Data processing agreement

Last updated: 7 June 2026

This data processing agreement applies when you, as a business customer (the "controller"), use BelBuddy and we process your callers' personal data on your behalf. In that case BelBuddy is the "processor". This agreement forms part of our Terms and conditions and our Privacy policy and complies with Article 28 of the AVG (GDPR).

1. Parties and division of roles

The customer is the controller and determines the purpose and means of the processing. BelBuddy — a service of Crafty Cast, KvK 87872641, Noordvestsingel 81, 3119 DC Schiedam — is the processor and processes personal data solely on the instructions of, and as directed by, the customer.

2. Subject matter, nature and purpose of the processing

BelBuddy processes personal data in order to answer inbound calls on behalf of the customer, hold and record conversations, capture leads, schedule appointments and send messages via SMS or WhatsApp. The processing lasts for as long as the agreement between the customer and BelBuddy is in force.

3. Types of personal data and categories of data subjects

Data subjects: the customer's callers and contacts.

Types of data: telephone number, call recordings and transcriptions, name, the reason for the call, appointment and booking details, and message content.

4. Instructions

BelBuddy processes the personal data solely on the basis of the customer's written instructions, including this agreement, unless a legal obligation provides otherwise. If, in BelBuddy's view, an instruction conflicts with the AVG (GDPR), BelBuddy will say so.

5. Confidentiality

BelBuddy ensures that persons who have access to the personal data are bound by a duty of confidentiality.

6. Security (Article 32 of the AVG / GDPR)

BelBuddy takes appropriate technical and organisational measures, including encryption of traffic (TLS), access restrictions, and core processing of speech on its own self-hosted infrastructure within the EEA.

7. Sub-processors

The customer gives BelBuddy general authorisation to engage the sub-processors listed below. BelBuddy informs the customer of any intended changes so that the customer can object. Appropriate processing arrangements have been made with each sub-processor.

8. Assistance to the controller

BelBuddy provides the customer with reasonable assistance in handling requests from data subjects (access, rectification, erasure and the like) and in meeting obligations relating to security, data breaches and data protection impact assessments.

9. Data breaches

BelBuddy informs the customer without undue delay — and within 48 hours of discovery at the latest — of a personal data breach, providing the information the customer needs to meet its own notification obligations.

10. Audits

BelBuddy makes available to the customer the information needed to demonstrate compliance with this agreement and cooperates with reasonable audits, having due regard for confidentiality and business continuity.

11. Return and deletion

On termination of the agreement, BelBuddy deletes the personal data, or returns it, once the agreed retention period (730 days by default) has elapsed, unless statutory retention obligations require otherwise.

12. Transfers outside the EEA

In so far as personal data is processed outside the European Economic Area, this is done with appropriate safeguards, such as the Standard Contractual Clauses (SCCs) of the European Commission.

13. Liability, governing law and disputes

The liability provisions of the Terms and conditions apply to this agreement. This agreement is governed by Dutch law; disputes are submitted to the District Court of Rotterdam.

14. Signing

A signable version of this data processing agreement is available on request. Customers who accept BelBuddy through their account agree to this agreement by electronic means; the acceptance is recorded with its date and version. Questions? privacy@belbuddy.com.