Data Processing Agreement and Project Order

Smartest AI Sales | AI Netherlands

Version 3.24 | 25 October 2026

Project and lead intake

One page per customer and project. We prefill known details and registers; check, complete and accept. Routine evidence uploads for individual leads are not required.

Company and registration number: ___________________________________________

Authorised representative name, role and email: _________________________________

Project / order reference: __________________________________________________

Lead file / list reference: ____________________ Unique leads: __________________

Recipient countries: __________________ Customer privacy URL: _________________

Source: [ ] Our customers [ ] Our enquiries / opt-ins [ ] Third party / other: ________

Contact basis: [ ] Valid WhatsApp consent for our business [ ] Customer exception*

Package: [ ] WhatsApp Web Unlimited [ ] WhatsApp Business API Managed

Sender / number: ____________________ Requested go-live date: _________________

Appointment types (choose one): [ ] Google Meet only [ ] Telephone callback only [ ] Both

Criteria for selected types / attached criteria reference: __________________________

Project and provider registers with version: ____________________________________

Prices excluding VAT under the selected package in the supplied English Terms 3.24: Web €499 setup + €499 per service month; API €599 setup + €3,999 per service month. Selected types only, under Terms 7.4: €50 per qualified, booked and confirmed Google Meet appointment or recorded telephone callback after the agreed criteria and the lead’s request/acceptance; callbacks are immediately billable without extra confirmation. Both types for the same lead/opportunity: €50 total; no extra fee for enabling both. First invoice: setup, first live service month and ordered extras; then subscription in advance and outcomes in arrears. Payment 14 days; minimum 1 service month. Notice: Web 14 days, API 30 days. Different prices or extras require an expressly attached order.

[ ] I declare and can demonstrate that the supplied leads were obtained lawfully, that we may provide their data to AI Netherlands for this assignment and that AI Netherlands may contact them via WhatsApp on behalf of our business based on valid consent or an applicable statutory exception. I also confirm the required WhatsApp opt-ins and processed opt-outs; we retain the evidence. As an authorised representative, I accept this DPA, the order and the supplied English Terms 3.24; the Privacy and Cookie Policies have been received. Go-live requires separate test approval by an authorised email.

Name as electronic acceptance or signature: __________________ Date: ______________

* Customer exception: number obtained at sale, your own similar offering, and opt-out at collection and in each marketing message; required WhatsApp opt-ins still apply.

1 Parties and application

1.1 The customer identified above is the controller for the campaign, or acts as a processor with demonstrable authority from the underlying controller. The processor is Oktay Akgül, trading as the sole proprietorship AI Netherlands, also under the trading name Smartest AI Sales, Chamber of Commerce 96434392, S.L. Louwesstraat 96, 7545 EX Enschede, Netherlands; contact he***@***************es.com.

1.2 This agreement implements Article 28 GDPR and other applicable requirements and forms part of the accepted Project Order. It takes effect through authorised signature or express electronic acceptance identifying the order and this version. AI Netherlands accepts its duties by issuing this DPA with its offer and accepting the order. Handwritten signatures by both parties are unnecessary. Electronic acceptance is recorded with identity, date, version and order reference; this intake identifies English as the accepted contract language.

1.3 Each new customer and project has its own confirmed project page. Existing company details and a current provider register may be reused by specific reference; list, size, source, countries and permission must remain correct for the new assignment. Additional lists or material extensions are not silently authorised by an earlier approval. Material changes require authorised documented confirmation. Customer amendments apply only if AI Netherlands expressly accepts them.

1.4 This DPA, the project page, completed Project Register in Annex A, Provider Register supplied beforehand in Annex B and Data Protection and Security Policy 3.24 form the processing arrangements. AI Netherlands prepares the technical registers; the customer confirms its business choices. An empty entry or generic provider category does not authorise an unidentified processing activity or provider. For data-protection conflicts, mandatory law and mandatory transfer provisions prevail, then this DPA; the commercial order follows Terms 3.2. Our own website-consent administration remains our controller activity under the Privacy Policy.

2 Subject purpose data and duration

2.1 The subject is the lawful, identified lead list processed for AI-assisted communication solely on the customer's behalf, qualification against its criteria, bookings with its designated sales team only in the Google Meet and/or telephone callback formats selected in the Project Order, agreed confirmations and reminders and recording outcomes. Necessary support, security, rights assistance, return and deletion remain within that limited purpose. Sale, unrelated enrichment, our own lead campaigns and exchange with other customers are excluded.

2.2 Operations may include collection on instruction, import, organisation, storage, retrieval, messaging and AI processing, limited campaign-related search, qualification, routing, booking, reporting, export, restriction and deletion. Approved integrations may read or update specified contact fields, tags, notes, tasks, deals, pipeline stages and calendar entries for the assignment. Unapproved actions are excluded; anonymous examples follow section 8.

2.3 Data subjects are the customer's permitted existing and prospective customers, conversation and appointment participants and authorised customer staff. Data is limited to necessary business and contact details, message identifiers, relevant enquiry or purchase context, messages and necessary attachments (text, images, voice or video), necessary transcripts and summaries, knowledge-base and configuration data, answers, qualifications, appointments, campaign status and necessary source, consent, opt-out, usage and technical records.

2.4 Standard lead lists and chats must not contain special-category or criminal-offence data, identity documents, passwords or payment-card secrets. A sensitive sector or appointment can itself reveal special-category information; such use requires an appropriate additional legal condition, instruction, security and agreement before processing. Unexpected receipt is minimised, restricted and handled under lawful instructions. Authorised connection tokens are kept separately as protected integration credentials, not added to ordinary chats or AI knowledge.

2.5 Processing lasts for the defined service and necessary return, deletion and limited statutory-retention stages. Conversation data is kept only as needed and, by default, no later than twelve months after the last relevant interaction; an earlier end of purpose, valid deletion instruction or the end-of-service rules in section 9 can require earlier deletion. A minimum service month does not authorise unnecessary retention or unwanted contact. This DPA remains effective while AI Netherlands holds project personal data.

2.6 Campaign conversations. Only conversations with leads from your supplied list contacted through the broadcast appear on the platform; your sales team can take them over. Other WhatsApp chats and existing chat history are not imported.

3 Customer declarations and instructions

3.1 Between the business parties, the customer is responsible for its source, lawful acquisition and disclosure, selected recipients and countries, correct details, lawful basis, separate channel permissions, information duties and evidence for what it supplies or approves. It is the commissioning sender and determines purpose, offering, audience, knowledge, qualification, communication windows and its own follow-up. It authorises AI Netherlands to communicate and book on its identified business's behalf within the recorded limits.

3.2 Before supplying leads, the customer checks that the contact basis covers the actual sender, WhatsApp marketing and intended use. It applies exclusions and retains proportionately linked evidence, including text, date, affirmative action, channel, sender and source where relevant. Necessary evidence for Dutch electronic marketing is normally kept demonstrable for five years after sending. A source checkbox or acceptance of this DPA is not the lead's consent.

3.3 For a concrete complaint or reasoned request, the customer supplies existing evidence normally within fourteen calendar days, sooner where required by law, supervision or specific legal urgency. It promptly reports incorrect data, withdrawn consent and objections and provides timely lawful instructions for rights requests. Evidence must exist before sending; this supply period is not time to obtain permission retrospectively.

3.4 Instructions comprise this DPA, the accepted order, completed registers and later authorised documented settings or orders. Settings may be recorded automatically; silence, broad administrator access or a lead's message is not new authorisation. Separate digital approval of the tested AI agent and agreed configuration is required before go-live. The integration, role and risk arrangements in the Terms apply subject to this DPA.

4 Duties of AI Netherlands

4.1 We process project personal data only on documented lawful instructions, including for transfers, unless Union or applicable Member State law requires processing. We inform the customer before that mandatory processing unless the law prohibits notice for important public-interest reasons. A foreign order does not replace a required transfer assessment. We immediately inform the customer if, in our opinion, an instruction infringes applicable data-protection law.

4.2 Authorised people are bound to confidentiality, receive access according to task and need and appropriate privacy and security instructions. We separate customer environments and do not use project data for our own marketing, advertising audiences, other customers, data sale or unrelated analysis.

4.3 We maintain technical and organisational measures appropriate to risk. The agreed baseline includes secure transmission, protection of stored secrets and backups, appropriate authentication and permissions, customer separation, secure integrations and destinations, relevant logging, maintenance, incident handling and recoverability. The Project Register and Data Protection and Security Policy 3.24 specify components and responsibilities. Measures may be responsibly improved, but not materially reduced below the required protection without a valid basis.

4.4 Disclosure and use are restricted to necessary fields, recipients and purposes. A provider may not use identifiable project data for its own training. Secrets are not placed in ordinary conversation histories or public logs. Choosing an integration does not waive mandatory security.

4.5 The security baseline includes TLS 1.2 or higher on supported platform connections, encrypted backups and stored connection tokens, hashed passwords and role-based access. The Project Register records actual components, locations, backup cycle and any alternative measures. Technical platform-security logs are kept where necessary for up to twelve months; shorter suitable settings or documented incident retention may apply. Section 9 governs end-of-service deletion.

5 Subprocessors and transfers

5.1 The customer gives general written authorisation for the subprocessors specifically identified, with their tasks, in the Provider Register supplied before processing. It records the actual legal entity, address and contact, service, data, storage and access locations and transfer basis; the relevant further platform chain is also identified. A generic category or incomplete entry does not authorise an unknown party.

5.2 We normally notify additions or replacements at least thirty days before use, with enough information for a reasoned data-protection objection. The parties seek suitable safeguards or a reasonable alternative. If unresolved, either may end the affected future service before use without a penalty for that reason, with proportionate settlement of unused advance payments. A legally required urgent change is made with prompt notice and necessary protection only as legally permitted.

5.3 We impose materially equivalent relevant data-protection duties on subprocessors in writing and remain responsible to the customer to the extent required by Article 28 GDPR. A provider contracted directly by the customer may have a different role; the actual role is established before connection and does not remove our duties for our own performance.

5.4 Processing or access outside approved locations requires a valid transfer basis and necessary safeguards. Where needed, the applicable EU standard contractual clauses are executed with the correct module and completed annexes, a transfer assessment and supplementary measures. An adequacy decision applies only to its covered recipient and processing. DPF status is verified; the former Privacy Shield is not used. UK and Swiss requirements are applied separately where relevant.

5.5 We assess binding government requests, minimise disclosure and give notice where lawful. Relevant external support and remote access are recorded. A contract label or EU-server option does not prove the absence of international transfers.

6 Rights incidents and assistance

6.1 Taking account of the processing and available information, we provide appropriate technical and organisational assistance with data-subject rights and security, breach, impact-assessment and prior-consultation duties. Customer-data requests are forwarded without undue delay, normally within two working days. We do not independently provide a substantive answer on the customer's behalf without instructions or a legal requirement.

6.2 We notify the customer of a personal-data breach without undue delay after becoming aware. Where reasonably possible, initial notice is given within 24 hours; we do not wait for a complete investigation. We provide available information about nature, data and people affected, likely effects, measures and contact details and supplement it progressively. We retain proportionate evidence and assist containment, investigation and recovery. The controller's own statutory deadline is not an allowed waiting period for our processor notice.

6.3 The customer handles notifications for which it is responsible; we fulfil our own legal duties. Necessary notification, opt-out handling and statutory assistance do not depend on payment or a waiver of rights. Reasonable additional assistance is charged only at proportionate rates agreed beforehand; remedying our own breach is not extra customer work.

7 Review and documentation

7.1 We provide information needed to demonstrate Article 28 compliance and allow appropriate audits and inspections by the customer or its authorised independent auditor. Reliable existing documentation may be used first where sufficient; a necessary inspection cannot be excluded solely by our unilateral preference for documents.

7.2 Ordinary audits are efficiently scheduled, normally once a year on reasonable prior notice. This does not restrict necessary additional or expedited review for a substantiated incident, material warning, legal requirement or competent authority. Reviews protect other customers, security and confidentiality without making effective review impossible. Ordinary reasonable audit costs are the customer's; costs of establishing and remedying our proven material breach are ours to the appropriate extent required by law.

7.3 We maintain required processing and security records and cooperate with competent authorities. A statement, badge or provider brochure does not replace actual implementation. The Project Register is kept current.

8 Anonymisation and AI training

8.1 Identifiable or merely pseudonymised project data is not used for training, fine-tuning or general model evaluation. This also binds AI providers receiving personal data to deliver the service. Inference, campaign-related retrieval and quality checks remain limited to the assignment.

8.2 Only prior lawfully assessed preparation of truly anonymous, non-confidential examples is permitted under Terms 8.1 and Privacy Policy 6. Annex A records purpose, role, instruction, lawful basis, information, additional conditions and the anonymity assessment. Privacy law applies while source data remains personal; an independent purpose of AI Netherlands requires its own corresponding duties to be met beforehand. Without the conditions, preparation does not begin.

8.3 Genuine anonymity requires sufficient protection against direct and indirect identification, linking, singling out, reconstruction and model leakage. Reversible coding or removing names alone is insufficient. Only the genuinely anonymous result may be used outside the personal-data part of this DPA and retained after the assignment for the limited AI sales and appointment improvement purpose. Reidentification, rebuilding lead lists and advertising use are prohibited. Recipients are bound in writing to the limited purpose, no reidentification and appropriate security. Personal sources remain subject to ordinary deletion and confidential information remains protected.

9 Return and deletion

9.1 During the agreement and for thirty calendar days after it ends, the customer may request its data for handover and choose lawful return or deletion. We provide an appropriate available commonly used machine-readable export; mandatory switching and retrieval rights remain. This does not entitle continued campaigns or normal platform use.

9.2 After that thirty-day retrieval period, active processor copies are deleted within thirty days and remaining backups within ninety days, unless a shorter valid instruction or necessary legal retention applies. Residual copies are restricted from normal use. Valid deletion and suppression instructions are reapplied after recovery. On reasonable request we confirm completion, any lawful residual retention and its expiry.

9.3 A legal hold covers only demonstrably necessary data and is periodically reviewed. An invoice dispute does not permit unlawful withholding of necessary data or continued campaigns. The customer handles deletion in its own systems and directly chosen providers, with appropriate assistance for our part.

10 Additional applicable US restrictions

10.1 Where we are a service provider, contractor or processor under applicable US privacy law, personal information is processed only for the specifically described purposes in section 2 and the Project Register, with the required level of protection. We do not sell or share it for cross-context behavioural advertising, retain or use it outside the permitted business relationship or combine it with unrelated personal datasets. A statutory possibility does not broaden this agreed narrower purpose.

10.2 We certify that we understand and comply with these applicable restrictions, notify the customer if we can no longer do so and allow reasonable appropriate checks and measures to stop and remedy unauthorised use. Required obligations are imposed on further recipients. Legally compelled processing remains limited to necessity and applicable safeguards. Contract labels do not change the actual classification of sale, sharing or an independent purpose.

11 Responsibility and administration

11.1 The customer declaration and allocation of roles concern data, decisions and instructions for which the customer is responsible. Each party retains its own statutory duties. AI Netherlands acts within the assignment and acquires no ownership of the lead list. The customer retains its documents and rights in its list, subject to rights of individuals and third parties.

11.2 Terms 10.1, 10.6 and 10.7 govern legally valid business limitations and indemnities for attributable customer causes, including incorrect source or permission declarations. They do not automatically transfer our own faults or mandatory processor and subprocessor duties. Rights of individuals and authorities, mandatory transfer provisions and statutory loss allocation and recourse remain. A complaint alone does not establish customer liability.

11.3 Dutch law and the valid dispute arrangements in the Terms apply between the parties, subject to mandatory rules. Invalid parts are severed only as legally possible. Changes identify their version and do not expand purposes without the required legal basis and instructions. Confidentiality and data duties survive as needed; contact details in the project page and registers are kept current.

Annex A Project Register

AI Netherlands completes this before the relevant processing, or attaches a specifically identified service or configuration register supplied beforehand. The customer confirms its business choices; the short intake does not replace this record.

Annex B Provider Register

AI Netherlands supplies the current completed register before processing. A previously supplied, unambiguously identified current register may be incorporated by its reference on the project page. The customer does not prepare the provider chain. The functions below are entries to complete, not authorisation of unidentified providers.

Independent payment, administration and own-website services are recorded according to their actual role under the Privacy Policy; they are not automatically subprocessors of customer leads. The completed register's date, version and authorisation are retained with the project page.