Data processing agreement AxonContinuity

Version 1.0, 26 October 2026

Annex to the Terms AxonContinuity (version av-1.0).

1. Parties and roles

1.1. This data processing agreement is concluded between the Client that orders AxonContinuity (hereafter: you, the controller) and Axon Factory, a trade name of M. de Jager Holding B.V., Kweeklust 7, 2203 ZB Noordwijk, the Netherlands, Chamber of Commerce 60613319 (hereafter: Axon Factory, the processor).

1.2. You accept this agreement together with the Terms AxonContinuity, before paying. We record the version you accepted with your order. Capitalised words have the meaning given in those terms. Terms such as personal data, processing, data subject and personal data breach have the meaning given in the General Data Protection Regulation (GDPR).

1.3. This agreement only applies to the data in article 2. For the other order details, such as your e-mail address, company name and KVK number, Axon Factory is itself the controller. The AxonContinuity privacy statement applies to those.

2. Which data, about whom and for what

2.1. Data. The contact details you enter in the questionnaire:

• name and phone number of the crisis lead, the deputy, the person responsible for communication and the staff you list;
• name and phone number of your IT partner, your bank and the manager of your building;
• name, phone number and policy number of your insurer;
• phone numbers of your suppliers.

2.2. Data subjects. Your staff and the contact persons of your suppliers, IT partner, insurer, bank and building manager.

2.3. Purpose. Axon Factory processes this data only to put together the Plan and the Card and deliver them to you, and to put them together again within the retention period if you ask for it or if something went wrong. For nothing else.

2.4. Nature. Storing, encrypting, decrypting when putting the Documents together, including it in the Documents, showing it to you in your own questionnaire, determining per block whether it has been filled in, and deleting.

2.5. Duration. This agreement runs as long as Axon Factory holds the data of 2.1, and ends when it has been deleted under article 10.

3. Your instructions

3.1. Axon Factory processes the data only on your instructions. Your instruction is the order as the Terms describe it. You give any other instruction In Writing through support@axonfactory.ai.

3.2. If Axon Factory considers that an instruction infringes the GDPR or other data protection rules, it tells you immediately.

3.3. If Axon Factory must process data because the law requires it, it tells you in advance, unless the law prohibits that.

4. Your responsibility

4.1. You make sure you may use the data for the Plan and the Card, and that the data subjects know their data is used for that and appears on the Card.

4.2. You only enter what the Card needs: a name and a phone number, no home addresses, dates of birth or other data.

5. Confidentiality

Only Axon Factory and the persons it engages for this purpose have access to the environment where the data is held. Anyone with access on behalf of Axon Factory is bound to confidentiality in writing. The data is not shown in the AxonContinuity admin environment.

6. Security

Axon Factory takes these measures:

• the contact details are encrypted and stored separately from the other answers, with ASP.NET Core Data Protection; the keys are protected with a key in Azure Key Vault;
• decryption only takes place when putting the Documents together, to show the data to you again in your own questionnaire, and to determine per contact block whether it has been filled in; of the latter only "filled in" or "empty" leaves the application, never the data itself;
• the data is not in log files, not in mails and not in the admin environment;
• the data does not go to the language model: a check beforehand stops anything that looks like a phone number, e-mail address, IBAN or web address, and names of people are not sent;
• the Card is not attached to any mail; you download the Documents through a link that works for 7 days, with a release of 5 minutes per download;
• the Documents are kept in shielded storage that is not publicly reachable, with Azure's standard encryption; besides the deletion of article 10, that storage deletes them itself no later than 45 days after they were put together;
• the connection to the website uses https.

7. Sub-processors

7.1. You consent to this sub-processor:

7.2. Resend (the mails) and Anthropic (the language model) do not receive the data of article 2. Neither do Mollie and AxonHub.

7.3. If Axon Factory wants to add or replace a sub-processor for this data, it does so with a new version of this agreement, which applies to orders placed afterwards. For an ongoing order we first ask for your consent.

7.4. Axon Factory imposes the same obligations as in this agreement on every sub-processor, and remains responsible to you for that sub-processor.

8. Transfers outside the EEA

Axon Factory processes the data of article 2 within the European Economic Area (A11.3).

9. Assistance with your obligations

9.1. Rights of data subjects. You are the point of contact for data subjects. If Axon Factory receives a request itself, it forwards it to you. Axon Factory helps you with a request, for example by deleting the data earlier if you ask through support@axonfactory.ai.

9.2. Other obligations. Where reasonable, Axon Factory helps you with a data protection impact assessment or a question from the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) about this processing.

9.3. Information and audit. On request, Axon Factory gives you the information needed to show that it complies with this agreement. If you also want an audit, we agree the scope and timing in advance. An audit is at your expense and may not burden Axon Factory's business unreasonably.

10. Retention and deletion

10.1. Axon Factory deletes the data of article 2, and the Documents that contain it, automatically:

• 30 days after the Delivery;
• for an order that was not paid: 30 days after the questionnaire was started;
• if it was paid but not yet delivered: 30 days after payment.

A daily task carries out the deletion. As a safety net, the storage deletes the Documents in any case no later than 45 days after they were put together.

10.2. Deleted data remains in the database backups until the end of the retention period of those backups: 7 days. Those backups cannot be viewed separately and are only used to restore the service after a failure. Apart from those backups, Axon Factory keeps no copies.

10.3. You manage the Documents you downloaded yourself. You are responsible for them.

11. Data breach

11.1. If Axon Factory discovers a personal data breach involving the data of article 2, it notifies you without undue delay, and no later than 48 hours after discovery, at the e-mail address of the order.

11.2. The notification contains, as far as known: what happened, which data and how many data subjects are affected, the likely consequences, what Axon Factory is doing to limit the breach, and a contact person. Axon Factory adds what is not yet known as soon as it is known.

11.3. You decide whether to notify the Dutch Data Protection Authority and the data subjects. Axon Factory helps you with that.

12. Liability

The limitations of liability of article 13 of the Terms AxonContinuity and of A12 apply to this agreement, as far as the law allows.

13. Final provisions

13.1. If this agreement conflicts with the Terms AxonContinuity or the General Terms and Conditions of Axon Factory on the processing of the data of article 2, this agreement prevails.

13.2. This agreement is governed by Dutch law. A dispute is submitted to the court of article 15 of the Terms AxonContinuity.

13.3. This agreement exists in Dutch and English; in case of difference, the Dutch text prevails.