nisebookings
Nederlands Start building

NiseBookings processor agreement

Draft, not yet legally reviewed. Version: draft 2026-11-05. This is a translation of the Dutch text. If the two differ, the Dutch text applies.

Parties

  • Customer: the NiseBookings account holder. For the data of its End customers, the Customer is the controller.
  • Nise: Regentesselaan 142, 2562 EE Den Haag, the Netherlands, info@nisebookings.com. Nise is the processor here.

This agreement only covers data Nise processes for the Customer. For account data and site visitors Nise is itself responsible; see the privacy statement.

GDPR terms have the same meaning in this agreement. This agreement is part of the terms and conditions.

Article 1. Subject and instructions

  1. Nise processes personal data only to provide the Service, as described in annex 1, and following the Customer’s documented instructions.
  2. Use of the Service and the settings in the admin count as instructions.
  3. If EU or member state law requires Nise to act otherwise, Nise reports this in advance, unless that is prohibited.
  4. If Nise finds an instruction contrary to privacy law, it reports this at once.
  5. The Customer ensures there is a legal basis, informs its End customers and complies with the law.

Article 2. Confidentiality

Nise keeps the data confidential. Everyone with access on Nise’s behalf is bound to confidentiality.

Article 3. Security

  1. Nise takes the measures in annex 3.
  2. Nise may change measures as long as the security level does not drop.
  3. The Customer is responsible for its own part: login details, API keys, roles, invited users and what it collects.
  4. The Customer has assessed that annex 3 suits the data it processes. Special categories of personal data are not the purpose of the Service.

Article 4. Subprocessors

  1. The Customer consents to the subprocessors in annex 2.
  2. For a new or different subprocessor Nise gives at least 30 days’ notice. The Customer can object with reasons within that period. If the parties cannot agree, the Customer can cancel by the effective date.
  3. Nise imposes the same obligations on subprocessors and stays responsible for them towards the Customer.

Article 5. Transfers outside the EEA

The subprocessors in annex 2 process the data in the European Economic Area. Nise transfers no data outside the EEA without the safeguards the GDPR requires, and reports this first under article 4.

Article 6. Data subject rights and assistance

  1. The Customer can handle most requests itself in the admin, such as viewing, changing and deleting data. The retention periods in annex 1 apply, for example to the send log.
  2. If Nise receives a request from an End customer, it forwards it to the Customer and does not handle it itself.
  3. Nise assists the Customer, as far as reasonable, with data subject requests, data protection impact assessments and questions from the supervisory authority. Nise may charge for work beyond normal use.

Article 7. Data breaches

Nise reports a data breach to the Customer within 48 hours of discovering it and follows the procedure in annex 4. The Customer decides whether the supervisory authority or data subjects are informed.

Article 8. Term, deletion and return

  1. This agreement runs for as long as Nise processes data for the Customer.
  2. The Customer can retrieve its data until the end through the admin and, if its plan includes it, through the management API.
  3. After an account has ended, Nise keeps the data for 1 more year and then deletes it, unless the Customer explicitly asks for earlier deletion. The Customer hereby instructs Nise to do so.
  4. Until automatic clean-up exists, Nise deletes this data by hand.
  5. Falling back to Free does not end the account.
  6. Data in backups only disappears when the backup expires.

Article 9. Information and audit

  1. On request Nise provides the information needed to demonstrate compliance.
  2. The Customer may have an audit carried out at most once a year, or after a data breach. The Customer announces it 30 days in advance, the auditor signs a confidentiality undertaking, and the Customer bears the costs.

Article 10. Liability

Liability under this agreement falls under article 12 of the terms and conditions. The rights of data subjects under Article 82 GDPR are not affected.

Article 11. Final provisions

Changes follow article 14 of the terms and conditions. This agreement is governed by Dutch law. Disputes go to the District Court of The Hague.

Annex 1. Description of the processing

Purpose and nature: storing and processing bookings, customers, payment statuses, mails and uploads, so the Customer can take and manage bookings.

Data subjects: End customers, event attendees and the Customer’s staff.

Duration: as long as the account exists, plus the period in article 8.

Data Content Retention during the account
Customers Name, e-mail, phone, notes Until the Customer deletes them
Bookings, tickets, packages, waiting list Time, service, staff member, status, note, extras, intake answers Until the Customer deletes them; removed with the customer
Payments Amount, VAT, status, reference, coupon code Until the Customer deletes the Project; stay without a customer link if the customer is deleted
Uploads Images and PDFs up to 5 MB Not linked to a booking: 24 hours. Otherwise as long as the booking exists
Send log Recipient, subject, content, calendar file, status 90 days, even if the customer was deleted earlier. Waiting mails stay until processed
Staff Name, e-mail, phone, info, calendar link Until the Customer deletes them
API audit Key, method, path, status, time 1 year
Webhook log Ids and status fields, no names or e-mail addresses 30 days
Idempotency responses Response to a repeatable request 24 hours

The Customer cannot set these periods. There is no automatic clean-up of customers, bookings or payments.

Free fields and uploads can hold any kind of data. The Customer decides that.

Annex 2. Subprocessors

See subprocessors.md.

Annex 3. Security measures

Separation between customers

  • Row Level Security is on for all tables in the public database schema.
  • Each row belongs to one customer. A public key is bound to one customer.
  • Server-side queries with the service key filter by customer themselves. That key never reaches the browser.
  • The roles owner, admin, front desk and staff determine access. A staff member only sees their own calendar.

Encryption and keys

  • Traffic runs over HTTPS. HTTP is redirected and HSTS is on.
  • Customers’ Mollie keys and webhook secrets are stored encrypted with AES-256-GCM, with a key (PAYMENT_SECRET_KEY) held only on the server.
  • API keys are stored only as a SHA-256 hash and shown once.
  • Passwords are stored hashed by the sign-in system. The sign-up page requires at least 8 characters.

Files

  • Uploads are in a private bucket. They can only be read through a signed link valid for 10 minutes.
  • JPEG, PNG, WebP and PDF are allowed, checked on the file’s content, up to 5 MB.

Public links

  • Booking, package and payment links use a random 48-character token and are not indexed.
  • Calendar feeds use such a token and can be revoked per staff member.

Limiting abuse

  • 120 requests per minute per IP address or API key, 20 bookings per minute.
  • Sign-in: 20 per minute per IP address, 10 per minute per e-mail address. Sign-up: 5 per hour per IP address. Authentication mails: 10 per hour per IP address, 3 per hour per e-mail address.
  • These limits apply per server process and start over after a restart.
  • Each Customer can set a list of allowed websites.

Webhooks

  • Outgoing webhooks are signed and contain only ids and status fields.
  • Addresses on private networks are refused.

Web security

  • The headers X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS and a Content-Security-Policy are on every application response. That CSP limits framing, base-uri and objects, but not yet scripts.

Backups and access

  • A database backup is made every night to a Hetzner Storage Box in Germany.
  • Administrative access to the server lies with Nise.

Not in place; the Customer cannot rely on these

  • No ISO, SOC or NEN certification.
  • No two-factor authentication in the Service.
  • No WAF, no virus scan of uploads, no script restriction in the CSP.
  • No application-level database encryption, except the keys named above.
  • No general activity log. Only write actions through the API are logged.

Annex 4. Data breach procedure

  1. Discover and record. Nise records what happened, when, which data and which Customers are affected.
  2. Stop. Nise takes immediate measures to stop the breach and limit further damage.
  3. Notify the Customer. Within 48 hours of discovery Nise mails the e-mail address of the account’s owner. Missing information follows as soon as possible.
  4. Content of the notice. Nature of the breach, the categories and estimated number of data subjects and records, likely consequences, measures taken and proposed, and a contact person.
  5. Decision. The Customer decides whether to inform the Dutch Data Protection Authority and the data subjects. Nise helps and does not report on the Customer’s behalf unless the law requires it.
  6. Close. Nise completes the investigation, records the cause and keeps a register of data breaches.

Contact for data breaches: info@nisebookings.com.