Data Processing Agreement

1.1 On the basis of the General Terms and Conditions, this Data Processing Agreement (hereinafter: “Agreement”) forms an integral part of the main agreement between the following parties:

Data Controller — the Client: the organization using Hoeray’s services, hereinafter: “Client”.

Data Processor — Hoeray (trade name of The Circle of 10 B.V.), with its registered office at Danzigerbocht 45S, 1013 AM Amsterdam, the Netherlands, registered in the Dutch Commercial Register under Chamber of Commerce (KvK) number 92475809, VAT ID NL866064485B01, hereinafter: “Hoeray” or “Processor”.

Data subjects — the Client’s employees whose personal data is processed by Hoeray.

1.2 Capitalized terms used in this Agreement that are not defined herein have the meaning given to them in the General Data Protection Regulation (GDPR) or in Hoeray’s General Terms and Conditions.

2.1 This Agreement relates to the processing of personal data of the Client’s employees by Hoeray in the context of the main agreement.

2.2 The duration of this Agreement equals the term of the main agreement between the parties.

2.3 Obligations under this Agreement which by their nature are intended to survive termination — including in any event the obligations concerning confidentiality (Article 5(b)), return and deletion (Article 12) and demonstrating compliance with respect to the period during which processing took place (Article 11) — remain in force after termination of the main agreement until they have been fully performed.

3.1 Hoeray processes personal data of the Client’s employees for the purpose of sending gifts (including cards and flowers) based on HR data at milestones, including birthdays, work anniversaries, promotions, joining the company and leaving the company — in each case after approval by the Client through the monthly approval round.

3.2 The processing comprises collecting (through the HR integration activated by the Client or manual entry), storing, structuring, consulting, using and disclosing to the sub-processors listed in Article 6, insofar as necessary to perform the services, as well as erasure in accordance with Article 12.

3.3 Hoeray processes personal data solely on the basis of documented instructions from the Client, unless a legal obligation to which Hoeray is subject requires otherwise; in that case, Hoeray informs the Client thereof before the processing, unless that legislation prohibits such notification.

3.4 The following in any event qualify as documented instructions from the Client: the main agreement and this Agreement, the configuration the Client records in the dashboard (including the activated occasions and gift types), the activation of an HR integration by the Client, the Client’s monthly approvals and rejections, and additional written instructions (including instructions given by email).

3.5 If Hoeray is of the opinion that an instruction from the Client infringes the GDPR or other Union or Member State data protection provisions, Hoeray shall immediately inform the Client thereof and is entitled to suspend the execution of that instruction until the parties have reached agreement.

4.1 The following categories of personal data are processed:

• First name and last name
• Date of birth
• Address details (street, house number, postal code, city, country)
• Employment start date and employment end date
• Business email address
• Department and job title
• Language preference
• Delivery details of gifts sent (gift type, dispatch date, recipient name and delivery address in the delivery history)

4.2 In addition, Hoeray stores on the Client’s behalf the access credentials for the HR integration activated by the Client. These are stored in encrypted form (see Annex 1) and are used solely to perform the synchronization activated by the Client.

4.3 The data subjects are employees of the Client. This includes current employees and, insofar as relevant to the services, employees who have recently left employment.

Hoeray commits to the following obligations:

a) Instructions
Hoeray processes personal data solely in accordance with Article 3.

b) Confidentiality
Hoeray ensures that all persons who have access to personal data under its authority have committed themselves to confidentiality or are bound by an appropriate statutory obligation of confidentiality.

c) Security (Art. 32 GDPR)
Hoeray implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The current measures are described in Annex 1 (Security measures, set out in Article 9), which forms part of this Agreement.

d) Sub-processors
Hoeray engages sub-processors solely in accordance with the regime of Article 6.

e) Assistance with data subject requests (Art. 28(3)(e) GDPR)
Taking into account the nature of the processing, Hoeray assists the Client by appropriate technical and organizational measures in fulfilling the Client’s obligation to respond to requests from data subjects (access, rectification, erasure, restriction, portability and objection). If Hoeray receives such a request directly from a data subject, Hoeray forwards it to the Client without undue delay and does not handle it independently.

f) Assistance with security, data breaches, DPIAs and prior consultation (Art. 28(3)(f) GDPR)
Taking into account the nature of the processing and the information available to Hoeray, Hoeray assists the Client in complying with the Client’s obligations under Articles 32 to 36 GDPR: security of processing, notification of breaches to the supervisory authority and to data subjects, data protection impact assessments (DPIA) as well as prior consultation of the supervisory authority (Art. 36 GDPR).

g) Notification of data breaches
In accordance with Article 8.

h) Information and audits (Art. 28(3)(h) GDPR)
Hoeray makes available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allows for audits in accordance with Article 11.

6.1 The Client hereby grants Hoeray a general written authorization to engage sub-processors for the performance of the services.

6.2 The current list of sub-processors is set out in Article 6.6 and is kept up to date at hoeray.com/dpa.

6.3 Hoeray informs the Client at least thirty (30) days before the intended engagement of a new sub-processor or the replacement of an existing sub-processor, by email to the Client’s account owners.

6.4 Within this period of thirty (30) days, the Client may object to the intended change in writing, stating its reasons. In that case, the parties will consult on a reasonable solution. If no solution is reached and Hoeray proceeds with the change, the Client has the right to terminate the main agreement with effect from the date on which the new sub-processor is engaged, without being bound by the regular notice period; subscription fees already paid in advance for the period after termination will in that case be refunded pro rata.

6.5 Hoeray imposes on every sub-processor, by contract, the same data protection obligations as set out in this Agreement, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organizational measures. Where the sub-processor fails to fulfil its obligations, Hoeray remains fully liable to the Client for the performance of that sub-processor’s obligations.

6.6 At the time of entering into this Agreement, the following sub-processors are engaged:

The transfer mechanisms in this table were verified on 27 August 2026.

7.1 Hoeray transfers personal data to countries outside the European Economic Area (EEA) only where an adequate level of protection is ensured on the basis of:

• an adequacy decision by the European Commission (including the EU-US Data Privacy Framework for certified organizations); or
• Standard Contractual Clauses (SCCs) as adopted by the European Commission, where necessary supplemented with additional measures based on a Transfer Impact Assessment.

7.2 The transfer mechanism applied per sub-processor is stated in the table in Article 6.6. The Client may request a copy of the safeguards applied via hello@hoeray.com.

8.1 Hoeray notifies the Client of a personal data breach affecting the data processed under this Agreement without undue delay, and no later than 72 hours after establishing the breach, by email to the account owners.

8.2 The notification contains, insofar as known at that time: the nature of the breach, where possible the categories and approximate number of data subjects and personal data records concerned, the likely consequences, the measures taken and proposed, and a contact point for further information. Information not yet available is provided by Hoeray in phases as soon as it becomes available.

8.3 Hoeray documents all breaches, supports the Client in any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects, and does not independently report a breach to the supervisory authority or to data subjects on the Client’s behalf, unless the Client so requests or a legal obligation of Hoeray requires it.

The following technical and organizational measures have been implemented. This annex describes only measures that have actually been implemented and is updated in the event of material changes.

Encryption

• TLS encryption for all data in transit.
• Encrypted storage (AES-256-GCM) of sensitive secrets using a dedicated application key, including customers’ HR integration credentials and secrets for two-factor authentication.
• Passwords stored exclusively as an encrypted hash (bcrypt).

Access management

• Role-based access control and the least-privilege principle.
• The application accesses the database through a separate database role with restricted privileges.
• Two-factor authentication (TOTP) available to all users; the account owner can make two-factor authentication mandatory for all administrators and users of the organization.
• Internal system integrations (including automated tasks) authenticated using timing-safe verification.

Monitoring and continuity

• Daily automated monitoring of the service.
• Rate limiting against abuse of login and form routes.
• Regular data backups.

Organizational

• Confidentiality obligation for all persons with access to personal data.
• Separation of customer environments at database level (row-level security with enforced per-organisation access rules on all customer data tables), complemented by application-level separation and mandatory source checks on all HR synchronizations.

10.1 On first request, Hoeray makes available to the Client all information reasonably necessary to demonstrate compliance with the obligations under Article 28 GDPR and this Agreement.

10.2 Initial reasonable assistance with the obligations referred to in this Agreement is included in the services; Hoeray does not charge any costs for it. For assistance exceeding this (such as extensive DPIA projects or repeated extensive information requests), Hoeray may charge the actual reasonable costs, provided these are announced in advance.

11.1 The Client has the right to conduct audits, or to have them conducted by an independent expert bound by confidentiality, to verify compliance with this Agreement, subject to the following conditions:

• A maximum of one (1) audit per calendar year, unless a specific data breach or an instruction from the supervisory authority gives cause for an additional audit.
• The audit shall be announced in writing at least thirty (30) days in advance.
• The costs of the audit shall be borne by the Client, unless the audit shows that Hoeray is in breach of this Agreement on material points.
• The audit shall be conducted in a manner that disrupts Hoeray’s business operations as little as possible and does not provide access to data of other customers.

11.2 Hoeray cooperates with audits and provides the auditor with the information reasonably necessary for the audit.

12.1 At the Client’s written request, made upon or after termination of the main agreement, Hoeray shall within thirty (30) days, at the Client’s choice:

• return all personal data of data subjects to the Client in a common, machine-readable format and subsequently delete it; or
• delete all personal data of data subjects.

12.2 If the Client makes no request, Hoeray automatically deletes or anonymizes all personal data of data subjects — including the delivery details (recipient name and delivery address) in the delivery history — no later than ninety (90) days after the end of the customer relationship.

12.3 Hoeray confirms the deletion to the Client in writing.

12.4 By way of exception to the foregoing, Hoeray retains only the data subject to the statutory (tax) retention obligation of seven (7) years: invoices, the payment and credit records and the accounting data necessary for them. After the deletion pursuant to Article 12.1 or 12.2, these financial records no longer contain recipient names or delivery addresses of data subjects.

12.5 If the Client itself deletes the data of an individual data subject during the term of the agreement (for example after the employee leaves employment), Hoeray no longer processes that data, subject to the tax exception of Article 12.4.

13.1 The liability of the parties under this Agreement is subject to the limitations and conditions set out in the main agreement (Hoeray’s General Terms and Conditions), it being understood that nothing in this Agreement limits the rights of data subjects under the GDPR and that the statutory allocation of liability under Article 82 GDPR remains unaffected. In the event of a conflict between this Agreement and the General Terms and Conditions, this Agreement prevails insofar as damage in connection with the processing of personal data is concerned (Article 2.5 of the General Terms and Conditions).

14.1 Hoeray may amend this Agreement, for example in the event of changed legislation or changed services. Amendments are communicated to the Client by email at least thirty (30) days in advance, in accordance with the amendment clause in the General Terms and Conditions. Updates to the list of sub-processors follow the regime of Article 6.

14.2 Hoeray keeps a dated copy of every version; earlier versions can be requested via hello@hoeray.com.

15.1 This Data Processing Agreement is governed by Dutch law. Disputes arising from or in connection with this Agreement shall be submitted to the competent court in Amsterdam.