This data processing agreement ("DPA") is part of every agreement for the CleverPrism subscription. It supplements Chapter 4 (Processing of personal data) of the NLdigital Terms 2025 and contains the arrangements required by Article 28(3) of the General Data Protection Regulation (GDPR). If this DPA and the NLdigital Terms 2025 conflict on the processing of personal data, this DPA prevails.
1Parties and roles
- The customer is the controller: it determines the purposes and means of the processing of personal data in its CleverPrism environment.
- CleverPrism B.V. (Elzentlaan 27, 5611 LG Eindhoven, KvK 42175200) is the processor: it processes these personal data only on behalf of the customer.
- This DPA applies for as long as CleverPrism processes personal data on behalf of the customer, including the 60-day retention period after the agreement ends and for as long as copies remain in encrypted backups (at most 12 months).
- Definitions. "Desk" means an isolated AI workspace within Tirmel, hosted and managed by CleverPrism for the customer, with its own AI agent environment, storage and access rights (technically a sandbox). Tirmel (formerly Iriva) is the product name of the CleverPrism subscription.
2Subject, nature and purpose
- CleverPrism provides the customer with a private AI environment: a dedicated server with desks, a password vault, an artifact server and a tool gateway (the "Toolkit") that checks the actions of AI agents in the customer's connected systems before they are carried out. The processing consists of storing, hosting, transmitting and, on the customer's instruction, deleting the data the customer and its users put into the environment; operating, monitoring and securing the environment; and providing support.
- CleverPrism processes the personal data only for providing the service. It does not look at the content of the environment, except when necessary for support the customer has asked for, for security or to comply with the law. Except as set out in 2.3, it does not use the data for its own purposes, and it never uses it to train AI models.
- Processing for CleverPrism’s own purposes. CleverPrism acts as an independent controller, and not as processor, when it (a) processes account data and technical and network data to secure its platform and network, prevent abuse and comply with legal obligations, (b) compares digital fingerprints (hashes) of images published through public links with lists of known child sexual abuse material, and (c) accesses content to handle a specific report, to comply with an order, or where there is a serious and concrete indication of abuse, as described in section 3A of the terms of service. This processing is described in the privacy statement. For all other processing CleverPrism is the processor.
3Personal data and data subjects
| Type of personal data | Data subjects |
|---|---|
| Account data: names and email addresses of users who may log in, and of password vault accounts, insofar as processed on the customer’s behalf (see 2.3) | Employees and other users appointed by the customer |
| Content: all personal data in files, projects, messages to and from AI models, generated output and stored credentials. The customer decides what this includes. | Users, and anyone whose data the customer puts into the environment, such as its customers, suppliers and contacts |
| Tool calls: the system, function and input of each action an AI agent takes through the Toolkit, and the decision on it. These are kept in the customer's Toolkit log for 90 days. | Anyone whose data appears in that input, such as the people in an email or record the agent works with |
| Technical data: IP addresses, timestamps, request and error logs of the environment, insofar as processed on the customer’s behalf (see 2.3). Prompts and AI answers are not collected in these logs. | Users and visitors of the environment and its shared links |
- The service is not designed for special categories of personal data, criminal data or national identification numbers (Article 28.6 NLdigital Terms 2025). If the customer wants to process such data, it agrees this with CleverPrism in writing first.
4Instructions
- CleverPrism processes personal data only on the customer's documented instructions. The agreement, this DPA and the way the customer configures and uses the environment are the customer's instructions.
- If CleverPrism is required by EU or Dutch law to process personal data otherwise, it informs the customer beforehand, unless that law prohibits this.
- CleverPrism informs the customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
5Confidentiality and security
- Everyone at CleverPrism and its sub-processors who has access to the personal data is bound by a duty of confidentiality.
- CleverPrism takes appropriate technical and organisational measures as referred to in Article 32 GDPR, including:
- a separate, dedicated server for every customer, in a data centre in Eindhoven, the Netherlands;
- network separation and a firewall; administrative access only with SSH keys, from a limited number of known addresses;
- encrypted connections (TLS) for all access to the environment from the internet;
- credentials kept in a separate password vault, so AI agents do not see them in plain text;
- access for staff only when needed for their work, and changes to the platform recorded in version control;
- automatic security updates, and monitoring of availability and security events;
- support access by CleverPrism staff only with the customer’s permission, for example when the customer asks for support: from CleverPrism’s office network, at most one hour per session, visible in the environment and recorded in the customer’s log, with an email to the customer;
- private access to systems in the customer’s own network, which is included in the service and which the customer uses as it chooses, through an encrypted VPN that CleverPrism hosts for the customer in its own data centre; an administrator of the customer decides which systems can be reached;
- technical logs kept for at most 90 days.
- CleverPrism may adapt these measures, as long as the level of security does not decrease.
6Sub-processors
- The customer gives general authorisation for the use of sub-processors. CleverPrism currently uses:
| Sub-processor | Service | Location |
|---|---|---|
| CleverIT B.V., Eindhoven (Clever group) | Data centre, network, email relay and internal tooling, including the gateway through which the Toolkit reaches the AI inference providers | The Netherlands |
| Infercom SCS, Luxembourg | AI inference for the Toolkit: an AI model assesses tool calls against the customer's rules. Prompts and outputs are not stored. | European Union (data centre in Munich, Germany) |
| Eyloo GmbH (LLMBase), Montabaur, Germany | AI inference for the Toolkit, alongside Infercom | European Economic Area or Switzerland (data centres in Germany, the Netherlands, Finland and Switzerland) |
| Scaleway SAS, Paris, France | Speech recognition (Whisper) for dictation in the Tirmel app and in the desks: the audio is processed transiently, only to return the text | European Union (France) |
| Cloudflare, Inc. and its affiliates | Secure tunnels, DNS and TLS for access to the environment from the internet, and storage of encrypted backups in Cloudflare R2 (EU jurisdiction). The backups are encrypted on CleverPrism’s servers before they are sent; Cloudflare cannot read them. | Global network; backups stored in the European Union; transfers outside the EEA based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses |
- CleverPrism informs the customer by email at least 30 days before it adds or replaces a sub-processor. The customer may object on reasonable grounds within that period. If the parties cannot resolve the objection, the customer may terminate the agreement with effect from the date of the change.
- CleverPrism imposes the same data protection obligations on sub-processors as in this DPA and remains responsible to the customer for them.
- AI inference for the Toolkit. The Toolkit sends the system, function and input of a tool call to an AI model to check it against the customer's rules; it does not send the name of the desk. CleverPrism uses only AI inference that runs in the European Economic Area (EEA) or in Switzerland for this, with providers that do not use the data to train models. The model answers only whether the call is allowed.
- Not a sub-processor: the AI provider the customer connects to its desks with its own subscription or API key (for example Anthropic or OpenAI). The customer contracts with that provider directly and is responsible for that processing, including any transfer outside the EEA.
- CleverPrism may in the future offer AI models for use in the customer's desks itself, for example through Amazon Bedrock in an EU region. Such an option applies only to customers who choose it. CleverPrism adds the provider to the list above in accordance with 6.2 before it is used.
7Assistance to the customer
- The customer can access, correct and delete the data in its environment itself. Where that is not possible, CleverPrism helps the customer respond to requests from data subjects.
- CleverPrism helps the customer with its obligations under Articles 32 to 36 GDPR, such as security, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to CleverPrism.
- CleverPrism may charge its usual rates for assistance that goes beyond what is reasonable, in line with the NLdigital Terms 2025.
8Personal data breaches
- CleverPrism informs the customer without undue delay after discovering a personal data breach that affects the customer's data. It provides the information the customer needs to decide whether to notify the supervisory authority or data subjects, as far as available: what happened, which data and how many data subjects are affected, the likely consequences and the measures taken.
- Notifying the supervisory authority and data subjects is the customer's responsibility (Article 29 NLdigital Terms 2025).
9Transfers outside the EEA
- The environment and its data are hosted in the Netherlands. CleverPrism transfers personal data outside the European Economic Area only through the sub-processors listed above, and only with appropriate safeguards as referred to in Chapter V GDPR. AI inference for the Toolkit takes place in the EEA or in Switzerland. Switzerland is not part of the EEA, but the European Commission has decided that it ensures an adequate level of protection (Article 45 GDPR, Decision 2000/518/EC).
10End of the processing
- After the agreement ends, or after a desk is removed, CleverPrism keeps the data for 60 days. During those 60 days the customer can ask for an export of its data in a common, machine-readable format, free of charge, whether or not it exported the data itself beforehand. If the agreement ends because of non-payment, this period runs during the suspension, as described in section 6.3 of the terms of service. CleverPrism recommends that the customer itself exports the data it still needs before the agreement ends, while the environment is still accessible.
- After these 60 days CleverPrism deletes the personal data from the environment in such a way that they can no longer be used or accessed. Copies in backups are encrypted, are used only to restore data after an incident and are deleted automatically as the backup cycle rotates, at the latest 12 months later. This applies unless EU or Dutch law requires CleverPrism to keep the data.
11Information and audits
- CleverPrism provides the customer, on request, with the information needed to demonstrate compliance with Article 28 GDPR.
- The customer, or an independent auditor mandated by it and bound by confidentiality, may audit compliance, including by inspection, once a year with at least 30 days' notice, and in addition after a personal data breach affecting the customer’s data or when a supervisory authority requires it, at the customer’s own expense. CleverPrism cooperates within reason. Audits take place in a way that does not affect the security of other customers.
12Liability and other provisions
- The limitation of liability in Article 15 of the NLdigital Terms 2025 applies to this DPA.
- This DPA is governed by Dutch law. Questions about this DPA: service@cleverprism.com.
Version 1.9 (1 November 2026): section 10.1 recommends that the customer exports its data itself before the agreement ends and confirms that it can still ask for a free export during the 60 days. Nothing else changed.
Version 1.8 (30 October 2026): the tool gateway is now called by its product name, the Toolkit, instead of Toolgate (sections 2.1, 3, 6.1, 6.4 and 9.1); section 5.2 says that the private access to the customer’s own network is included in the service and that the customer uses it as it chooses. Nothing else changed.
Version 1.7 (26 October 2026): section 1.3 covers backup copies; 2.3 describes when CleverPrism processes data for its own purposes (security, abuse prevention, legal obligations) as an independent controller; 3 is adjusted accordingly; 10.1 refers to the final warning before deletion after non-payment; 11.2 allows audits by the customer itself and after a breach.
Version 1.6 (26 October 2026): section 5.2 now describes support access with the customer’s permission and the optional private access; 6.1 adds the storage of encrypted backups in Cloudflare R2 (EU) to the services of Cloudflare; 10 says that the export is free of charge and how long encrypted backup copies are kept.
Version 1.5 (15 October 2026): Scaleway SAS (Paris, France) was added to the sub-processors in 6.1, for speech recognition for dictation in the Tirmel app and in the desks. Nothing else changed.
Version 1.4 (13 October 2026): the product name Iriva was changed to Tirmel, and the web addresses were changed to the Tirmel domain names (such as tirmel.com and tirmel.app). Nothing else changed.