Order Form and Services Agreement

Version 2026-06-25. Engage Data Consulting BV (Engage Compliance), KvK 82538638, Amsterdam.

Part A, Services Agreement

1. The service

Engage Data Consulting BV, trading as Engage Compliance ("Engage"), provides the outsourced Data Protection Officer service described in your Order Form, which is the plan, base fee, any add-ons, billing cycle, and currency shown at checkout. For the Essentials and Premium plans, Engage acts as your appointed Data Protection Officer. Engage provides the named DPO and the DPO's contact details, which you communicate to your supervisory authority as required by Article 37(7) of the GDPR. The Advisory plan is an advisory service only and does not include an appointed Data Protection Officer.

2. Independence and your role as controller

Where Engage acts as your DPO, it performs that role independently in line with Article 38 of the GDPR. You will not instruct the DPO on how to carry out the role and will not penalize or dismiss the DPO for performing it, you will involve the DPO properly and in good time, and you will give the access needed to do the job. The DPO is bound by secrecy or confidentiality in performing the role. You remain the controller and keep legal responsibility for your own compliance and for the decisions you take. Engage advises, monitors, and supports, but does not assume your legal obligations or your liability for your decisions.

3. Term and minimum commitment

The minimum term is 12 months from the start date. After the minimum term the subscription continues until either party ends it on three months' written notice, taking effect no earlier than the end of the minimum term.

4. Fees and payment

Fees are as shown at checkout and are stated excluding VAT. VAT is added at the payment step, or the reverse charge applies for business customers in the EU who provide a valid VAT identification number. A one-time setup fee applies to monthly plans on the first invoice and is waived on annual plans. Annual plans are billed yearly and include a 5 percent prepay discount. Fees may increase by up to 4 percent on each anniversary. All fees are non-refundable. Monthly plans are charged each month in advance by the payment method selected at checkout. If a payment fails or is not made when due, Engage may suspend the service after giving you reasonable notice and an opportunity to fix it.

5. Scope and included time

The scope, deliverables, and included monthly time for your plan are set out in your Order Form and the accompanying scope schedule. The Advisory plan includes up to 4 hours per month of asynchronous, email-based advisory support. Work beyond the included time is carried out only with your prior agreement and is charged at Engage's then-current hourly rates.

6. Your responsibilities and insurance

You give Engage timely access to the people, systems, and information it reasonably needs, and you remain responsible for the decisions you take and for implementing any advice. On the Essentials and Premium plans, you maintain professional and general liability insurance of at least €1,000,000, or the equivalent in your billing currency, for the duration of the agreement; this insurance requirement does not apply to the Advisory plan. Engage maintains professional indemnity insurance appropriate to the service.

7. Data protection

The Data Processing Agreement in Part B forms part of this agreement and governs any personal data Engage processes on your behalf in delivering the service. The independent DPO role described in section 2 is carried out under Article 38 and not as a processor acting on your instructions.

8. Confidentiality and intellectual property

Each party keeps the other's confidential information confidential and uses it only to perform this agreement. Engage's own reusable methodologies, frameworks, templates, and materials remain Engage's intellectual property, and your right to use those underlying materials is limited to the duration of the agreement. The compliance deliverables and work product Engage develops specifically for you, such as your records of processing, policies, and assessments, belong to you, and you may continue to use them after the agreement ends.

9. Liability

Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, or data. Engage's total liability under this agreement is limited to the lesser of the fees paid in the 12 months before the claim and the amount recoverable under its insurance. Nothing in this agreement limits liability that cannot be limited by law.

10. Termination

Either party may end this agreement as set out in section 3, or earlier if the other materially breaches it and does not remedy the breach within 30 days of written notice. On termination you pay all fees due up to the end of the agreement, and fees already paid are non-refundable. On termination Engage returns or deletes your personal data in line with Part B.

11. General

If there is any conflict, the Order Form prevails over Part A, and Part A prevails over Part B, except that Part B prevails on data protection matters. Notices may be given by email to the addresses on file. Neither party may assign the agreement without the other's consent, except to a group company or on a sale of the business. If any term is unenforceable the rest stands. Variations are effective only in writing. Neither party is liable for delay or failure caused by events beyond its reasonable control. This agreement and the Order Form are the entire agreement between the parties on the service.

12. Governing law

This agreement is governed by the law of the Netherlands, and the courts of Amsterdam have exclusive jurisdiction.

Part B, Data Processing Agreement

This schedule applies where Engage processes personal data on your behalf as a processor in delivering the service. It does not apply to the independent DPO role, which is governed by Article 38 and section 2 above. If your own data processing terms are agreed in the Order Form, those prevail over this schedule.

1. Subject matter and duration

Engage processes personal data to provide the service for the term of the agreement.

2. Nature and purpose

Processing is for providing the outsourced DPO and advisory service, including handling data subject requests, reviewing records, and advising on compliance.

3. Types of personal data and categories of data subjects

The personal data you make available in the course of the service, relating to your staff, customers, users, and other data subjects as applicable.

4. Instructions

Engage processes the personal data only on your documented instructions, including this schedule and the Order Form, unless required otherwise by law, in which case it tells you first where lawful. This does not limit the DPO's independence under section 2.

5. Confidentiality

Engage ensures the people processing the data are bound by confidentiality.

6. Security

Engage takes appropriate technical and organizational measures to protect the personal data, having regard to the risk.

7. Sub-processors

You give general authorization for Engage to use sub-processors, including for backup or coverage of the DPO role. Engage tells you of intended changes and gives you a chance to object, and it imposes equivalent data protection obligations on each sub-processor.

8. Assistance

Engage assists you, taking account of the nature of processing, with data subject requests and with your obligations on security, breach notification, data protection impact assessments, and prior consultation.

9. Personal data breach

Engage tells you without undue delay after becoming aware of a personal data breach affecting your data.

10. Return or deletion

At the end of the service Engage returns or deletes your personal data at your choice, unless law requires it to keep the data.

11. Audits and information

Engage makes available the information needed to show compliance with this schedule and allows for and contributes to audits on reasonable notice.

12. International transfers

Engage does not transfer the personal data outside the EEA without an appropriate transfer mechanism, such as the relevant standard contractual clauses.