Effective from: 16 June 2026 · Version 1.0
1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the Terms of Service at /legal/terms (the "Terms") between Giesen Coffee Roasters B.V. ("Giesen", the "Processor"), Industrieweg 15, 7071 CK Ulft, The Netherlands (KvK 09165753), and the customer accepting the Terms (the "Controller").
This DPA applies where Giesen processes personal data contained in Customer Data on behalf of the Controller in providing GiesenCloud (the "Service") — for example personal data of the Controller's own customers, suppliers, and staff. It is automatically accepted as part of the Terms; no separate signature is required. A countersigned copy is available on request via privacy@giesen.com.
For personal data for which Giesen is itself the controller (such as Account data), the Privacy Notice applies instead.
In the event of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.
2. Definitions
Terms such as "personal data", "processing", "data subject", "controller", "processor", "supervisory authority", and "personal data breach" have the meaning given in Regulation (EU) 2016/679 ("GDPR"). Capitalised terms not defined here have the meaning given in the Terms.
3. Description of processing
- Subject matter: provision of the GiesenCloud roastery-management platform.
- Duration: the term of the Terms, plus the deletion period in Section 10.
- Nature and purpose: hosting, storage, transmission, display, analysis, backup, and support of Customer Data to provide the Service features the Controller uses; de-identification as instructed under Section 4.
- Categories of data subjects: the Controller's customers and their contacts, suppliers and their contacts, employees and other users the Controller invites to its Team.
- Categories of personal data: contact details (name, email, phone, address), order and invoice data, delivery details, support communications, user activity within the Controller's Team, and any other personal data the Controller chooses to process through the Service.
- Special categories: the Service is not designed for special categories of personal data (GDPR Art. 9), and the Controller agrees not to process them through the Service.
4. Instructions
4.1 Giesen processes personal data only on the Controller's documented instructions, unless required to do so by EU or member-state law (in which case Giesen informs the Controller before processing, unless the law prohibits this).
4.2 The documented instructions consist of: (a) the Terms and this DPA, (b) the Controller's configuration of the Service (including enabled integrations and settings), and (c) reasonable written instructions consistent with the Terms.
4.3 De-identification and AI training. The Controller instructs Giesen to de-identify and aggregate Customer Data and to use the resulting data to maintain, develop, and improve the Service — including training machine-learning models — as described in Section 7 of the Terms, unless and to the extent the Controller has disabled AI training in Settings → Privacy & Data. Disabling the setting takes effect immediately for future training runs.
4.4 Giesen informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.
5. Confidentiality
Giesen ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what is needed for their role.
6. Security
6.1 Giesen implements and maintains appropriate technical and organisational measures pursuant to GDPR Art. 32, including encryption in transit and at rest, multi-tenant isolation, role-based access control, two-factor authentication, audit logging, and tested backups.
6.2 The current measures are described at /trust/security, which is incorporated into this DPA as its security annex. Giesen may update the measures from time to time, provided the overall level of security does not materially decrease.
7. Sub-processors
7.1 The Controller grants a general written authorisation for the engagement of sub-processors.
7.2 The current list of sub-processors — including each provider's purpose, the data involved, and its location — is published at /trust/sub-processors and is incorporated into this DPA as its sub-processor annex.
7.3 Giesen announces the addition, removal, or replacement of sub-processors on that page at least 30 days before the change takes effect. The Controller may subscribe to updates as offered on that page.
7.4 The Controller may object to a new sub-processor on reasonable data-protection grounds within 30 days of the announcement. The parties will then discuss a solution in good faith; if none is found, the Controller may terminate the affected Subscription pro rata as its sole remedy.
7.5 Giesen imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains fully liable to the Controller for the sub-processor's performance.
7.6 Third-party services the Controller itself connects — such as AI assistants connected via the MCP endpoint or integrations the Controller enables with its own third-party accounts — act on the Controller's instruction and under the Controller's own agreement with that provider; they are not Giesen's sub-processors.
8. Assistance
8.1 Taking into account the nature of the processing, Giesen assists the Controller with appropriate technical and organisational measures in fulfilling data-subject requests (access, rectification, erasure, restriction, portability, objection). Much of this is available directly in the Service (export and deletion features, audit logs).
8.2 Giesen assists the Controller in ensuring compliance with GDPR Arts. 32–36 (security, breach notification, data-protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to Giesen.
8.3 If a data subject contacts Giesen directly about processing under this DPA, Giesen forwards the request to the Controller without undue delay and does not respond substantively except on the Controller's instruction or where legally required.
9. Personal data breach
Giesen notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's Customer Data. The notification includes, to the extent known: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Giesen documents breaches and cooperates with the Controller's own notification obligations.
10. Return and deletion
10.1 During the term, the Controller can export Customer Data at any time using the in-app export features and APIs.
10.2 After termination of the Terms, the Controller has a 30-day window to export Customer Data. After this window, Giesen deletes the personal data from live systems and subsequently purges it from encrypted backups within the backup retention period stated in the Privacy Notice, unless EU or member-state law requires longer storage.
10.3 De-identified Data created under Section 4.3 before an opt-out or termination is no longer personal data and is not subject to return or deletion.
11. Audits
11.1 Giesen makes available the information reasonably necessary to demonstrate compliance with this DPA, including the documentation in the Trust Center at /trust and, when available, third-party certifications and audit reports (see /trust/certifications).
11.2 Where this information is insufficient, the Controller (or an independent auditor mandated by it and bound to confidentiality) may audit Giesen's compliance with this DPA, at most once per 12 months, during business hours, with at least 30 days' notice, without disrupting operations, and at the Controller's expense. Competitors of Giesen may not be used as auditors.
12. International transfers
12.1 Giesen processes Customer Data primarily within the European Economic Area.
12.2 Where a sub-processor processes personal data outside the EEA in a country without an adequacy decision, the transfer is safeguarded by the European Commission's Standard Contractual Clauses and, where applicable, the recipient's certification under the EU-US Data Privacy Framework, as indicated per provider at /trust/sub-processors.
13. Liability and term
13.1 The liability provisions of the Terms apply to this DPA.
13.2 This DPA takes effect upon acceptance of the Terms and remains in force as long as Giesen processes personal data on behalf of the Controller.
14. Contact
Questions about this DPA: privacy@giesen.com.