Data processing agreement

1. Definitions

Terms such as personal data, processing, controller, processor, data subject, special categories of personal data and personal data breach have the meaning given in the General Data Protection Regulation (GDPR). In addition:

• User: the controller, the business or professional with a TransferGuard account. For a company account, that is the company.
• Service, recipient, transfer, identity check, report, company account: as defined in the terms of service.
• Sub-processor: a third party engaged by TransferGuard to process personal data for the user.

This agreement covers the personal data TransferGuard processes as processor for the user. For the reusable identity, the passkey and the Verified badge of recipients, which a recipient can use with several senders, and for the Verified sender badge, TransferGuard is the controller itself, with the consent of the data subject. The privacy statement describes that processing. TransferGuard is only for businesses and professionals.

2. Subject matter and duration

TransferGuard processes personal data for the user to provide the service. The agreement runs as long as the user uses the service and thereafter until all personal data has been erased in accordance with section 14.

3. Nature and purpose of the processing

4. Data subjects and types of personal data

Data subjects: recipients of files, persons from whom the user requests files, and persons whose data is contained in the files.

Personal data:

• contact data: email address, for Email and text message the mobile number, and for an identity check name and optionally date of birth as entered by the user;
• a short note from the user to the recipient (at most 300 characters), which is not encrypted in the browser;
• identity data after a successful check: name, date of birth, type of ID document, document number and country of issue;
• images of the ID document and face, only at the verification partner;
• biometric data for unique identification (face match), a special category of personal data (Article 9 GDPR), only at the verification partner;
• technical data: IP address and browser and device type at receipt, times, log events, HMAC values of email addresses and whether the badge is visible;
• encrypted files with size and SHA-256 fingerprint. The files may contain personal data of any kind, including special categories. TransferGuard cannot read that content.

BSN. TransferGuard does not read or store the Dutch citizen service number from the result of the check. TransferGuard also does not keep the nationality or the photos of the document and face.

5. Instructions

• TransferGuard only processes the personal data on documented instructions of the user. The choices the user makes per transfer (recipient, type of access, way of delivery, expiry date, identity check) and the use of the service count as such instructions.
• TransferGuard does not process the data for its own purposes, except to secure the service, prevent abuse and comply with a legal obligation. The reusable identity and the badge of recipients are not covered by this agreement (section 1).
• If TransferGuard is required by law to process or disclose data, it informs the user in advance, unless the law prohibits this.
• If TransferGuard believes an instruction infringes the GDPR, it informs the user immediately.

6. Obligations of the user

• The user ensures a valid legal basis for the processing. For biometric data in an identity check, that is the recipient's explicit consent (Article 9(2)(a) GDPR). TransferGuard asks for this consent on behalf of the user in a consent step before the check; without consent the check does not start.
• The user informs the recipients about the processing.
• The user carries out a DPIA where required. Processing of biometric data is on the Dutch Data Protection Authority's list of processing operations requiring a DPIA.
• The user is responsible for the content of the files and remains responsible for its own legal obligations, such as a legal obligation to identify someone. TransferGuard does not take these over.

7. Confidentiality and access

• TransferGuard keeps the personal data confidential. Anyone at TransferGuard who can access personal data is bound by confidentiality.
• TransferGuard's admin screen shows no recipient data; a technical check refuses responses containing such data. Access to transfers of a company account requires membership of that company account.
• Administrators with server access can technically reach the database and the keys for server-side encryption, and therefore, with automatic delivery, also the stored key of a transfer. Only administrators designated by TransferGuard, who are bound by confidentiality, have this access, and only for administration and resolving incidents. Every sign-in to the server is recorded automatically, with time and origin, and kept for 12 months.

8. Security measures

TransferGuard takes appropriate technical and organisational measures (Article 32 GDPR), including:

• encrypted connections (TLS) for the website, the accounts and the recipient pages;
• encryption in the browser for files and file names, end-to-end when the user shares the link personally;
• with automatic delivery: the transfer key stored encrypted (AES-256-GCM), bound to that one transfer, and only released after the email code or the identity check;
• server-side encryption with AES-256-GCM for identity check data and for IP address and device at receipt;
• mandatory two-step verification (authenticator app or passkey) for all staff members of company accounts and TransferGuard administrators;
• passwords as bcrypt hashes, temporary lockout after repeated failed sign-ins and request rate limiting;
• separation of company accounts in the application;
• a hash chained log that the database only allows to be appended to, with independent RFC 3161 timestamps;
• no storage of BSN, nationality or photos from the identity check;
• automatic erasure of files after the expiry date and of reports after their end date;
• an encrypted database backup every hour in the EU jurisdiction of Cloudflare R2, kept for 90 days and unchangeable for the first 30 days;
• server, database, file storage and backups located in the EU.

On request TransferGuard gives the user a current description of these measures.

9. Sub-processors

The user gives TransferGuard general authorisation to engage sub-processors. TransferGuard imposes the same obligations on them as in this agreement and remains responsible for their compliance. Currently these are:

Not a sub-processor. Mollie B.V. processes the payments for the subscription as independent controller. Mollie only processes data of the user itself, not of recipients.

Didit acts as independent controller for a number of its own purposes: security, abuse prevention, the integrity of its service, audit logs, legal obligations, training fraud models and legal claims. TransferGuard has switched off the use of its verification data for training, has the session at Didit deleted after the final result and has set a maximum retention period at Didit. The data processing agreement with Didit is Annex 2 to Didit's business terms. Didit only provides the list of its own sub-processors on request and under confidentiality.

TransferGuard announces a new or replacement sub-processor by email at least 30 days in advance to the user, for a company account to the owners. If the user objects, it may terminate the agreement free of charge before the effective date.

10. Transfers outside the EEA

TransferGuard only transfers personal data to a country outside the European Economic Area if a valid mechanism exists, such as an adequacy decision or standard contractual clauses. This currently applies to Cloudflare and to Brevo's sub-processors in the United States (EU-US Data Privacy Framework and standard contractual clauses), and to Didit's sub-processors outside the EEA (2021 standard contractual clauses, where applicable).

11. Data subject rights

• TransferGuard forwards a data subject request it receives to the user without undue delay and does not answer it itself, unless instructed by the user. A recipient can hide the Verified badge themselves.
• TransferGuard helps the user respond to requests. In the service the user can download the report per transfer, revoke a transfer and then erase the report.

12. Personal data breaches

• TransferGuard notifies the user, for a company account the owners, of a breach affecting the user's data without undue delay and at the latest within 48 hours after discovery.
• The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed and a contact person. Information that becomes known later follows as soon as possible.
• The user decides whether the breach is reported to the supervisory authority and to data subjects. TransferGuard assists with this.

13. Assistance and audits

• TransferGuard assists the user with a DPIA and any prior consultation of the supervisory authority, with the information available to it.
• TransferGuard demonstrates compliance with this agreement primarily through documentation: on request the user receives a description of the technical and organisational measures and the other information needed to demonstrate compliance.
• An on-site inspection is only possible where the GDPR requires it, at most once a year and with at least 30 days' notice, by an independent auditor bound by confidentiality. The costs are borne by the user.

14. Retention and erasure

• Files are available until the expiry date of the transfer (5, 14 or 30 days) or until the user revokes the transfer. After that nobody has access any more and TransferGuard erases the files. TransferGuard erases a draft that was not sent after 24 hours.
• The recipient data and download status of a free transfer are kept for 5 days, together with the files. Free transfers do not include a PDF report. With Certified Delivery they are kept for 1 year after sending, or 1 year after the first complete receipt if that is later; for a file request 1 year after it was created. After revoking or expiry the user can erase the report earlier. The log remains, without names or email addresses. TransferGuard erases the full mobile number for a code by text message as soon as the transfer expires or is revoked; the report only keeps a masked number. At Brevo, sending data of emails and text messages is deleted automatically after 3 months.
• TransferGuard has the session at the verification partner deleted as soon as the final result is in. TransferGuard erases a date of birth entered by the user after the outcome, or when the transfer is revoked or expires.
• TransferGuard erases the reusable identity of a recipient, with passkeys and badge, 1 year after the latest identity check.
• Return. The user gets the personal data back by downloading the files per transfer while they are available, and the report as a PDF. TransferGuard does not offer a separate full export.
• If Certified Delivery ends, the user can still download the reports for 30 days. After that TransferGuard erases the reports and the related recipient data.
• If the user deletes the account or the agreement ends in another way, TransferGuard erases the remaining personal data of recipients within 30 days, unless a legal obligation requires retention.
• Erased data remains in the encrypted backups for at most 90 days.
• On request TransferGuard confirms in writing that the data has been erased.

15. Liability

The limitations and the limitation period in section 13 of the terms of service apply to liability between the parties, including claims under the GDPR, to the extent permitted by law. A fine imposed on a party by a supervisory authority remains with that party. The limitations do not apply in case of intent or wilful recklessness (gross negligence) of management. Claims of data subjects themselves (Article 82 GDPR) are not limited by these arrangements.

16. Final provisions

• In case of conflict between this agreement and the terms of service, this agreement prevails regarding the processing of personal data.
• TransferGuard may amend this agreement when the service or the law changes. It announces material changes by email at least 30 days in advance. If the user does not agree, it may terminate the agreement free of charge before the effective date.
• This agreement is governed by Dutch law. Disputes are submitted to the District Court of Midden-Nederland, Utrecht location. In case of differences between the Dutch and English text, the Dutch text prevails.