Bouw Botje processes personal data on your behalf as controller — in line with art. 28 GDPR. This page describes the agreements and sub-processors, and how to request a signed Data Processing Agreement.
When you use Bouw Botje to connect Exact Online Construction to your AI assistant, you are the controller within the meaning of art. 4(7) GDPR. Industrial IT (trading as Bouw Botje) is the processor within the meaning of art. 4(8) GDPR. This Data Processing Agreement (DPA) governs the agreements between both parties in accordance with art. 28 GDPR.
In the context of the Bouw Botje service, the following personal data may be processed insofar as present in your Exact Online Construction administration:
Bouw Botje only processes this data to deliver the service: the connection between Exact Online Construction and AI assistants, and showing and modifying data via the MCP protocol.
Bouw Botje applies appropriate technical and organisational measures (art. 32 GDPR):
Bouw Botje engages the following sub-processors. For each sub-processor a data processing agreement has been concluded in accordance with art. 28(4) GDPR.
| Sub-processor | Purpose | Location |
|---|---|---|
| Exact Online (Exact Holding NV) | Source administration (Exact Online Construction); data is retrieved via the official Exact API. | NL (EU) |
| Industrial IT (hosting) | Application and database server for Bouw Botje & MCP server. | NL (EU) |
| Mollie B.V. | Payment processor for subscriptions. | NL (EU) |
AI assistants (ChatGPT, Claude, Copilot, etc.) are not a sub-processor of Bouw Botje. When you query via the MCP connection, your AI assistant communicates directly with the Bouw Botje MCP server. The processing of prompts and responses by the AI provider falls under a separate legal relationship between you and that provider.
Personal data is retained for as long as the agreement is in effect. Upon termination of the subscription and revocation of the Exact Online connection, the mirrored data is deleted within 30 days, unless statutory retention obligations dictate otherwise (such as the invoicing records of Bouw Botje itself for 7 years).
In the event of a security incident leading to a data breach, Bouw Botje will notify the controller without undue delay in accordance with art. 33 GDPR — in any case within 24 hours of discovery.
Requests from data subjects under art. 15-22 GDPR (access, rectification, erasure, restriction, portability, objection) are primarily handled by the controller. Bouw Botje provides reasonable cooperation on request. See the FAQ section on security & privacy for more details.
Want to receive a signed Data Processing Agreement, tailored to your organisation? Get in touch via our contact form — mention "Data Processing Agreement" in the subject and the full legal name of your organisation + Chamber of Commerce number.
Industrial IT
Molecatenlaan 57A
7339 LJ Ugchelen, Netherlands
CoC: 67449727
VAT: NL001376060B08
Phone: +31 6 44236132