General Conditions of Travel Management Services
General Conditions for Travel Management Services version 10
A. Introduction
These General Conditions of Travel Management Services apply to all Travel Management Services that Munckhof provides in the area of travel under the General Travel Management Services Agreement. This can involve regularly facilitating tickets (such as for air travel), but also services facilitating overnight stays or other travel services.
Because Munckhof offers and performs these Travel Management Services for a Client professionally and under a general agreement as referred to in Book 7, Article 501(1)(c) of the Dutch Civil Code, the provisions of Part 7A of Book 7 of the Dutch Civil Code (Package Travel and Linked Travel Arrangements) do not apply to the legal relationship between Munckhof and the Client. Instead, this legal relationship is governed exclusively by these conditions.
Providing Travel Management Services is inextricably linked to processing Personal Data. The General Travel Management Services Agreement is also the processing agreement between Munckhof and the Client. Further details on processing personal data can be found in the ‘Personal Data Section’.
B. Contents
Article 1. Definitions
Article 2. Applicability
Article 3. Travel Management Services
Article 4. Offer and Order
Article 5. Price
Article 6. Term and termination
Article 7. Credit facility and financial securities
Article 8. Payment
Article 9. Changes to and cancellations of Orders
Article 10. Indemnity and liability
Article 11. Obligations of the Client and/or Traveller
Article 12. Assignment
Article 13. Complaints
Article 14. Data security and confidentiality
Article 15. Property rights
Article 16. Extinction of rights of action
Article 17. Other provisions
Article 1. General
Article 2. Personal data, categories, purpose and acquisition
Article 3. Use of personal data
Article 4. Provision of Personal Data to third parties
Article 5. Rights of Data Subjects
Article 6. Retention period, return, destruction and transfer of Personal Data
Article 7. Subprocessors
Article 8. Security and audits
Article 9. Duty to report data breaches and security incidents
Article 10. Liability in connection with Personal Data
C. General Section
Article 1. Definitions
1.1. Offer: Munckhof’s proposal to the Client for a Travel Service Provider to provide or perform a Travel Service for the Client and/or Traveller(s).
1.2. General Conditions: These General Conditions of Travel Management Services.
1.3. Munckhof: Munckhof Business Travel Venlo BV, which for this purpose (a) assumes the capacity of intermediary and (b) is the processor of personal data.
1.4. Order: The agreement concluded between the Travel Service Provider and the Client, for which Munckhof acts as an intermediary at the Client’s expense and risk.
1.5. Order Confirmation: a written confirmation from Munckhof to the Client of one or more Orders.
1.6. Client: the legal entity or group of legal entities and/or the natural person acting in the course of a profession or operating a business that (a) instructs Munckhof to provide Travel Management Services and (b) is the controller of personal data.
1.7. Agreement: The General Travel Management Services Agreement concluded between Munckhof and the Client.
1.8. Party or Parties: the Contractor or the Client, individually or jointly.
1.9. Travel Service: Transporting people (by plane, bus, boat, train and so on), providing accommodation, hiring vehicles intended for passenger transport and all other services that may be part of – or connected with – travel.
1.10. Travel Service Provider: the carrier, accommodation provider or other service provider with which the Client enters into an agreement to provide a Travel Service and which is responsible for performing the Travel Service, subject to its applicable conditions.
1.11. Traveller: the person (or persons) to whom one or more services are provided under the agreement concluded with the Client.
1.12. Working days and office hours: Mondays to Fridays from 8:30 AM to 5:30 PM, excluding recognized public holidays.
Article 2. Applicability
2.1. The General Conditions govern the legal relationship between Munckhof and the Client.
2.2. The exclusions and/or limitations of Munckhof’s liability specified in the Agreement and the General Conditions also benefit Munckhof’s employees, agents and intermediaries.
2.3. The applicability of the Client’s general conditions is expressly excluded.
2.4. The Agreement – with these General Conditions – sets out the full arrangements between the Client and Contractor relating to the Travel Management Services for which the Agreement has been concluded.
Article 3. Travel Management Services
3.1. Munckhof’s services include providing travel information and advice in the broadest sense, as well as performing all acts that arise from Orders.
3.2. Travel Management Services can involve a ‘Hands-On’ or ‘Hands-Off’ procedure. Under the ‘Hands-on’ procedure, an expert consultant provides a full service to the Client by telephone or email. Under the ‘Hands-Off’ procedure, the Client can independently compile and accept (‘book’) an Offer through Munckhof’s online system ‘i:Mo’.
Article 4. Offer and Order
4.1. Munckhof’s Offer is without obligation and Munckhof can withdraw it, even after acceptance. Withdrawal must occur as soon as possible and within two working days of the date of the Order. This provision applies by analogy to an Offer or Order that amends an existing Order.
4.2. An Order is created when the Client accepts Munckhof’s Offer. Acceptance can be in writing or oral. Payment in any case serves as proof that the Client has accepted Munckhof’s offer.
4.3. Munckhof’s Offer can relate to several Travel Services. Acceptance of this Offer will result in several Orders.
4.4. Munckhof may perform all acts arising from the Order as soon as the Client has accepted the Offer.
4.5. After accepting the Offer, the Client is bound by it. If Munckhof provides a confirmation, this serves as proof of the content of the Order.
4.6. If Munckhof acts on behalf of the Client in relation to an Order, the Client always enters into the agreement with the Travel Service Provider. This Travel Service Provider’s conditions apply to that agreement and the Client already accepts these conditions in advance.
4.7. Munckhof need not execute an Order even after the expiry of the term referred to in the first paragraph if and insofar as the Offer and/or the written Order Confirmation are based on an obvious error or mistake.
Article 5. Price
5.1. The prices that Munckhof mentions or quotes in the Offer and/or the Order Confirmation are based on the Travel Service Provider’s price determinants known on the date and time of the Order.
5.2. If the price determinants – including, but not limited to, transport costs, taxes, levies, surcharges and/or currency changes – increase after an Offer has been made or after the date of the Order, and the Travel Service Provider passes on these increases, Munckhof may alter the Offer or charge these price changes to the Client.
5.3. The Client agrees that Munckhof will adjust the agreed rates on 1 January of each calendar year in accordance with Service Price Index (SPI) of Statistics Netherlands’ most recently published annual change. The new rates will be rounded off arithmetically to 10 eurocents and will be determined no later than 31 December of each year.
Article 6. Term and termination
6.1. Unless agreed otherwise, the Agreement is open-ended.
6.2. If the Agreement is entered into for a fixed term, it will be continued each time for the same period as the period that has passed after the penultimate start date or extension date of the Agreement and the next extension date.
6.3. The Agreement is terminated through giving notice by registered letter effective from the end of the agreed term, with due observance of a minimum six-month notice period.
6.4. Any Party may terminate this Agreement early, without observing a notice period or giving reasons if a Party:
a) petitions for their own bankruptcy, a third party petitions for their bankruptcy, they have been declared bankrupt, or they are or will become subject to the application of the Wet Schuldsanering Natuurlijke Personen (Debt Restructuring (Natural Persons) Act);
b) has been granted a moratorium on the payment of debts, petitions for a moratorium or a third party petitions for them to be granted a moratorium;
c) ceases or liquidates their business;
d) has prejudgment attachment or attachment in execution levied on a substantial part of their assets, movable and/or immovable property or other property and there is reasonable doubt as to whether that Party will or can meet their payment obligations under this Agreement or ensuing agreements;
e) demonstrably fails to fulfil their obligations under the Agreement and does not remedy this attributable failure within thirty (30) days of a written notice of default to that effect.
6.5. Munckhof may terminate the Agreement early if the Client, after a request by Munckhof, is unable or unwilling to provide financial security, or additional financial security, within a reasonable period that Munckhof sets.
6.6. Obligations that by their nature are intended to continue even after the termination of the Agreement continue to apply after the termination of the Agreement. These obligations include those that arise from the provisions on confidentiality, transfer and destruction, liability and applicable law.
Article 7. Credit facility and financial securities
7.1. Payment for almost all Orders will be made to the Travel Service Provider through Munckhof. Munckhof may grant the Client a maximum credit facility for this purpose and/or require the Client to provide further financial securities.
7.2. Munckhof will grant the Client a reasonable period within which to provide financial securities, or additional financial securities, unless this results in an unreasonable financial risk for Munckhof.
7.3. Munckhof may temporarily suspend its services if the amounts it is owed by the Client collectively exceed the maximum credit facility.
Article 8. Payment
8.1. The Client is liable for all obligations arising from an Order, even if they entered into these obligations on behalf of or for a third party.
8.2. If an Agreement applies to several Clients, these Clients are jointly and severally liable towards Munckhof for performing that Agreement.
8.3. The Client has no right of suspension or setoff. Section 7, Part 1 of Book 6 of the Dutch Civil Code is expressly excluded. If the Client disputes one of Munckhof’s invoices, they may not suspend or fail to comply with their obligations.
8.4. All dealings (including payment transactions) between the Traveller(s) and Munckhof are exclusively through the Client.
8.5. Payment must be made in the manner Munckhof specifies and within the period stated on the invoice unless the Parties have agreed otherwise in writing or it follows from the nature or characteristics of the Travel Service that payment must be made directly. If a payment period is not stated on the invoice, payment must be made within fourteen (14) days of the invoice date.
8.6. All costs related to the method of paying Munckhof and/or the Travel Service Provider are payable by the Client, including credit card surcharges.
8.7. If full payment is late, the Client is in default by operation of law. If the Client is in default, Munckhof will send a demand for payment setting a period of 14 days for the Client to fulfil their obligations, also stating that if payment is not received, Munckhof may also claim compensation of the costs to determine damage and liability and to obtain payment out of court.
8.8. If the Client has not paid on time, they will owe statutory interest on the amount owed from the date of default. As from the fifteenth day after the demand for payment, the Client must also pay extrajudicial collection costs. These extrajudicial costs are capped at 15% on a travel sum up to €2,500.00, subject to a minimum of €100.00; 10% on the next €2,500.00; 5% on the next €5,000.00 and 1% on the excess.
8.9. If the Client is in default, Munckhof may – partly to limit further damage – terminate (cancel) the Travel Services contracted for the Client and temporarily suspend providing Travel Management Services to the Client. Besides the costs that third parties have already charged or charge because of the termination (cancellation), the Client will then also owe Munckhof the fee agreed with Munckhof for its services. Any part of the amount due that has been paid in advance will be set off against these costs.
8.10. Payments made to Munckhof first serve to reduce costs, including extrajudicial and judicial costs, followed by interest due and, lastly, the principal amount (with older receivables paid before new ones).
8.11. Munckhof shall pass on any refunds due to the Client that it receives from a Travel Service Provider as soon as possible after any outstanding items are settled. Munckhof shall try to collect these refunds for the Client without assuming any obligation to achieve a result in this regard.
Article 9. Changes to and cancellations of Orders
9.1. Changes and cancellation by the Client
9.1.1. If the Client wishes to make changes to an Order, this is possible only if the Parties reach agreement for this purpose and the Client pays the costs associated with this change.
9.1.2. If the Client terminates (cancels) an Order, they must pay all related costs charged by the Travel Service Provider and Munckhof and still pay Munckhof its agreed fee.
9.1.3. The Client must terminate (cancel) an Order in writing. The Order and the Travel Service(s) included in it are deemed to have been terminated (cancelled) on the day that Munckhof receives the written notice of termination by and from the Client. Notices of termination given outside office hours are deemed to have been received on the next working day.
9.2. Changes and cancellation by the Travel Service Provider
9.2.1. If and insofar as a Travel Service Provider makes changes to the Order, or terminates (cancels) the Order, Munckhof is not liable to the Client for the Client’s resultant damage or loss.
9.2.2. Munckhof shall make every reasonable effort to seek alternatives to the altered and/or terminated Order, without being able to guarantee this. The other Orders mentioned in the same Order Confirmation remain in force.
Article 10. Indemnity and liability
10.1. Munckhof shall take account of the Client’s and Traveller’s interests as carefully as may reasonably be expected in the given circumstances.
10.2. If Travel Services or Orders are combined, Munckhof is not liable for the risk that these Travel Services or Orders are mismatched.
10.3. Notwithstanding the provisions of article 9.2 , Munckhof accepts no liability for the acts and/or omissions of Travel Service Providers involved in performing the Travel Services.
10.4. Munckhof also does not accept liability if an Order cannot be executed because of circumstances not attributable to Munckhof (‘Force Majeure’).
10.5. Force majeure means a failure to fulfil any obligation because of unforeseen circumstances that cannot be prevented despite all reasonable precautions, specifically, but not limited to, technical faults in the systems used in contracting the travel service(s), changes that the Travel Service Provider makes to the trip and/or cancellation by the Travel Service Provider.
10.6. Munckhof accepts no liability for the accuracy of the information provided by or on behalf of Travel Service Providers or other third parties.
10.7. If the Client suffers damage because of an attributable failure by Munckhof, Munckhof accepts liability limited to the value of the Order to which the complaint applies and capped at the amount that Munckhof’s business liability insurer pays in the case concerned plus the amount of Munckhof’s excess that is not covered by the insurer under the policy conditions.
10.8. Munckhof is not liable for a Travel Service Provider’s inability to pay its debts.
10.9. Munckhof does not accept any liability for damage covered by health, accident, travel and/or cancellation insurance of the Client or of a Traveller participating in a trip.
10.10. Munckhof is never liable to compensate indirect damage – including, but not limited to, consequential damage, loss of profit, loss of income, missed savings and business interruption loss – or damage that the Client and/or the Traveller suffers in the course of their profession or operating a business.
10.11. The Client indemnifies Munckhof against claims by Travellers and/or Travel Service Providers and/or other third parties arising from or related to an Order.
10.12. The Client is jointly and severally liable for all obligations of the Traveller(s) towards Munckhof and/or the Travel Service Provider insofar as these arise for the Traveller(s) from an Order.
Article 11. Obligations of the Client and/or Traveller
11.1. Before the Order or as soon as possible afterwards, the Client shall provide all personal and other data relating to themselves and the Traveller(s) required to properly perform the agreed Travel Services.
11.2. The Client and/or the Traveller shall obtain the necessary information from the authorities concerned regarding passport requirements, visas or other formalities relating to health risks and so on, and also check in due time before departure whether that information is still correct.
11.3. The Client and Traveller(s) shall comply with all instructions given by Munckhof and Travel Service Providers to help properly perform the travel service(s) – including, but not limited to, instructions regarding check-in times and transfer times – and are liable towards Munckhof and/or the Travel Service Provider for damage resulting from, or otherwise related to, their conduct and/or negligence. They must also bear their own resultant damage.
11.4. If a Traveller causes such hindrance or inconvenience that properly performing the Travel Service(s) is or could be made more difficult, Munckhof and/or the Travel Service Provider may exclude them from the Travel Service(s) or from continuing the Travel Service(s), if Munckhof and/or the Travel Service Provider cannot reasonably be required to execute the Order. All resultant damage is at the Client’s expense.
11.5. The Client and the Traveller(s) shall prevent any damage or further damage and/or limit it as much as possible, including by promptly reporting complaints in accordance with the provisions of 0.
Article 12. Assignment
12.1. Unless expressly stipulated in the Agreement or these General Conditions, a Party cannot assign the rights and obligations under the Agreement to a third party without the other Party’s prior written consent.
Article 13. Complaints
13.1. Complaints about Travel Management Services
13.1.1. The Client shall submit any complaints about Munckhof’s services (e.g. providing advice and information and handling reservations) in writing with reasons, within one month of becoming aware of the facts to which the complaint relates.
13.1.2. Munckhof shall deal with the complaint with the necessary expeditiousness.
13.2. Complaints about the performance of Travel Services
13.2.1. The Client shall immediately report any complaints relating to the performance of the Travel Service to the Travel Service Provider or its representative and first try to reach a solution with the Travel Service Provider or its representative locally.
13.2.2. The Client shall always give the Travel Service Provider the opportunity to come up with an appropriate solution to the complaint.
13.2.3. If the complaint cannot be resolved locally with the Travel Service Provider or its representative, the Client shall contact Munckhof without delay. Munckhof shall then try, as far as reasonably possible, to resolve the complaint satisfactorily.
13.2.4. Munckhof shall mediate in disputes between the Travel Service Provider and the Client about the performance of the Travel Service without becoming a party to the dispute itself.
13.2.5. If the complaint cannot be resolved satisfactorily locally, it must be submitted to the Travel Service Provider or Munckhof in writing with reasons, as soon as possible, but no later than one month after return. Munckhof shall forward the complaint – insofar as it relates to the performance of the Travel Service – to the Travel Service Provider for further handling. Both the Travel Service Provider and Munckhof shall try to deal with the complaint with the necessary expeditiousness.
Article 14. Data security and confidentiality
14.1. The Client shall maintain the confidentiality of all information that they have learnt or is provided to them under this Agreement or that has been obtained in any other way, for three years after the Agreement ends, or until the data provided has become public knowledge, through no acts or omissions of the Client.
14.2. The Client does not have to maintain confidentiality of those parts of the information provided by Munckhof that they can prove to Munckhof’s satisfaction were already public knowledge or already in their possession before this information was obtained from Munckhof.
14.3. Munckhof shall maintain the confidentiality of all Personal Data and information that it processes under the Agreement, except insofar as such data or information are obviously not of a secret or confidential nature or are already generally known.
14.4. Insofar as Munckhof uses external parties for data storage, software, system development and other technological systems, Munckhof shall cooperate mainly with ISO 27001-certified parties and, if this party works with the Client’s payment data, PCI DSS-certified parties.
Article 15. Property rights
15.1. All intellectual and other property rights, including copyrights, database rights and all further intellectual property rights, as well as similar rights to protect information about Munckhof’s products and services, always vest in Munckhof. The Client acknowledges Munckhof’s intellectual property rights and undertakes not to contest their existence.
15.2. All intellectual and other property rights, including copyrights, database rights and all further intellectual property rights, as well as similar rights to protect information about the collection of data and Personal Data, copies or adaptations, always vest in the Client. Munckhof acknowledges the Client’s intellectual property rights and undertakes not to contest their existence.
Article 16. Extinction of rights of action
16.1. Any right of action in respect of Munckhof’s liability ceases to apply at the end of one year, calculated from the moment the Order was executed or the Travel Management Service was provided.
Article 17. Other provisions
17.1. Unless the context demands otherwise, words in the singular also mean plural and vice versa.
17.2. Reference to ‘written’ or ‘in writing’ in these General Conditions includes by electronic means (such as emails).
17.3. If any provision of these General Conditions (General Section and Personal Data Section) and the Agreement are incompatible, this order of precedence applies, with one provision taking precedence over the other:
a) The Agreement
b) The General Conditions, Personal Data Section
c) The General Conditions, General Section
17.4. If and insofar as one or more provisions of the Agreement and/or the General Conditions are incompatible with mandatory statutory provisions, the latter provisions will be deemed to have replaced the relevant provisions or part of the provisions of the Agreement and/or General Conditions, notwithstanding the validity of the other provisions of the Agreement or General
Conditions.
17.5. Munckhof may amend these General Conditions unilaterally. In that case, Munckhof shall inform the Client of the amendments at least one month before the new General Conditions take effect, unless it is necessary, at Munckhof’s discretion, to have the amendments take effect earlier.
17.6. Additions to – or amendments of – the provisions of the Agreement or these General Conditions are binding only to the extent that they have been agreed in writing between the Parties.
17.7. Dutch law applies to all disputes between the Client and Munckhof.
17.8. The court in the judicial district where Munckhof has its registered office has jurisdiction to hear all disputes between the Parties, unless Munckhof chooses the competent court of the Client’s place of residence or registered office.
17.9. If there is a difference in meaning between the General Conditions in Dutch and the General Conditions drawn up in another language, the Dutch version of the General Conditions will prevail.
D. Personal Data Section
Article 1. General
1.1. The terms used in this section are defined in the General Data Protection Regulation1 (‘GDPR’) and have the meaning attributed to them in the GDPR;
1.2. While providing the Travel Management Services, Munckhof will process personal data on behalf of the Client. As the Parties independently determine the purpose and means of processing personal data, they independently qualify as Controllers within the meaning of Article 4, introduction and under 7 GDPR;
1.3. The Parties are committed to adequately protecting the personal data of the Data Subjects whose personal data are processed;
1.4. These personal data can relate to Travellers and persons (employees) who will act as contact persons for Munckhof on behalf of the Client;
1.5. Notwithstanding the rights a data subject has with respect to personal data that Munckhof processes, the Client will always be the primary point of contact for the Travellers and contact persons referred to in the previous paragraph.
Article 2. Personal data, categories, purpose and acquisition
2.1. Munckhof will process these categories of personal data of data subjects:
a) Surname and first name as in passport
b) Date of birth
c) Identify document number
d) Contact information, such as mobile phone or landline number, email address
e) All travel information of the Orders used by a data subject
f) Other information that the data subject voluntarily provides to Munckhof to include in their travel profile (e.g. seat and meal preferences, frequent flyer membership(s), and so on)
2.2. The purpose of processing the personal data referred to above is to guarantee proper performance of the General Travel Management Services Agreement and the Orders arising from it.
2.3. The Client warrants to Munckhof:
a) that explicit consent has been obtained from the Traveller(s), or their parents/guardians insofar as a Traveller is younger than 16, whose personal data the Client provides to Munckhof for processing
b) that Orders for several Travellers for the same Travel Services may result in Travellers having access to each other’s personal data, such as names, contact details, a number from the relevant identity document, dates of birth and any meal options of data subjects, caused by the procedures and design of Travel Service Providers’ systems
c) that they will provide the Traveller(s) with all information required by law before obtaining the consent referred to above, including at least this information:
i) which personal data they will provide to Munckhof
ii) that the Travel Service Providers or other third parties, including airlines, to which Munckhof provides personal data to provide the Travel Services, may be required to provide certain personal data to third countries, international organizations or Travel Service Providers located outside the European Economic Area (EEA) that do not provide privacy protection comparable to that provided by EEA countries under the GDPR, including, but not limited to, the US Bureau of Customs and Border Protection
iii) that within the limits of the applicable laws and regulations, Travellers may request access to the personal data Munckhof has about them and that if these personal data are factually incorrect, incomplete, irrelevant or are otherwise processed contrary to any statutory rule, the Traveller may request to rectify, supplement, remove or restrict these data and inform Travellers that they can contact Munckhof for more information about these rights and/or such a request
iv) all other information needed to provide the Traveller(s) with proper and careful processing of their personal data by Munckhof
2.4. If employees or other data subjects to whom the Agreement relates can also provide personal data to Munckhof themselves, the Client warrants that these employees or other data subjects have been informed of the contents of this article in advance, and insofar as necessary of the other articles in this Personal Data Section.
Article 3. Use of personal data
3.1. The Personal Data will only be processed for the purpose described in Article 2.2 of Part D of these General Terms and Conditions.
3.2. Parties should ensure compliance with the conditions set under the GDPR for processing personal data.
3.3. Munckhof gives its employees access to the personal data only insofar as this is necessary for performing the services under the Agreement. This concerns employees in the positions listed below:
| Job category | Category/Categories of Personal Data | Type of Processing |
| Travel Consultant | All | Reserving, modifying, cancelling trips, including financial processing. |
| Office Manager | All | Reserving, modifying, cancelling trips, including financial processing. |
| Technology medewerker | All | Giving support to the Travel Consultant and Office Manager. |
Article 4. Provision of Personal Data to third parties
4.1. The Client agrees to Munckhof passing on personal data (including mobile telephone number and/or email address) and other information of the Client and any Travellers, which are important for properly performing the agreed Travel Services, to the Travel Service Providers (e.g. airlines).
4.2. The Client warrants to Munckhof that the Travellers have given permission for the processing and transfer of their personal data and indemnifies Munckhof against any claims in this regard. If the Client does not want this transfer of personal data or remains in default of transferring Travellers’ personal data, Munckhof will not be liable for delays and/or other damage because it or the relevant Travel Service Provider cannot inform Travellers in due time.
4.3. Travel Service Providers that receive personal data from Munckhof process these personal data exclusively on the basis of their own privacy statement and are independently responsible for processing these personal data. Most privacy statements of Travel Service Providers (airlines) are available through the IATA Travel Centre (https://www.iatatravelcentre.com/privacy.htm) and/or website of the relevant Travel Service Provider.
Article 5. Rights of Data Subjects
5.1. If a data subject chooses to exercise their rights, as set out in Articles 12 to 22 GDPR, the Parties must assist each other in complying with this obligation within the statutory time limit.
Article 6. Retention period, return, destruction and transfer of Personal Data
6.1. Munckhof does not retain personal data for longer than needed to perform the Agreement, execute the Order or comply with any of its statutory obligations. The Client is aware that sectoral legislation imposes a retention obligation of at least seven years on Munckhof. Insofar as possible, Parties may agree on a different retention period.
Article 7. Subprocessors
7.1. The Client agrees to the use of a data centre by Munckhof, provided that the location of that data centre is within the EEA and it has ISO 27001, NEN 7510 or an equivalent certification.
7.2. Munckhof will use Processors for the implementation of the Agreement. The overview of the Processors deployed by Munckhof is included on Munckhof’s website. Click here for the page.
7.3. Munckhof remains the point of contact for the Client at all times and is responsible for compliance with the provisions of this Agreement.
Article 8. Security and audits
8.1. The Parties must ensure that appropriate technical and organizational measures are implemented to properly secure Personal Data for the purpose of processing of Personal Data, in accordance with Article 32 GDPR
8.2. Munckhof shall adopt at least these security measures as part of the appropriate technical and organizational measures, as referred to in paragraph 1:
a) Munckhof will only store personal data in a data warehouse with the required ISO 27001 and PCI DSS certifications
b) Personal data will only be able to be accessed through Munckhof’s secure network, which is equipped with a firewall, antivirus software that is regularly updated and a strict policy regarding passwords and their management
c) Software applications that use personal data will be accessible to Munckhof employees only on a need-to-know basis to perform the services in this Agreement. These employees will have a unique username and password for these software applications. Access control will also be supported by log files and security protocols that are checked regularly
d) Information security policy (management system)
e) Employees will be trained in how to handle personal data
f) Confidentiality clause/arrangements with employees and third parties who have access to personal data
g) Logical access control to systems, applications and files using passwords (and individual user IDs)
h) Multi-factor authentication to obtain access to personal data
i) Physical security checks for access to Munckhof areas where personal data are stored or accessible
j) Automatic logging of all actions involving personal data
k) Security of external network connections using Secure Socket Layer (SSL) technology
l) Access restrictions based on an individual’s specific role
m) A policy to prevent the loss of personal data
n) Issued authorization monitoring
o) Patch management to manage vulnerabilities (regular updates and the latest patches for systems, servers, networks, network components and workstations)
p) Making a daily backup of the personal data stored on Munckhof’s system to prevent loss of personal data older than one day
q) Keeping backups in a safe and fireproof location
r) Pseudonymizing and/or anonymizing personal data, if possible
s) Processing personal data using only trusted/managed devices
t) Virus protection and next-gen firewalls, smart or otherwise
u) The possibility to permanently guarantee the reliability, integrity, availability and recovery of processing systems and services
v) A possibility to promptly restore the availability of and access to personal data if a physical or technical incident occurs
w) A procedure for regularly testing, assessing and evaluating the effectiveness of the technical and organizational measures to secure personal data processing
x) If web applications are developed and used, this also includes responsibility for vulnerability updates (as described in OWASP top 10), vulnerability testing and unauthorized intrusion
8.3. At the request of a Party, the other Party must always cooperate in a data protection impact assessment (DPIA) and a prior consultation as referred to in Articles 35 and 36 GDPR.
Article 9. Duty to report data breaches and security incidents
9.1. Munckhof shall immediately inform the Client of all actual or suspected security breaches as well as other incidents that must be reported to the supervisory authority or data subject by law, notwithstanding the obligation to reverse or limit the consequences of such breaches and incidents as soon as possible. Immediately on the Client’s request, Munckhof shall also provide all information deemed necessary by the Client to assess the incident.
9.2. In the event of a Data Breach, the parties will consult about reporting to the Dutch Data Protection Authority and the Data Subjects. In principle, the Party where the Data Breach took place will be responsible for making a report. The other Party shall support the Party in this as necessary.
Article 10. Liability in connection with Personal Data
10.1. The Parties are each responsible and liable for their own actions. Each Party must indemnify the other Party for damage that arises from an attributable failure of that Party to fulfil its obligations under this Agreement, or any statutory obligation for which that Party is responsible.
10.2. Insofar as the Parties are jointly and severally liable towards third parties, including the Data Subject, or the supervisory authority imposes a penalty on them jointly, they are obliged towards each other, each for the part of the debt that concerns them in their relationship with each other, to contribute to the debt and costs in accordance with the provisions of Book 6, Part 1, Section 2 of the Dutch Civil Code unless the GDPR provides otherwise, in which case the GDPR takes precedence.
