Terms and Conditions

Last updated on 10 May 2021

This document sets out the Terms and Conditions ("Terms") on which Assemble will provide access to its SaaS tools to Subscriber and provide related Services.

Table of Contents

Terms & Conditions

Data Processing Addendum ('DPA')

DPA Appendix 1: Details of the Processing of Personal Data

DPA Appendix 2: Sub-processors

Terms and Conditions

0. Definitions

The definitions in these Terms can be used anywhere in the Agreement. If a Document has a separate definition, then that definition will apply in relation to that Document. Where the word "including" is used in this Agreement, it should be interpreted as "including, but not limited to". Definitions for terms will apply to both singular and plural uses of the terms. Titles of articles and sub-articles in the Agreement do not affect the interpretation of the Agreement.

Access Rights Any personalized access rights for the SaaS that have been granted by the Subscriber, an End-User or on behalf of the Subscriber;

Administrator An End-User with the greatest role that Subscriber can grant to a single End-User in the SaaS and designated in the SaaS as an administrator;

Affiliate in respect of a Party, any entity that such Party Controls, is Controlled by or is under common Control with such Party (where 'Control means the direct or indirect ownership of at least fifty percent (50%) of the ownership or voting rights);

Agreement Any agreement between the Parties in relation to the provision of services to Subscriber, such as the agreement entered into when creating a Subscription;

Article Any article including its sub-articles;

Business Day Monday to Friday, except national holidays as customary in the Netherlands;

Company Account A section of the SaaS designated in the SaaS as a company account and intended to confine the Subscriber Data held under a single Subscription, but also used for other purposes, such as grouping End-Users;

Customer Subscriber;

Document Any part of the Agreement that can be seen as a single document, such as the Terms or a service level agreement;

Documentation the user manuals, administration guides, product specifications and integration specifications that are placed at the Subscribers disposal by Assemble relating to the SaaS and or a Functionality;

End-Users Anyone with Access Rights;

Functionality a function or possibility of the SaaS that is described in the Agreement or the Documentation, whether further divided into sub functionalities and/or sub possibilities or not;

Non-Renewal Notice A notice from any Party in relation to a Subscription that it does not wish for the Subscription Term in which the notice is given to be followed up by a new Subscription Term. Notice consists of the Party to cancel the Subscription through the SaaS tool;

Non-Web Offers Offers that aren't Web Offers (e.g. offers made by e-mail);

Party Subscriber or Assemble;

Assemble Assemble 33 BV, a private company with limited liability under the laws of the Netherlands with company number 74344684;

Assemble Content Any content made available by Assemble through its Services and Site;

SaaS The software-as-a-service that is provided to the Subscriber under these Terms, depending on the SaaS tool subscribed to by Customer (eg batch2sepa, Payroll-mate, and Orka);

Service Any service provided by Assemble under the Agreement;

Site www.asm33.nl and SaaS specific sites depending on the SaaS tool subscribed to by Customer (eg batch2sepa.eu);

Subscription A trial subscription or paid subscription for the SaaS;

Subscription Changes Downgrades, upgrades or changes of a Subscription agreed to by the Subscriber;

Subscription Term A period that the Subscription is committed to for, that may be preceded or followed by another such period;

Subscriber The person or legal entity that the Company Account is created for and entering into the Agreement or the successor/assignee of such a legal person;

Subscriber Data any data stored by Assemble on behalf of the Subscriber as part of the SaaS, excluding back-ups;

Support the provision of assistance and advice concerning the usage of Functionality;

Third Party Service Provider Third parties used by Assemble to provide, support or facilitate the Services;

Web Offers Any offers that are made through the Site or through the SaaS, that are not designated as 'special' or 'custom' or designated with similar terms.

1. Access to the Services

1.1 Availability

Assemble will make commercially reasonable efforts to ensure that the SaaS is available twenty-four hours a day, seven days a week.

1.2 Limits

Assemble retains the right to create limits on use and storage with respect to the Services at any time with or without notice, including to ensure the stability, legality, availability, scalability, usability, commercial viability and responsiveness of the services provided by Assemble to the Subscriber and to other customers of Assemble.

1.3 Subscriber Requirements

Subscriber warrants to Assemble that if Subscriber is an individual, he or she is at least 18 years of age. Subscriber also warrants that Subscriber is legally permitted to use the Services, and takes full responsibility for the selection and use of the Services.

1.4 Local Laws

Assemble makes no claim that the Services may be lawfully used or that Assemble Content may be uploaded or downloaded to and from the Services outside of the Netherlands. Access to Assemble Content may not be legal by certain persons or in certain countries. If Subscriber uses the Services from outside the Netherlands, Subscriber does so at its own risk and Subscriber is responsible for compliance with the laws and regulations of its jurisdiction(s).

1.5 Compatibility

Subscriber shall be responsible for obtaining and maintaining any equipment or ancillary services needed for Subscriber and any End-Users to connect to and use the Services, including modems, hardware, software, and long distance or local telephone service. Subscriber shall be responsible for ensuring that such equipment or ancillary services are compatible with the Services.

2. General Terms

2.1 Subscriber Details

The Subscriber warrants that it has provided all details necessary to legally identify the Subscriber to Assemble. Additionally the Subscriber will actively and accurately populate the SaaS with details relating to identification of the Subscriber and billing of the Subscriber and take reasonable measures to protect such details (including by maintaining the confidentiality of login credentials). The provision of credit card details is required if Subscriber opts for payments by credit card. There can be only one Subscriber under the Agreement.

2.2 Subscriber's Responsibility

Subscriber is responsible for any and all activity that occurs through or under Subscriber's SaaS.

2.3 Illegitimate Use

Any fraudulent, abusive, improper or unauthorized use of the Services or use in violation of the Agreement may be reason for Assemble, as it deems appropriate, to suspend, terminate or cancel Subscriber's right to use the Services or to access the Site. One person or legal entity may not maintain more than one free Company Account. Subscriber may not resell or otherwise provide the Services to any third party as a private label, with the inclusion of a mark-up fee or otherwise without the express written consent of Assemble. If approved by Assemble in writing, multiple Company Accounts may fall under a single Subscription. Assemble is not liable for any loss or damage resulting from Subscriber's failure to comply with the obligations set out in this article, including the loss of control over a Company Account.

2.4 Relationship to End-Users

For the sake of clarity and without prejudice to additional attribution to others, all use of Access Rights will be attributed to the Subscriber in the context of the Agreement. An End-User that is not the Subscriber does not derive any rights from these Terms.

3. Quality of Service Support

3.1 Service Level

Assemble will make commercially reasonable efforts to respond to all incoming Support requests within two Business Days.

3.2 Disproportionate Use

Assemble is only required to provide Support to End-Users in so far as Subscriber makes sure that requests for Support of End-Users are routed efficiently by the Subscriber and that Subscriber's End-Users do not disproportionately request Support. If Assemble determines, in its sole discretion, that Subscriber's End-Users are disproportionately requesting Support, then Assemble may require that the Subscriber appoints a single contact person for Support requests. Assemble's Support team is available via feedback@asm33.nl.

3.3 Onboarding and Training

Assemble will make commercially reasonable efforts to provide any onboarding and training Services if such is explicitly agreed to between the Parties.

4. Warranty and Disclaimer

4.1 Subscriber Representations, Warranties and Disclaimer

Subscriber represents and warrants that (a) the Subscriber has the right and capacity to enter into and be bound by the Agreement; (b) the Subscriber shall comply with all applicable laws and regulations in connection to Subscriber's use of the Services; (d) the Subscriber agrees to abide by these Terms in connection to the Services and the Site as provided by Assemble. Subscriber agrees to use the Services and the Site at Subscriber's own risk.

4.2 Assemble Warranties and Disclaimer


4.3 Third Party Interaction

Assemble may display or provide links or other interaction, including interoperation and integration, with third party websites, third party services and third party advertising banners on the Site and through the Services ('Third Party Interaction'). In particular, the Services may also provide the Subscriber with the opportunity to connect and publish Subscriber's information and/or data through third parties such as uploading to Subscriber s bank portal and connecting to Subscriber s payroll software. Use of any Third Party Interaction shall be at the risk of the Subscriber and third parties may require Subscriber to agree to additional terms and conditions for the use of such Third Party Interaction. Assemble may, at its sole discretion, with or without notice and at any time, disable any Third Party Interaction. Assemble cannot be held liable or responsible for Third Party Interaction including the quality, contents, terms of use and availability.

4.4 Custom Services

Subscriber understands and agrees that the services provided by Assemble to its customers may share the same underlying software, hardware and infrastructure and are intended for provision to many customers in a scalable manner. The Services will not be customized and/or tailored for Subscriber, unless, and in so far as, explicitly agreed to by the Parties.

5. Limitation of Liability

Subscriber expressly understands and agrees that Assemble is not liable for damages and/or losses resulting from: (i) the use or the inability to use the Services; (ii) the cost of procurement of substitute goods and services resulting from any goods, data, information or services purchased or obtained or messages received or transactions entered into through or from the Services; (iii) statements or conduct of any third party on the Services. ASSEMBLE SHALL NEVER BE LIABLE FOR INDIRECT OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, AND/OR LOSSES OF SUBSCRIBER AND/OR THIRD PARTIES. ASSEMBLE'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT WILL NOT EXCEED THE FEES (CALCULATED PRO RATA) FOR THE CONTINUED PROVISION FOR TWO MONTHS OF THE SAAS PROVIDED BY ASSEMBLE TO SUBSCRIBER UNDER THE AGREEMENT IMMEDIATELY PRIOR TO THE FIRST OCCURRENCE GIVING RISE TO SUBSCRIBER'S CLAIM(S) AGAINST ASSEMBLE ASSUMING SIMILAR MONTHLY USAGE ('LIABILITY CAP'). THE LIABILITY CAP APPLIES TO: (I) ANY DAMAGES; (II) ALL CLAIMS IN THE AGGREGATE, INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY, INDEMNITY, NEGLIGENCE, STRICT LIABILITY, MISREPRESENTATIONS, AND OTHER TORTS. The limitations as set out in this article will not apply in so far as liability cannot be limited under applicable laws and regulations, such as in the case of deliberate recklessness, fraud, or malintent of Assemble. The limitations specified in this article will apply even if any limited remedy specified in the Agreement is found to have failed of its essential purpose. Any limitations agreed upon under this article will also apply to the liability of Assemble's directors, officers, employees, contractors, agents and members.

6. Indemnification

Subscriber agrees to indemnify and hold harmless Assemble, its contractors, and licensors, and their respective directors, officers, employees, members, shareholders and agents from and against any and all third party claims, liabilities, losses, actions, causes of action, demands, reasonable costs and expenses, including but not limited to reasonable attorneys' fees, arising out of: (i) infringement of any intellectual property rights by Subscriber Data, or (ii) the use of Third Party Interaction by Subscriber. Assemble agrees to indemnify and hold harmless Subscriber and Subscriber's contractors, directors, officers, employees, members, shareholders and agents from and against any and all third party claims liabilities, losses, actions, causes of action, demands, reasonable costs and expenses, including but not limited to reasonable attorneys' fees, arising out of infringement of any intellectual property by the Services of Assemble. Any indemnification by Assemble or Subscriber under this article ('Indemnifying Party') is subject to (i) the other Party's ('Indemnified Party') prompt notification of such claim, (ii) Indemnifying Party's right to take sole conduct of the claim, (iii) no settlement may be entered into by the Indemnifying Party, without the express written consent of the Indemnified Party (such consent is not to be unreasonably withheld), and (iv) Indemnified Party's obligation to provide reasonable cooperation to Indemnifying Party's defense of the claim. The terms and conditions specified in this article will survive termination or expiration of the Agreement.

7. Modification of Services

Assemble reserves the right to make changes to the Services at any time in an effort to improve the Services in part or as a whole. If a change may have significant negative consequences for Subscriber's existing use of the Services as described in the Documentation of the Services, the change will be announced if possible. If substantial maintenance if required by Assemble to continue with the Service or if substantial new features are developed by Assemble, the fee increase limitation of article 9.2 does not apply.

8. Third Party Service Providers


9. Payments, Renewals, Refunds and Subscription Changes

9.1 Trials

Use of a Subscription is free during either (depending on the SaaS tool subscribed to by Customer (eg batch2sepa, Payroll-mate, and Orka); Subscriber's free trial period which is 14 days by default, or when the free credits issued during the trial have been used, unless the Parties agree otherwise or the Subscriber enters into a paid Subscription.

9.2 Payments

A valid credit card, direct debit approval or iDEAL, is required for paying fees, unless explicitly agreed otherwise or other payment methods are explicitly offered by Assemble for specific fees. Assemble may automatically charge fees for Services entered into Assemble's SaaS. All fees for a Subscription can be fully charged and are due on the first calendar day of each Subscription Term, unless specified otherwise by Assemble in the Agreement. Fees for all Services other than Subscriptions (eg top up credits) are immediately charged and due when the order is completed. Assemble may suspend Subscriptions if any fees for a Subscription or top up credits are overdue or payments bounce. Assemble may at each renewal of a Subscription increase its applicable fees, rates and prices for the Subscription with up to 10% in relation to the previous Subscription Term.

9.3 Duration and Renewal

Subscriptions are by default entered into for monthly Subscription Terms and renewed for the duration of the previous Subscription Term, unless explicitly specified otherwise in the Agreement. If the previous Subscription Term is more than 1 (one) year then the renewal Subscription Term will be 1 (one) year, unless explicitly specified otherwise in the Agreement. Subscriptions will be automatically renewed, unless a Party gives a Non-Renewal Notice 30 (thirty) calendar days in advance or a Business Day in advance in case of a Subscription with a monthly Subscription Term. A Non-Renewal Notice given by Subscriber will not affect renewals that have already been committed to by Subscriber. Any calculation of fees for renewals of Subscriptions will be based on fees excluding discounts.

9.4 Subscription Changes (Web Offers)

Subscription Changes for Subscriptions based on Web Offers paid by credit card will take effect immediately. In case of Subscription Changes related to Web Offers the start-date and end-date of the then-current Subscription Term will not be affected, unless the Subscription Change relates to the duration of the Subscription Term(s). If a Subscription Change relates to the duration of the Subscription Term(s) of a Subscription based on a Web Offer paid by credit card, then a new Subscription Term will commence immediately. Subscriber will not be refunded or credited in case of Subscription Changes. However, if fees have been paid by credit card for Subscriptions based on Web Offers, then in case of Subscription Changes the fees corresponding (calculated pro rata) to the part of an already paid for Subscription Term that lies in the future will be credited towards fees for future provision of Subscriptions.

9.5 Taxes and Currencies

All fees are exclusive of all taxes, levies, or duties imposed by taxing authorities, and Subscriber shall be responsible for payment of all such taxes, levies, or duties, excluding only taxes on the income of Assemble. All fees are in Euro ('EUR').

10. Termination and Suspension


General Termination of Services, and thereby also the Agreement in so far as it is connected to such Services, can take place in multiple ways. Subscriber can terminate the Services at any time at its convenience with immediate effect by notifying Assemble through the SaaS site. In case of such a termination (without prejudice to other terminations such as for breach): Subscriber will not be compensated for any damages arising out of the termination nor will any fees be refunded or credited and any fees for Subscription Terms (including renewals) that have been committed to will be due immediately (if not already). Assemble, in its sole discretion, has the right to at any time and without prior notice suspend or terminate Subscriber's Services and refuse any and all current or future use of the Services in case of a breach of the Agreement. Each Party may immediately terminate the Agreement if the other Party has been granted provisional suspension of payment or is declared bankrupt.

10.2 Deletion of Data

In case of termination of the Services by Assemble due to Subscriber s breach of the Terms, Subscriber's access to the SaaS is forfeited. Upon request Assemble will delete all Subscriber Data within 30 (thirty) calendar days after termination.

10.3 Legal Restrictions and Sanctions

Assemble may at any time, without prior notice, terminate the Services if Assemble is prohibited from providing the Services to Subscriber by a) the laws and regulations applicable to Assemble or b) any of Assemble's business partners or service providers due to governmental economic sanctions against any country or state.

11. Intellectual Property and Content

11.1 IP-rights and Licenses

No license for intellectual property rights is granted by Assemble.

11.2 Restricted Content

Subscriber agrees that it will not use the Services to process or store any content that (a) infringes, violates or otherwise interferes with any copyright or trademark of Assemble or a third party, (b) is libelous, defamatory, obscene, pornographic, abusive, indecent, threatening, harassing, hateful, offensive or otherwise violates any law or right of any third party, (c) contains a virus, trojan horse, worm, time bomb or other computer programming routine or engine that is intended to damage, detrimentally interfere with, surreptitiously intercept or expropriate any system, data or information. If requested by Assemble the Subscriber warrants that it will remove any Subscriber Data that is in violation of this article or the Agreement promptly after notification of the Subscriber by Assemble. Assemble reserves the right to remove any Subscriber Data from the Services that it, in its sole discretion, considers to be in breach of this article or the Agreement.

11.3 Confidentiality

Assemble will make commercially reasonable efforts to respect the confidentiality of Subscriber Data that is disclosed to Assemble exclusively through the SaaS. For example, confidentiality is required for certain finance related data but not required in relation publicly available data such as a company name. Subscriber will use the SaaS in line with best security practices. Such practices include maintaining the confidentiality of any login or access credentials, limited API access to connected Third Party tools as far as possible and as instructed by Assemble.

12. Privacy - Data Processing Addendum

The Data Processing Addendum ('DPA') available on Assemble's website (https://asm33.nl/terms) applies as an addendum to these Terms. The DPA will not apply to a Subscription if the Parties have duly executed another written data processing agreement/addendum that is applicable to such a Subscription.

13. Electronic Delivery Policy

Subscriber agrees that Assemble may provide Subscriber required notices as referred to in the Agreement and other information concerning the Services electronically, including by communicating to any End-User with an Administrator role on the e-mail address associated with his account or through notifications to such an End-User in the SaaS. Assemble is not responsible for e-mails to Subscriber or End-User "bouncing" or being rejected and other delivery failures that cannot be attributed to Assemble. Notices by Subscriber will be given by postal mail, registered letter or by any means that Assemble explicitly designates for specific notices.

14. Contracting Party, Governing Law and Disputes

Unless otherwise agreed, Assemble 33 BV will be the contracting party.

This Agreement or Subscriber s use of the Services shall be governed by the laws of the Netherlands, without regard to any conflict of laws principles. In that case any legal proceedings related to this Agreement and the Services provided by Assemble 33 BV shall solely be settled by the competent court of Amsterdam, the Netherlands.

15. Miscellaneous

15.1 Modifications of the Terms

These Terms may be modified by Assemble in its sole discretion from time to time. Any modification will be announced by publishing the new version of the Terms on Assemble's website (https://asm33.nl/terms). Modifications will enter into effect at the beginning of any subsequent Subscription Terms or when Subscription Changes take place. Assemble may explicitly indicate that foregoing modifications will enter into effect earlier, in such case Subscriber may terminate a Subscription immediately and receive a refund of pre-paid fees for the terminated portion of a pre-paid Subscription Term. Modifications to the Terms apply to any and all earlier versions of these Terms including Documents that were based on such versions.

15.2 Entire Agreement

The entire Agreement will only consist of these Terms, offers made by Assemble in writing, documents signed by Assemble or terms, conditions & offers explicitly agreed to by an authorized representative of Assemble in writing. The Agreement supersedes any and all prior or contemporaneous understandings or agreements, written or oral, regarding the subject matter thereof. Unless agreed otherwise between the Parties, in case of separate service level agreements or data-processing agreements between the Parties relating to the Services, those agreements will be added to these Terms as addenda.

15.3 Survival

For the sake of clarity, after termination the Agreement will remain in effect with regard to intellectual property, due payments, disclaimers, limitations of liability and any other subject matter that requires survival due to its nature and/or purpose.

15.4 Trials

Assemble reserves the right to terminate a free trial Subscription at any point in time for any or no reason.

15.5 Acceptance of Orders and Subscription Changes

Any acceptance of an order made through the Site or the SaaS can be retracted by Assemble within 2 Business Days, giving the Subscriber a right to a refund in relation to that specific order. Assemble's consent with Subscription Changes in relation to Subscriptions based on Non-Web Offers can only take place by non-automated means, including a personalized e-mail.

15.6 Waivers

The failure of either Party to exercise in any respect any right provided for under the Agreement shall not be deemed a waiver of any further rights under the Agreement.

15.7 Force Majeure

Assemble shall not be liable for any failure to perform its obligations under the Agreement where such failure results from any cause beyond Assemble's reasonable control, including mechanical, electronic or communications failure or degradation.

5.8 Severability

If any provision of the Agreement is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that the Agreement shall otherwise remain in full force and effect and enforceable.

15.9 Assignments and Use by Third Parties

Assemble is offering the Services solely for use or benefit of the Subscriber and its Affiliates and not for the use or benefit of any other parties. Additionally, this Agreement will bind and inure to the benefit of each Party's permitted successors and assigns. Neither Party may assign this Agreement without the advance written consent of the other Party, except that either Party may assign this Agreement in connection with a merger, reorganization, acquisition or other transfer of all or substantially all of such Party's assets or voting securities. In case of an assignment of the Agreement the Subscriber will notify Assemble 30 days in advance and comply with other obligations in the Agreement.

15.10 Independent Contractors

No agency, partnership, joint venture, or employment is created as a result of the Agreement.

15.11 Translations

Assemble might make versions of the Agreement available in languages other than English. If Assemble does, the English version of the Agreement will govern the relationship of the Parties and the translated version is provided for convenience only and will not be interpreted to modify the English version of the Agreement.

Questions about the Agreement should be sent to feedback@asm33.nl

Data Processing Addendum (DPA)

0. Definitions

Unless otherwise defined herein, all capitalised terms in this DPA shall have the meaning given to them in the Terms. The following terms shall have the following meanings in this DPA: Applicable Data Protection Law : any applicable laws and regulations of the European Union, the member states of the European Union and the United Kingdom protecting the fundamental rights and freedoms of individuals, and in particular the right to privacy with respect to the Processing of Personal Data, including, but not restricted to the GDPR and the UK GDPR, as such laws and regulations are amended, extended and re-enacted from time to time; GDPR : Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation); Controller , Data Subject , Personal Data , Process/Processing , Processor , and Supervisory Authority : shall have the same meaning as in the GDPR; Security Breach : a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed; Standard Contractual Clauses : any standard data protection clauses adopted or approved by the European Commission or another competent authority in accordance with Applicable Data Protection Law; Sub-processor : a Processor that has been engaged by Assemble to perform specific Processing activities on behalf of the Subscriber; Terms : the Assemble Terms & Conditions that the Parties have agreed to be applicable as made available in/on https://asm33.nl/terms (defined on the webpage as Terms); Third Country : any country outside of the European Economic Area ( EEA ); UK GDPR : the GDPR as incorporated into the law of the United Kingdom under the UK European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

1. General


This DPA is an addendum to the Terms and applies only in relation to any Processing of Personal Data by Assemble as a Processor on behalf of the Subscriber as Controller as described in DPA Appendix 1. This DPA may be modified by Assemble under the same terms and conditions that apply to modifications to the Terms.


The following documents form an integral part of this DPA: (i) this document and (ii) any document attached to this DPA that is labelled as a DPA Appendix . Any reference to the DPA shall be deemed to include a reference to said documents.


In the event of any inconsistency arising between the provisions of this DPA and the Terms, the provisions of this DPA shall prevail, unless explicitly mentioned otherwise in this DPA.


For the sake of clarity, this DPA will apply to any Processing of Personal Data by Assemble as Processor on behalf of the Subscriber as Controller as part of the Services under the Agreement, unless Parties have explicitly made other contractual arrangements relating to said Processing of Personal Data.

2. Processing of Personal Data


Assemble shall Process Personal Data on Subscriber s behalf in accordance with the instructions of the Subscriber provided through the use of the Services and as set out in DPA Appendix 1. The details of the Processing of Personal Data are specified in DPA Appendix 1.


Subscriber shall ensure that Assemble may lawfully Process the Personal Data on Subscriber's behalf in accordance with this DPA for the performance of the Agreement. Where required under Applicable Data Protection Law, Subscriber shall ensure that the Data Subjects have given their consent for the Processing and have been informed.


Subscriber's instructions for the Processing of Personal Data shall comply with Applicable Data Protection Law. If Assemble believes that any instruction of Subscriber infringes Applicable Data Protection Law, it will inform Subscriber without delay. Assemble shall be entitled to suspend performance on such instruction until Subscriber confirms or modifies such instruction. Assemble is not required to actively investigate whether instructions from the Subscriber are compliant with the Applicable Data Protection Law.


Assemble may be legally required under applicable laws and regulations to disclose Personal Data that it Processes to third parties such as authorities. If this is the case, Subscriber will be informed by Assemble insofar as permitted by applicable laws and regulations.

3. Security & Confidentiality


Assemble will implement and maintain appropriate technical and organisational measures to protect the Personal Data against destruction, loss or unauthorized access or other forms of unauthorized or unlawful Processing of Personal Data. These measures will ensure a level of security appropriate to the risks presented by the Processing and the nature of the Personal Data to be protected having regard to the state of the art and the cost of their implementation. Subscriber understands and agrees that these measures are subject to change and development and Assemble is therefore expressly allowed to implement alternative measures.


Subscriber has the sole responsibility to ensure that End-Users use the Services in line with best security practices and in accordance with Applicable Data Protection Law. Such practices include but are not restricted to maintaining the confidentiality of any login or access credentials.


Assemble shall ensure that personnel authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Third Country Data Transfers


Assemble will other then disclosed in DPA Appendix 2 - not transfer Personal Data to any Third Country, unless Assemble has obtained the prior written consent of the Subscriber.


The Subscriber agrees that in case no appropriate adequacy decision or any other appropriate data transfer mechanism applies for transfer of Personal Data to a Third Country and such transfer requires such a decision or mechanism under Applicable Data Protection Law, Assemble will enter into Standard Contractual Clauses. Subscriber hereby expressly authorizes Assemble to enter into Standard Contractual Clauses, (also) on its behalf as far as necessary, and commissions Assemble to enforce these Standard Contractual Clauses on the Subscriber s behalf where appropriate.


Nothing in this DPA will be construed to prevail over any conflicting clause of any Standard Contractual Clauses that have been entered into by Assemble including Standard Contractual Clauses entered into on behalf of the Subscriber.

5. Rights of Data Subjects


Subscriber will inform Data Subjects that it is the Controller and how Data Subjects may contact the Subscriber with requests. Assemble will not be that contact point. Assemble shall make an effort, to the extent legally permitted, to immediately notify Subscriber, if it receives a request from a Data Subject for access to, inspection, data portability, correction (rectification) or deletion (erasure) of Data Subject s Personal Data. Assemble shall not respond to any such requests of Data Subjects without Subscriber s prior written consent.


Assemble shall provide Subscriber with cooperation and assistance to allow Data Subjects to exercise any rights they might have under Applicable Data Protection Law, such as access, correction, deletion and/or data portability. Assemble will provide such cooperation and assistance only on Subscriber s request and only in so far as Subscriber cannot meet his obligations under Applicable Data Protection Law without Assemble s cooperation and assistance.

6. Data Breach Notification


Assemble shall, to the extent permitted by law, notify Subscriber without undue delay of a Security Breach with regard to the Personal Data Processed on behalf of the Subscriber under this DPA.


Such notification shall include at least: (a) a description of the nature of the Security Breach, including where possible, information that assists the Subscriber in determining the categories of and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) information available to Assemble that assists the Subscriber in determining the likely consequences of the Security Breach; and (c) a description of the measures taken or proposed to be taken by Assemble to address the security breach, including, where appropriate, measures to mitigate its possible adverse effects.


Subscriber is solely responsible for complying with any Security Breach notification obligations applicable to Subscriber. The performance of Assemble's obligation to report or respond to a Security Breach under this article is not an acknowledgement by Assemble of any fault or liability with regard to the Security Breach.

7. Sub-processors


Assemble may use Sub-processors to provide certain parts of the Services on Subscriber s behalf. The Subscriber hereby gives a general written authorisation to Assemble to engage any Sub-processor for the Processing of Personal Data. Assemble may only engage a Sub-processor if it has imposed, in writing, the necessary responsibilities and obligations on the Sub-processor as required by article 28 GDPR. Assemble may remove or appoint other suitable and reliable Sub-processors at its own discretion in accordance with this article. Assemble will give at least six weeks prior notice of any changes to the list of Sub-processors. The Subscriber can object to a Sub-processor by using its termination rights under the Agreement. If Subscriber does not terminate the Agreement within this timeframe, Subscriber is deemed to accept the respective Sub-processor. Where the Sub-processor fails to fulfil its data protection obligations, Assemble shall remain similarly liable to Subscriber for the performance of its obligations under this DPA.

8. Information & Audits


If Subscriber reasonably concludes that an audit or inspection of technical and organisational measures at Assemble s premises is necessary to monitor the compliance with this DPA in an individual case, Subscriber shall have the right to carry out such an audit or inspection provided such audit or inspection will be conducted (i) during regular business hours, and (ii) without interfering with Assemble s business operations, (iii) upon prior notice of at least 30 days in advance and further consultation with Assemble, (iv) all subject to (if not covered already by the Agreement) the execution of a confidentiality undertaking, and (v) at most once a year. Subscriber will bear its own expenses and compensate Assemble for the cost with regard to any internal resources required to conduct the audit. Such audit or inspection shall be carried out by the Subscriber or an inspection authority composed of independent persons in possession of the required professional qualifications, selected by the Subscriber. Subscriber will furnish immediately after the verification or inspection to Assemble a copy of the report of such audit.


Subscriber agrees that it will cooperate, together with Assemble, with Supervisory Authorities. Assemble will reasonably allow for and contribute to audits and inspections, conducted by Supervisory Authorities. Subscriber will notify Assemble immediately of any planned audits and inspections by Supervisory Authorities.


Assemble shall provide, upon written request, any such information and assistance the Subscriber may require for compliance with the Applicable Data Protection Law including to perform data protection impact assessments. Assemble will provide such information and assistance only in so far as Subscriber cannot meet its obligations under the Applicable Data Protection Law without Assemble s information and assistance.


Assemble may require Subscriber to sign a reasonable confidentiality agreement before complying with its obligations under this article.

9. Return of Personal Data


Upon termination of any Service, Subscriber s right to access or use the respective Service immediately ceases, and Assemble shall have no obligation to maintain any associated Personal Data. The Parties agree that Assemble shall in such event at the choice of the Subscriber either return all Personal Data to the Subscriber or shall destroy/delete all the Personal Data, unless prohibited from doing so by any applicable laws and regulations. If Subscriber doesn t make such a choice, then Assemble may delete Personal Data 30 days after the termination of the Service.


Assemble will, upon request of Subscriber and after the termination of the Service, declare in writing towards Subscriber that all copies of Personal Data have been permanently destroyed or returned to Subscriber.

DPA Appendix 1: Details of the Processing of Personal Data

Nature and Purpose of the Processing

Subscriber agrees to use the Services only for its intended use. Assemble shall on behalf of Subscriber Process Personal Data as part of the Services and pursuant to the Agreement.

Data Subjects

The aforementioned Processing of Personal Data will relate to the following Data Subjects: Subscriber's customers and suppliers (hereinafter collectively referred to as: Customers/suppliers); Subscriber's End User as employed by Subscriber (hereinafter referred to as: Employees);

Categories of Personal Data

Assemble shall on behalf of Subscriber Process or have access to the following categories of Personal Data relating to Customers/suppliers: Contact details, including names E-mail address Bank account information and other Personal Data relating to Customers/suppliers that is processed as part of the Services.

Assemble shall on behalf of Subscriber Process or could have access to the following categories of Personal Data relating to Employees: Contact details including name e-mail address and other Personal Data relating to Employees that is processed as part of the Services. If Subscriber when subscribing to Payroll-mate, in breach of the Terms & Conditions has not appropriately limited API access to its Third Party tools, the API key could also provide access to other employment related Personal Data. Assemble does not deliberately access or Process that data.

Assemble shall only Process the aforementioned Personal Data insofar as it falls under the Services, except when Personal Data has been anonymized and is used to improve the Services. The Subscriber or End-Users may provide Assemble with additional instructions regarding the Processing of Personal Data through their use of and within the limits of the Services. For example an end-user may choose in the SaaS to delete Personal Data relating to a Candidate. Subscriber is obliged to make sure that any instructions it gives including, but not limited to, those given on its behalf are compliant with applicable laws and regulations including, but not limited to, the GDPR.

DPA Appendix 2: Sub-processors

The Subscriber agrees that Assemble engages the parties listed below as Sub-processors:

Azure Storage Platform

Entity names: Microsoft Ireland Operations Ltd and its sub-processors

Data processing location: North Europe and / or West Europe


Entity names: Assemble 33 BV and affiliated companies

Data processing location: The Netherlands

Other details: These are the entities other than the contracting (Assemble) entity used to provide the Services

Account and marketing related e-mails

Entity names: The Rocket Science Group LLC d/b/a Mailchimp (together with its Affiliates, Mailchimp ) and its sub-processors

Data processing location: As per Mailchimp DPA, could include United StatesPayment services

Payment processing

Entity name: Stripe Payments Europe Ltd and its sub-processors

Data processing location: as per Stripe DPA, could be outside EU