Zoppabox logo ZoppaBox
← Back
Legal

Data processing agreement

The arrangements for how ZoppaBox, as processor, handles personal data on behalf of your association.

Version 1.0 – September 2026

This Data Processing Agreement forms an integral part of the agreement between ZoppaBox and the Association.

Article 1 – Roles

  1. For personal data that the Association processes via ZoppaBox for its own association activities, the Association is in principle the controller within the meaning of the GDPR.
  2. ZoppaBox processes these personal data on behalf of and on the instructions of the Association and acts as processor in doing so.
  3. For personal data that ZoppaBox processes for its own purposes, including customer administration, invoicing, security, support and business operations, ZoppaBox may be an independent controller.

Article 2 – Subject matter, nature, purpose and duration

  1. ZoppaBox processes personal data to the extent necessary to provide, maintain, secure and support the features used by the Association.
  2. Processing may include, among other things, collecting, recording, organising, storing, consulting, altering, making available to authorised Users, synchronising, securing, exporting and erasing.
  3. The purpose of the processing is to support the organisation and activities of the Association.
  4. Processing continues for as long as the agreement between ZoppaBox and the Association is in force and, where necessary, during the applicable deletion and backup periods thereafter.

Article 3 – Data subjects

Depending on how ZoppaBox is used, personal data may be processed of, among others:

  • members and former members;
  • board members and volunteers;
  • conductors and musical directors;
  • teachers and pupils;
  • parents and guardians;
  • guest musicians;
  • donors and contacts;
  • visitors and contact persons;
  • event participants and ticket buyers;
  • other persons registered in ZoppaBox by the Association.

Article 4 – Personal data

Depending on the features used, the following may be processed, among others:

  • name and contact details;
  • address details;
  • date of birth;
  • membership details;
  • instrument, group, section, team or committee;
  • attendance and availability;
  • roles and authorisations;
  • lesson and scheduling data;
  • contact and donor data;
  • event and ticket data;
  • photos and media;
  • messages and comments;
  • documents;
  • data in custom fields;
  • technical account, device, log and security data;
  • other data entered by the Association or its Users.

Free text fields, documents, photos, custom fields and other Content may contain special categories of personal data. The Association is responsible for the lawfulness and necessity of entering such data.

Article 5 – Instructions

  1. ZoppaBox processes personal data only on documented instructions from the Association, unless ZoppaBox is required by law to process them.
  2. The use and configuration of the features chosen by the Association constitute a documented instruction.
  3. ZoppaBox does not use personal data it receives as processor for its own advertising or marketing purposes.
  4. If ZoppaBox considers that an instruction infringes applicable privacy legislation, ZoppaBox will inform the Association, to the extent permitted by law.

Article 6 – Confidentiality and access

  1. Persons who have access to personal data on behalf of ZoppaBox are bound by confidentiality.
  2. Access is limited to persons and systems for which access is necessary to provide, maintain, secure or support ZoppaBox.
  3. ZoppaBox applies appropriate authorisation and access measures.

Article 7 – Security

  1. ZoppaBox takes appropriate technical and organisational measures in accordance with Article 32 GDPR.
  2. In doing so, account is taken of the state of the art, the costs of implementation, the nature and scope of the processing and the risks to data subjects.
  3. Measures may relate to, among other things:
    • encrypted data transfer;
    • authentication;
    • two-factor authentication where available or required;
    • roles and authorisations;
    • restriction of access;
    • security of cloud and storage services;
    • security updates;
    • logging and monitoring where appropriate;
    • backup and recovery facilities;
    • procedures for security incidents.
  4. Security measures are adapted where necessary to technical developments and changing risks.

Article 8 – Sub-processors

  1. The Association grants ZoppaBox general written authorisation to engage sub-processors that are necessary for the Service.
  2. ZoppaBox keeps an up-to-date list of relevant sub-processors available.
  3. ZoppaBox informs Associations of material additions or replacements of sub-processors.
  4. The Association may object to a new sub-processor on reasonable privacy grounds.
  5. ZoppaBox imposes appropriate data protection obligations on sub-processors.
  6. ZoppaBox remains responsible towards the Association for its sub-processors' compliance with the applicable obligations, to the extent provided by the GDPR.
  7. If personal data are processed outside the European Economic Area, ZoppaBox ensures a valid transfer mechanism in accordance with the GDPR.

Article 9 – Data breaches and security incidents

  1. When ZoppaBox becomes aware of a breach relating to personal data processed on behalf of the Association, ZoppaBox will inform the Association without undue delay.
  2. ZoppaBox provides, to the extent available, information about:
    • the nature of the incident;
    • the personal data involved;
    • the categories and numbers of data subjects, as far as known;
    • the likely consequences;
    • measures taken or proposed.
  3. If not all information is immediately available, ZoppaBox may provide it in phases.
  4. ZoppaBox reasonably cooperates in assessing the incident.
  5. The Association remains responsible for any notification to the Dutch Data Protection Authority and data subjects, unless otherwise agreed in writing.
  6. A notification by ZoppaBox does not constitute an acknowledgement of liability.

Article 10 – Data subject rights

  1. Taking into account the nature of the processing, ZoppaBox reasonably assists the Association with requests for access, rectification, erasure, restriction, objection or data portability.
  2. If a data subject contacts ZoppaBox directly about data for which the Association is the controller, ZoppaBox will, where appropriate, refer the request to the Association.

Article 11 – Other assistance

Taking into account the nature of the processing and the information available, ZoppaBox provides reasonable assistance with:

  • security obligations;
  • investigation and notification of data breaches;
  • data protection impact assessments (DPIA);
  • any prior consultation of a supervisory authority.

Article 12 – Information and audits

  1. ZoppaBox makes available the information reasonably necessary to demonstrate compliance with Article 28 GDPR.
  2. If this information is insufficient, the Association may request an audit.
  3. An audit is announced in advance and in principle takes place during normal office hours.
  4. An audit is limited to systems and processes relevant to the processing on behalf of the Association and must not affect the security or confidentiality of other customers.
  5. Where possible, available documentation, statements, certifications or audit reports are used first.
  6. Reasonable costs of an audit specifically requested by the Association are in principle borne by the Association, unless it reveals a material failure on the part of ZoppaBox.

Article 13 – Termination, return and deletion

  1. After the service ends, the Association has 30 days to export suitable data and download its own files, to the extent technically available.
  2. At the Association's request, ZoppaBox will delete the personal data or, to the extent technically reasonably possible, make them available to the Association.
  3. After the applicable period has expired, ZoppaBox may delete personal data from the active environment.
  4. Data may then remain in technical backups for a maximum of 30 days, until they are deleted or overwritten according to the regular retention cycle.
  5. Data in such backups are not used for purposes other than security, technical recovery or legal obligations.
  6. A statutory retention obligation may prevent the deletion of certain data.

Article 14 – Obligations of the Association

The Association:

  1. has a valid legal basis for its processing;
  2. informs data subjects where required by law;
  3. only processes data that are necessary and lawful;
  4. manages roles and authorisations carefully;
  5. restricts access to special categories of personal data where necessary;
  6. informs ZoppaBox of security incidents on its side that may affect the Service.

Article 15 – Liability

Liability between ZoppaBox and the Association is governed by the liability provisions of the ZoppaBox Terms and Conditions, to the extent this does not conflict with mandatory law.

Article 16 – Term and order of precedence

  1. This Data Processing Agreement applies for as long as ZoppaBox processes personal data on behalf of the Association.
  2. Obligations which by their nature are intended to continue, including confidentiality, remain in force after termination.
  3. In the event of a conflict between this Data Processing Agreement and the Terms and Conditions, this Data Processing Agreement prevails with regard to the processing of personal data.
Back to the homepage