affected paid Service before the Subprocessor begins Processing.
8.7. Termination under Article 8.6 applies only to the affected Service and does not affect the remainder of the Agreement unless the affected Service constitutes the sole materially purchased Service.
8.8. Be Informed will enter into a written agreement with each Subprocessor imposing data protection obligations appropriate to the Processing and will remain responsible for the Subprocessor’s performance of its data protection obligations to the extent required by Applicable Data Protection Law and subject to the liability provisions of the Agreement.
9. Data residency
9.1. Customer Personal Data may be Processed in the countries identified in the Subprocessor List, the applicable Order or a separate written agreement.
9.2. Unless expressly stated otherwise in the Order or separate written agreement, Be Informed does not guarantee that Customer Personal Data will be Processed exclusively within a particular country or geographic region.
9.3. Be Informed-managed Digital Services are currently operated primarily from within the European Economic Area (“EEA”). Customer acknowledges that certain Subprocessors, support activities, integrations, communications services, artificial-intelligence services or other service components may involve Processing outside the EEA, subject to this DPA and Applicable Data Protection Law.
9.4. Where Customer requires a specific data residency commitment, such commitment must be expressly identified during the purchase process, in the Order or separate written agreement and applies only to the Services and Customer Personal Data covered by that commitment.
9.5. A data residency commitment does not eliminate the requirement for lawful international-transfer mechanisms where access, support, Subprocessor Processing or other activities constitute a restricted transfer under Applicable Data Protection Law.
10. International transfers
10.1. Where Customer Personal Data is transferred from the EEA to a country not recognized as providing an adequate level of protection, Be Informed will ensure that the transfer is made using an applicable lawful mechanism, including the European Commission Standard Contractual Clauses, together with supplementary measures where required.
10.2. Where the EU Standard Contractual Clauses are required for a direct restricted transfer between Customer and Be Informed, they are incorporated by reference as follows: Module Two applies where Customer is Controller and Be Informed is Processor; Module Three applies where Customer is Processor and Be Informed is Subprocessor; Clause 9 Option 2 applies with the general authorization and notice periods in Article 8; the governing law is the law of the Netherlands; and disputes are resolved before the competent courts of the Netherlands, unless mandatory terms of the Clauses require otherwise.
10.3. The information required for Annex I of the Standard Contractual Clauses is contained in the Agreement and Annex A to this DPA. The technical and organizational measures required for Annex II are contained in Annex B. The approved Subprocessors required for Annex III are identified in the Subprocessor List.
10.4. Upon reasonable request, Be Informed will provide information regarding the applicable transfer mechanism, subject to appropriate protection of confidential and security-sensitive information.
11. Personal Data Breaches
11.1. Be Informed will inform Customer immediately, and in any event within thirty-six (36) hours, in writing after becoming aware of a confirmed or potential Personal Data Breach affecting Customer Personal Data.
11.2. The notification will include, to the extent known and available at the time: the nature of the breach; the categories of Customer Personal Data and Data Subjects involved; the date and time Be Informed became aware; the actual or anticipated consequences; the measures taken or proposed to investigate, contain, remediate or mitigate the breach; and a contact point for further information.
11.3. Be Informed may provide information in phases as the investigation develops. A notification does not constitute an admission of fault or liability.
11.4. Be Informed will provide reasonable assistance to Customer in investigating the breach and meeting applicable notification or communication obligations, taking into account the nature of Processing and the information available to Be Informed.
11.5. Customer remains responsible for determining whether notification to a Supervisory Authority, Data Subject or other person is required and for making such notification, except where Applicable Data Protection Law imposes a direct obligation on Be Informed.
12. Data Subject requests and compliance assistance
12.1. Taking into account the nature of the Processing, Be Informed will provide reasonable assistance through appropriate technical and organizational measures to enable Customer to respond to requests to exercise applicable Data Subject rights, including access, rectification, erasure, restriction, objection and data portability.
12.2. If Be Informed receives a request directly from a Data Subject relating to Customer Personal Data, Be Informed will forward the request to Customer and will not respond substantively unless Customer authorizes it or Applicable Data Protection Law requires Be Informed to respond.
12.3. Upon reasonable request, Be Informed will provide information and assistance available to it that Customer reasonably requires to conduct a data protection impact assessment or prior consultation relating specifically to Customer’s use of the Services, where Customer cannot reasonably obtain that information through the Services or Documentation.
12.4. Be Informed may charge reasonable costs disclosed in advance for assistance that is unusually extensive, repetitive, customer-specific or outside the standard functionality and support included in the applicable Subscription, unless Applicable Data Protection Law requires that assistance to be provided without additional charge.
13. Access, return, retention and deletion
13.1. During the Subscription Term, Customer may access, retrieve and delete Customer Personal Data through the standard functionality available under its Subscription.
13.2. Customer is responsible for exporting Customer Content before the Subscription ends. Be Informed is not required to provide a custom export, conversion or migration service unless separately agreed.
13.3. Following termination or expiry, Be Informed may make Customer Content available for retrieval for sixty (60) days unless otherwise agreed in writing. Access during that period may be restricted to export and account administration.
13.4. After the retrieval period, Be Informed will delete or irreversibly anonymize Customer Personal Data, except where retention is required by law, necessary for the establishment, exercise or defense of legal claims, or present in backups that remain protected and are deleted through the normal backup cycle.
13.5. Where Customer Personal Data is retained under an exception, Be Informed will continue to protect it under this DPA and will not Process it for another purpose except as required by law.
13.6. Upon Customer’s reasonable written request, Be Informed will confirm completion of deletion after the applicable deletion process has completed. Restoration from backup, non-standard exit assistance, custom conversion or migration may be subject to reasonable Fees disclosed in advance.
14. Audit and compliance verification
14.1. Be Informed will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR. The parties will ordinarily seek to satisfy verification requirements through Annex B, security documentation, questionnaires, certifications and independent assessment or audit information where available.
14.2. If the information provided under Article 13.1 is not reasonably sufficient, Customer may audit Be Informed’s compliance with this DPA itself or through an independent auditor that is not a competitor of Be Informed and is bound by confidentiality.
14.3. An audit must be limited to Processing relevant to Customer, occur no more than once in any twelve-month period unless required by a Supervisory Authority or following a material Personal Data Breach, take place during normal business hours, follow reasonable advance written notice, and avoid unreasonable disruption to Be Informed, its suppliers and other customers.
14.4. The parties will agree the scope, timing, duration and evidence required before an audit begins. Be Informed is not required to provide access that would compromise security, violate confidentiality obligations, expose another customer’s information, reveal privileged material or permit intrusive testing of production systems.
14.5. Customer bears its audit and auditor costs. Be Informed bears its ordinary internal cooperation costs. If the audit establishes material non-compliance attributable to Be Informed, Be Informed will prepare and implement a reasonable remediation plan and reimburse Customer’s reasonable external audit costs directly attributable to establishing that material non-compliance. Charges imposed by Subprocessors for additional evidence remain Customer’s responsibility unless the non-compliance is attributable to that Subprocessor and recoverable by Be Informed.
14.6. All information obtained through an audit is Be Informed Confidential Information and may be used only to verify compliance with this DPA and Applicable Data Protection Law.
15. Liability and indemnification
15.1. Each party is responsible for damage caused by its own breach of this DPA or Applicable Data Protection Law to the extent allocated by applicable law. Be Informed is not liable for damage that is not caused by an act or omission attributable to Be Informed or its Subprocessors.
15.2. Subject to mandatory law, Be Informed is not liable for indirect or consequential loss, lost profit, lost revenue, lost savings, loss of goodwill, business interruption, or loss arising from Customer’s unlawful instructions, Customer Content, Customer-selected Third-Party Services, or Customer’s failure to use available security and access controls appropriately.
15.3. The total aggregate liability of Be Informed arising out of or relating to this DPA, together with liability arising under the Agreement, is subject to the limitations and exclusions of liability stated in the Agreement.
15.4. The limitations in this Article do not apply to the extent prohibited by law or in the case of intentional misconduct or deliberate recklessness by Be Informed’s management where applicable under Dutch law.
15.5. A party seeking damages must notify the other party without unreasonable delay, provide reasonable details and allow a reasonable opportunity to investigate and mitigate the alleged damage. Subject to mandatory law, a contractual claim against Be Informed lapses twenty-four (24) months after the claim arose.
15.6. If either party receives a regulatory fine or third-party claim relating to a Processing activity under this DPA, the parties will provide reasonable assistance to each other in the defense, objection or mitigation of that fine or claim. Allocation of responsibility remains governed by Applicable Data Protection Law and the Agreement.
16. Term, changes and miscellaneous
16.1. This DPA takes effect when it is incorporated into the Agreement and continues until Be Informed no longer Processes Customer Personal Data under the Agreement, including any applicable retrieval, retention and backup period.
16.2. This DPA cannot be terminated separately while Be Informed continues to Process Customer Personal Data under the Agreement.
16.3. Be Informed may update this published DPA to reflect changes in law, security, technology, the Services or processing practices. Non-material changes may take effect when published with an updated effective date. Material changes will be notified in advance through the Services, the registered email address or another reasonable electronic channel. A change will not materially reduce Customer’s mandatory data protection rights.
16.4. If a material change substantially and adversely affects Customer’s lawful use of an existing paid Service and is not required by law or security, Customer may object before the effective date. The parties will discuss the objection in good faith. If no reasonable resolution is available, Customer may terminate the affected paid Subscription and receive a pro rata refund for the unused prepaid period.
16.5. This DPA is governed by the governing law and jurisdiction provisions of the Agreement. If the Agreement does not specify them, this DPA is governed by the laws of the Netherlands and disputes will be submitted to the competent courts of Gelderland, the Netherlands, except where mandatory law provides otherwise.
16.6. If a provision is invalid or unenforceable, it will be limited or replaced to the minimum extent necessary to preserve its purpose, and the remaining provisions remain effective.
16.7. Notices concerning this DPA should be sent to privacy@beinformed.com. Notices to Customer may be sent to the contact details associated with the Account, Tenant, Order or applicable agreement.
16.8. The English version governs. A translation is provided for convenience only unless mandatory law requires otherwise.
Annex A. Description of Processing
This Annex describes the standard Processing contemplated for the Be Informed Digital Services. Customer controls the specific Customer Personal Data submitted and may maintain a more detailed record for its own purposes.
Item | Description |
Subject matter | Customer Personal Data contained in Customer Content and Processed by Be Informed on behalf of Customer in connection with the Digital Services. |
Duration and frequency | Continuous or intermittent, depending on Customer’s use of the Services, for the term of the Agreement and any applicable retrieval, retention and backup period described in Article 12. |
Purpose | Providing, operating, maintaining, securing and supporting the Services in accordance with the Agreement and Customer’s documented instructions. |
Nature of Processing | Collection, recording, organization, structuring, hosting, storage, adaptation, retrieval, consultation, transmission, making available to authorized users, backup, support, security operations, restriction, export, deletion and irreversible anonymization. |
Typical Data Subjects | Customer employees, contractors, representatives, administrators, Authorized Users, training participants and other persons whose Personal Data Customer or its Users submit to the Services. |
Typical Personal Data | Names, business email addresses, job titles, organizational affiliations, account identifiers, authentication metadata, comments, collaboration information, support communications and other limited business contact or professional information included in Customer Content. |
Sensitive or highly confidential data | The Services are not intended for routine Processing of special-category data, criminal-offense data, health records, large-scale employee records, Customer CRM or end-customer datasets, highly confidential trade secrets, classified information or sector-specific regulated datasets unless expressly agreed otherwise. |
Processing locations | As described in Article 9 (Data Residency), the Subprocessor List and applicable Service information. |
Return and deletion | As described in Article 12 and the Agreement. |
Controller activities | Service Data and other personal data Processed by Be Informed as an independent Controller are outside this DPA and are described in the Privacy Notice. |
Annex B. Technical and Organizational Measures
This Annex provides the contractual summary of the technical and organizational measures implemented by Be Informed to protect Customer Personal Data. The measures support compliance with Articles 28(3) and 32 GDPR. They are not an exhaustive disclosure of sensitive internal configurations or procedures. Additional evidence may be made available under Article 7.4.
1. Governance and security management
- Be Informed operates an Information Security Management System covering information security, data protection, incident management, business continuity and supplier management.
- Security policies and procedures are documented, approved by management and reviewed periodically.
- Information security risks are identified, assessed and treated in a structured manner, with assigned security and privacy responsibilities.
2. Access control and confidentiality
- Access to systems and Customer Personal Data is granted on a least-privilege and role-based basis.
- Strong authentication mechanisms are used, and multi-factor authentication is applied where supported.
- Administrative and privileged access is restricted, logged and monitored.
- Personnel and contractors are subject to confidentiality obligations.
- Access rights are reviewed periodically and revoked promptly when no longer required.
3. Hosting model and physical security
- Be Informed-managed Digital Services are hosted using professionally managed hosting infrastructure and/or service providers selected in accordance with Be Informed’s security, operational and compliance requirements.
- Facilities provide redundant power, cooling and connectivity and apply multi-layered physical access controls.
- Office locations are protected through appropriate physical access controls.
4. Infrastructure and environment separation
- Production, test and development environments are appropriately segregated.
- Production Personal Data is not used in development or test environments.
- Network security measures include firewalls, segmentation and monitoring.
- Systems are hardened against recognized security baselines and security patches are applied based on risk and criticality.
5. Encryption and data protection
- Personal Data in transit is protected using industry-standard encrypted communication protocols, including TLS.
- Customer Personal Data at rest is protected through logical access controls. Encryption at rest is applied to storage systems and backups where supported and appropriate.
- Cryptographic mechanisms use widely accepted industry-standard algorithms.
- Backups are stored securely and protected against unauthorized access.
6. Logging, monitoring and incident management
- Security-relevant events are logged and monitored, and logs are protected against unauthorized access and modification.
- Be Informed maintains incident-response procedures covering detection, assessment, containment, remediation and lessons learned.
- Personal Data Breaches are documented and reported to Customer in accordance with this DPA.
- Reasonable assistance is provided in investigations and notifications.
7. Business continuity and availability
- Measures are maintained to support the availability, resilience and recoverability of Processing systems.
- Regular backups are performed, protected and tested.
- Business continuity and disaster recovery measures are proportionate to service criticality.
8. Supplier and Subprocessor management
- Subprocessors are selected with regard to their ability to provide appropriate data protection and security measures.
- Written data processing agreements impose applicable confidentiality, security and privacy obligations.
- International Processing is governed by applicable Chapter V GDPR safeguards.
- Relevant compliance information, certifications and audit material are reviewed as part of supplier oversight.
9. Data minimization, retention and deletion
- Customer Personal Data is Processed only to the extent necessary for the agreed purposes.
- Retention and deletion requirements are documented and applied.
- Customer Personal Data is securely deleted or irreversibly anonymized when no longer required, subject to applicable legal, contractual and backup exceptions.
10. Testing and continuous improvement
- Technical and organizational measures are periodically reviewed, tested, assessed and improved.
- Improvement actions identified through incidents, audits, assessments and changes in risk are tracked and addressed.