Data processingVerwerkersovereenkomst
Data processing agreementVerwerkersovereenkomst
Version 2026-10-27 · Last updated 27 October 2026. Part of the terms of service.Laatst bijgewerkt op 27 oktober 2026. Onderdeel van de algemene voorwaarden.
Deze verwerkersovereenkomst is in het Engels opgesteld en alleen de Engelse tekst geldt. Vragen? Mail [email protected].
1. Parties, roles and how this agreement applies
1.1 This agreement is between the Customer and Maturo.io, a trade name registered with the Netherlands Chamber of Commerce (KvK) under number 42051028, Coolsingel 104, 3011 AG Rotterdam, the Netherlands ("Maturo.io"). Words with a capital letter mean what they mean in the Maturo.io terms of service. "GDPR" means Regulation (EU) 2016/679. Personal data, processing, controller, processor, sub-processor, data subject and personal data breach have their GDPR meaning.
1.2 For personal data in Customer data, the Customer is the controller and Maturo.io is the processor. Annex 1 describes that processing.
1.3 Maturo.io is a controller, not a processor, for the personal data it collects for its own purposes: sign-in and account details needed to run the Platform securely, billing and contract records, and requests made on maturo.io. The privacy statement at maturo.io/privacy covers that data.
1.4 Scores in the peer benchmark are scores of companies, not of people. They are used only in anonymous averages and percentiles, as described in clause 6.3 of the terms. Anonymised, aggregated figures are not personal data and fall outside this agreement.
1.5 This agreement forms part of the terms of service. It applies from the moment the Customer accepts the terms or a quote, for as long as Maturo.io processes personal data for the Customer, and no separate signature is needed. If this agreement and the terms conflict on the protection of personal data, this agreement prevails.
2. Instructions and purpose
2.1 Maturo.io processes Customer personal data only to provide, secure and support the Platform for the Customer, and only on the Customer's documented instructions. The terms, this agreement and the Customer's use of the Platform's settings and features are those instructions.
2.2 Maturo.io does not process Customer personal data for its own purposes, does not sell it, and does not use it for advertising or to train models.
2.3 If EU or Dutch law requires Maturo.io to process the data otherwise, Maturo.io will tell the Customer before it does so, unless that law forbids it.
2.4 Maturo.io will tell the Customer at once if, in its opinion, an instruction breaks the GDPR or other data protection law. Maturo.io may then suspend that instruction until the Customer confirms or changes it.
2.5 The Customer is responsible for having a lawful basis for the personal data it puts into the Platform, and for informing the people it concerns, such as the founders and colleagues it invites.
3. Confidentiality and security
3.1 Only people who need it to provide or support the Platform may access Customer personal data, and each of them is bound to confidentiality. Today that is one person, the founder of Maturo.io. Maturo.io opens a Workspace's data only to fix a problem, answer a support request, or when the law requires it.
3.2 Maturo.io takes appropriate technical and organisational measures to protect Customer personal data against loss and unlawful processing, taking into account the state of the art, the cost, and the risks to the people concerned. Annex 2 lists the measures in place.
3.3 Maturo.io may improve the measures over time, but will not lower the overall level of protection during the agreement.
4. Sub-processors and transfers
4.1 The Customer gives general authorisation for Maturo.io to use sub-processors. The sub-processors in Annex 3 are approved by accepting this agreement.
4.2 Maturo.io will email the account owner at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. The parties will then look for a solution in good faith. If there is none, the Customer may end the agreement before the change takes effect and receive a pro rata refund of prepaid fees for the period after that date.
4.3 Maturo.io binds every sub-processor to data protection obligations at least as protective as this agreement, and remains responsible to the Customer for its sub-processors' performance.
4.4 Maturo.io keeps Customer personal data in the European Union where its providers allow it. Where a sub-processor or its group can access the data from outside the European Economic Area, the transfer rests on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's standard contractual clauses.
5. Assistance, breaches and audits
5.1 Requests from people. Owner admins can view, correct and remove users and company details in the Platform themselves. Where that is not enough, Maturo.io helps the Customer answer requests from data subjects to access, correct, delete, restrict, port or object. If a data subject contacts Maturo.io directly about Customer data, Maturo.io forwards the request to the Customer and does not answer it itself, unless the Customer asks it to.
5.2 Other help. Maturo.io gives the Customer the information it reasonably needs for a data protection impact assessment, a prior consultation with the Autoriteit Persoonsgegevens, or its security obligations, as far as it concerns the Platform.
5.3 Personal data breaches. Maturo.io tells the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice says what is known at that point: what happened, which categories and roughly how many people and records are affected, the likely consequences, and the measures taken or proposed. Maturo.io adds information as it becomes available, takes reasonable steps to limit the damage, and keeps a record of the breach. Notifying the authority and the people concerned is the Customer's decision.
5.4 Audits. Maturo.io makes available the information needed to show it meets this agreement, and answers reasonable written questions about it. If that is not enough, the Customer may have an audit carried out once a year, by itself or by an independent auditor bound to confidentiality, with at least 30 days' written notice, during business hours and without disrupting other customers. The Customer bears its own costs and pays for Maturo.io's time at a rate agreed in advance, unless the audit shows a material breach of this agreement. An audit never gives access to other customers' data.
6. End of processing, liability and precedence
6.1 When the agreement ends, the Customer can ask for an export of its Customer data within 30 days, as clause 5.4 of the terms says. After those 30 days Maturo.io deletes the Workspace and its Customer personal data, unless EU or Dutch law requires it to keep them. Copies in backups are overwritten within a further 30 days. On request Maturo.io confirms the deletion in writing.
6.2 Maturo.io's liability under this agreement falls under the limits in clause 10 of the terms, except where the GDPR or other law does not allow a limit.
6.3 This agreement ends when Maturo.io no longer processes Customer personal data. Clauses that by their nature continue, such as confidentiality and deletion, stay in force after that.
6.4 Maturo.io may update this agreement to follow a change in the law, a decision of a regulator or a change of sub-processors, in the way clause 11.1 of the terms describes. Dutch law applies, and disputes go to the District Court of Rotterdam (Rechtbank Rotterdam), as clauses 11.5 and 11.6 of the terms say.
Annex 1: description of the processing
| Topic | Description |
|---|---|
| Purpose | Providing the Platform: tracking the marketing maturity of the Customer's companies, inviting and signing in Users, reports, board packs and emails |
| Nature of the processing | Storing, organising, retrieving, displaying, emailing and deleting, by the Platform on the Customer's instructions |
| Data subjects | The Customer's Users (admins and analysts); founders and staff of tracked companies invited as company members; contact people the Customer records for a company |
| Categories of personal data | Name and work email address; role and the company a User belongs to; sign-in history (last sign-in, session cookie, IP address at sign-in); notes and assessments a User writes, where they mention people; credentials for connected sources (stored encrypted) |
| Special categories | None. The Platform is not meant for them, and the Customer will not enter them |
| Duration | The term of the agreement, plus the 30-day export period and the backup window in clause 6.1 |
| Location | Cloudflare data centres, with the database in Western Europe (see Annex 3) |
| Not covered | Company-level scores in anonymous peer figures (clause 1.4); Maturo.io's own account, billing and website data (clause 1.3) |
Annex 2: security measures
| Area | Measure |
|---|---|
| Sign-in | No passwords. A one-time sign-in link, valid for 15 minutes and usable once, sent only to addresses that already have an account. Sign-in requests are rate-limited per address and per IP address |
| Sessions | A random session id in a cookie that is HttpOnly, Secure and SameSite, expiring after 30 days. Removing a User ends their session on their next request |
| Separation | Every request is bound to one Workspace on the server, and every database query is limited to it. Company members only see their own company |
| Access by roles | Owner admin, analyst and company member roles, each with fixed rights. Only Maturo.io's superadmin can see across Workspaces, for support |
| Encryption | All traffic over HTTPS (TLS). Credentials for connected sources are encrypted with AES-GCM before they are stored. Cloudflare encrypts stored data at rest |
| Hosting | Cloudflare Workers, D1 and KV: no servers of Maturo.io's own to patch, with Cloudflare's network-level DDoS protection |
| Bot protection | Public forms are protected by Cloudflare Turnstile and rate limits |
| Backups and recovery | The database can be restored to an earlier point in time with Cloudflare D1's point-in-time recovery |
| Development | Code changes are tested before release. Secrets are kept as encrypted Worker secrets, never in the code |
| People | One person with access, the founder, using accounts protected with two-factor authentication |
Annex 3: sub-processors
| Sub-processor | What it does | Where the data is | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. (and Cloudflare Ltd.) | Hosting of the Platform, database (D1), sessions (KV), bot protection | Database in Western Europe; requests served from the nearest Cloudflare data centre | EU-US Data Privacy Framework and standard contractual clauses in Cloudflare's DPA |
| Resend (Plus Five Five, Inc.) | Sending the Platform's emails: sign-in links, invitations, digests, board packs | EU sending region | Standard contractual clauses in Resend's DPA |
| Google Ireland Ltd. (Google Workspace) | Maturo.io's mailbox, only for support emails the Customer sends and replies to them | EU and other Google data centres | EU-US Data Privacy Framework and standard contractual clauses in Google's data processing terms |