GDPR Data Processing
Agreement.

Role allocation

When you use Bouw Botje to connect Exact Online Construction to your AI assistant, you are the controller within the meaning of art. 4(7) GDPR. Industrial IT (trading as Bouw Botje) is the processor within the meaning of art. 4(8) GDPR. This Data Processing Agreement (DPA) governs the agreements between both parties in accordance with art. 28 GDPR.

Personal data processed

In the context of the Bouw Botje service, the following personal data may be processed insofar as present in your Exact Online Construction administration:

• Contact details of clients, suppliers, subcontractors and their contact persons (name, address, phone, email, Chamber of Commerce and VAT number, IBAN and G-account)
• Employee data (name, address, contact details, date of birth, job title, hourly rates, employment dates, hour registrations, leave and mileage registrations including licence plate)
• Project and transaction data with identifiable parties (project addresses, quotes, invoices, purchase invoices, contracts, delivery tickets, planning, daily and inspection reports, files)
• User account and authentication data (email, password hash, session data, tokens of connected AI clients)

Bouw Botje only processes this data to deliver the service.

Security measures

Bouw Botje applies appropriate technical and organisational measures (art. 32 GDPR):

• Connection to Exact Online Construction via an API key that is stored encrypted
• OAuth 2.1 with PKCE for AI clients connecting to the MCP server
• Own Bouw Botje user accounts; passwords are only stored as a hash
• HTTPS/TLS encryption of all data traffic
• Access tokens are valid for a maximum of 1 hour and are automatically refreshed
• Each administration has its own, separate database
• Hosting in the Netherlands (EEA) — no transfer of personal data outside the EEA
• Read-only by default; write access is enabled per user in Bouw Botje
• Logging of all MCP actions for audit-trail
• Option to immediately revoke the connection in Bouw Botje, or by generating a new API key in Exact Online Construction

Sub-processors

Bouw Botje engages the following sub-processors. For each sub-processor a data processing agreement has been concluded in accordance with art. 28(4) GDPR.

Not considered sub-processors of Bouw Botje: Exact Online Construction (the source administration, used on your instruction), Mollie B.V. (independent controller for payment processing) and the AI assistants you choose (ChatGPT, Claude, Copilot, etc.). The processing of prompts and responses by the AI provider falls under a separate legal relationship between you and that provider.

Retention periods

Personal data is retained for as long as the agreement is in effect. Upon termination of the subscription, or earlier at your request, the synchronised data is deleted within 30 days, unless statutory retention obligations dictate otherwise.

Data breaches

In the event of a security incident leading to a data breach, Bouw Botje will notify the controller without undue delay in accordance with art. 33 GDPR — in any case within 24 hours of discovery.

Rights of data subjects

Requests from data subjects under art. 15-22 GDPR (access, rectification, erasure, restriction, portability, objection) are primarily handled by the controller. Bouw Botje provides reasonable cooperation on request. See the FAQ section on security & privacy for more details.

Processor (Bouw Botje)