Data processing agreement

Version 1.0, 17 October 2026. Terms and conditions · Data processing agreement · Privacy and cookies · Disclaimer

Article 1. Why this agreement

When we manage a website, CRM, forms or email marketing for the client, we process personal data of its customers and contacts. Under the GDPR the client is then the controller and we are the processor. This agreement sets out how we handle that data. The processor is Zuidijk & marketingpartners, trading as Marketing Friends, known in English as Marketing Friends, Hohenheimstraat 66, 7323 RP Apeldoorn, the Netherlands, Dutch Chamber of Commerce KvK 76676528, VAT NL860741205B01.

This agreement forms part of our terms and conditions. It applies for as long as we process data for the client.

Article 2. Which data and for what purpose

• Data: name, email address, phone number, company name, messages from forms, notes, opportunities, whether someone wants to receive emails and which emails they received.
• Whose data: visitors, customers, members, donors and other contacts of the client.
• Purpose: receiving forms, keeping the CRM up to date, sending emails and automations on behalf of the client, hosting the website and measuring how the website performs.

We only process the data on the client's instructions and not for our own purposes. Do we believe an instruction violates the GDPR? Then we report this immediately.

Article 3. Security

We take appropriate measures to protect the data. The data is stored on a server in the Netherlands. Connections are encrypted. We store secrets such as keys and passwords encrypted. Only people who need it get access. Everyone at our company who works with the data is bound by confidentiality.

We make daily backups and keep the software up to date with updates.

Article 4. Sub-processors

We engage the following parties. With this agreement the client gives permission for this:

• Leaseweb, for the server in the Netherlands that hosts the website and the CRM.
• Postmark by ActiveCampaign, for sending emails. This party is based in the United States. Appropriate safeguards apply, such as the standard contractual clauses of the European Commission.

We announce a new sub-processor in advance. The client may object to it within 14 days on reasonable grounds.

Article 5. Data breaches

If we discover a data breach, we report it to the client within 48 hours. With what we know about the cause, the consequences and what we are doing about it. The client decides whether to report it to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, and to the data subjects. We help with this.

Article 6. Data subject rights and assistance

If someone asks the client for access to, correction of or deletion of their data, we help the client with this. In the portal the client can edit contacts, delete them and download them as a CSV file.

If such a request reaches us, we forward it to the client.

We cooperate with a reasonable audit of our compliance. The costs are borne by the client, unless it turns out that we did not comply with these agreements.

Article 7. End

After the agreement ends, the client can download its contacts as a CSV file for 30 days. After that we delete the data, including from backups as soon as they expire. Unless the law requires us to keep something longer.

The rules in our terms and conditions apply to liability.