Data processing agreement
Genscom NV — Standard Agreement for Business Clients
Version: 28 October 2026
Parties
This Agreement is entered into between:
The Client (Data Controller)
Company name: [Client name]
Company registration number: [Number]
Address: [Address]
And:
The Data Processor
Genscom NV
Ondernemingsnummer: BE 0553.863.070
Address: Louis Frarynlaan 77, 2050 Antwerp, Belgium
E-mail: info@genscom.be
Hereinafter collectively referred to as the "Parties".
1. Purpose of the agreement
The Client engages Genscom to create, personalise, print, process and/or distribute publications and provide related services.
Where Genscom processes personal data on behalf of the Client for these purposes, Genscom acts as the Data Processor and the Client as the Data Controller within the meaning of the General Data Protection Regulation (GDPR). This Agreement remains applicable for as long as Genscom processes personal data on behalf of the Client.
2. Obligations of the client
The Client determines the purposes of the processing and is responsible for ensuring the lawfulness of the personal data provided. The Client shall ensure that:
• the personal data has been lawfully collected and may be used for the relevant assignment;
• data subjects have been appropriately informed where required;
• only necessary personal data is provided;
• Genscom receives clear and lawful instructions;
• any special categories of personal data are identified in advance and assessed separately.
The Client remains responsible for complying with the GDPR obligations applicable to it as Data Controller.
3. Obligations of Genscom
Genscom shall process personal data exclusively for the performance of the agreed assignment and in accordance with the Client's documented instructions.
The order, quotation, agreed platform settings, this Agreement and written instructions form part of those documented instructions.
Genscom shall not use the personal data for its own marketing, prospecting, independent profiling, sale to third parties or training of general-purpose AI models.
Genscom shall ensure that persons authorised to access the personal data are subject to appropriate confidentiality obligations.
If Genscom considers that an instruction infringes the GDPR, it shall inform the Client accordingly.
If Genscom is legally required to process personal data for another purpose, it shall inform the Client in advance unless prohibited by law.
4. Security and confidentiality
Genscom shall implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR.
These measures include, among others:
• secure data storage and transmission;
• access controls and restricted access rights;
• protection of accounts and systems;
• backups and recovery procedures;
• monitoring and security updates;
• confidential handling of personal data by employees;
• procedures for managing incidents and deleting personal data.
The measures shall be appropriate to the nature and risks of the processing.
An overview of the security measures is included in Annex 1.
Genscom may modify these measures, provided that an appropriate level of security is maintained.
5. Engagement of other service providers
The Client grants Genscom general written authorisation to engage sub-processors necessary for the agreed services.
The sub-processors known at the time of signing and their respective functions are listed in Annex 1.
Genscom shall inform the Client in advance of any intended additions or replacements of sub-processors, allowing the Client to raise a reasoned objection based on data protection risks.
Genscom shall enter into written agreements with its sub-processors ensuring an equivalent level of data protection.
Genscom remains responsible to the Client for the fulfilment of data protection obligations by its sub-processors, in accordance with the GDPR.
6. Use of AI and external information
Where the Client uses Genscom Curator, external AI services may be used to summarise, rewrite, structure and personalise content.
Genscom shall use only the data necessary for the relevant assignment.
Where external AI services process personal data, they shall only be used where appropriate contractual and technical safeguards have been implemented.
The use of personal data for independent AI model training is prohibited.
Where the assignment involves collecting information from websites, such collection shall take place exclusively within the limits of applicable law and the agreed instructions.
The engagement of an AI service or the collection of website information does not, in itself, establish an independent lawful basis for processing personal data.
7. International data transfers
Personal data shall only be transferred outside the European Economic Area (EEA) where a valid legal basis exists and the applicable GDPR requirements are met.
Where necessary, appropriate transfer mechanisms shall be used, such as an adequacy decision or the applicable Standard Contractual Clauses adopted by the European Commission, supplemented by any required safeguards.
Genscom shall inform the Client of relevant international data transfers carried out in connection with the processing.
8. Personal data breaches and assistance
Where Genscom becomes aware of a personal data breach involving personal data processed on behalf of the Client, it shall inform the Client without undue delay.
Genscom aims to provide an initial notification within 24 hours of becoming aware of the breach, based on the information available at that time.
Genscom shall provide reasonable assistance in relation to:
• requests from data subjects concerning their privacy rights;
• investigating and handling personal data breaches;
• data protection impact assessments;
• any required prior consultation with supervisory authorities;
• compliance with the obligations set out in Articles 32 to 36 of the GDPR.
The Client remains responsible for assessing whether a breach must be reported to the supervisory authority and/or the affected data subjects.
9. Data retention and deletion
Genscom shall retain personal data no longer than necessary for the agreed services.
Temporary personal data and production files processed for order fulfilment shall be deleted no later than 30 days after the assignment has been fully completed, unless legal obligations require a longer retention period.
Files managed by the Client within a user account are subject to the separately agreed account retention periods.
The Client may delete these files using the available platform features.
Upon completion of the processing, personal data shall, at the Client's choice, be deleted or returned, unless a legal obligation requires its retention.
Data that remains in secure backups shall be subject to the applicable backup and deletion procedures. Once deleted from the active environment, such data shall not be restored for operational use.
10. Audits and compliance
Upon reasonable request, Genscom shall provide the information necessary to demonstrate compliance with this Agreement and Article 28 of the GDPR.
The Client, or an independent auditor appointed by the Client, may conduct audits within the limits of applicable law.
The Parties shall coordinate the practical arrangements in advance, taking into account confidentiality, security and business continuity.
Genscom shall cooperate with legally required audits and inspections.
11. Liability
Each Party is responsible for its own obligations under this Agreement and the GDPR.
The liability of the Parties shall be determined in accordance with applicable law, including Article 82 of the GDPR, and any valid contractual arrangements.
Nothing in this Agreement shall restrict the rights of data subjects or the statutory powers of supervisory authorities.
12. Term and termination
This Data Processing Agreement shall enter into force upon signature or any other legally valid acceptance by both Parties.
It shall remain applicable for as long as Genscom processes personal data on behalf of the Client.
Upon termination of the services, the provisions regarding the return, deletion and legally required retention of personal data shall apply.
13. Final provisions
This Agreement shall be governed by Belgian law.
In the event of any conflict between the General Terms and Conditions and this Data Processing Agreement, this Data Processing Agreement shall prevail in matters relating to the processing of personal data on behalf of the Client.
This Agreement may be executed electronically.
For the Client
Name:
Position:
Date:
Signature:
For Genscom NV
Name: Stefaan Vanysacker
Position: CEO
Date:
Signature:
______________________________________________________
Annex 1 — Processing activities, security and service providers
A. Description of processing activities
Subject matter
The processing of personal data for the creation, personalisation, printing and distribution of publications.
Duration
For the duration of the agreed services and the applicable retention periods.
Processing activities
Depending on the assignment:
• receiving, entering and storing data;
• structuring and preparing personal data;
• combining personal data with publication content;
• personalising texts, images and publications;
• editorial processing using AI, where applicable;
• preparing print-ready files;
• printing, packaging and distributing publications;
• providing necessary technical support;
• deleting or returning personal data.
Categories of data subjects
Depending on the assignment: customers, employees, members, tenants, shareholders, business contacts, prospects or other recipients designated by the Client.
Categories of personal data
Depending on the assignment: names, addresses, contact details, job titles, company information, photographs, texts and other data provided by the Client for the agreed personalisation.
Special categories of personal data are not automatically included in a standard assignment and require prior assessment.
B. Security measures
Genscom implements, in accordance with the nature and risks of the processing, the following measures, among others:
Technical measures
• access controls and individual user accounts;
• role-based access permissions;
• two-factor authentication where available;
• secure network connections and encrypted data transmission;
• protection of servers and workstations;
• patch management and monitoring;
• logging of relevant system activities;
• secure processing of print orders;
• backups and recovery procedures.
Organisational measures
• restricted access to Client data;
• confidentiality obligations;
• internal instructions for employees;
• procedures for handling security incidents;
• management of sub-processors;
• periodic evaluation of security measures;
• data deletion procedures.
These measures are further documented in Genscom's internal information security policy.
C. Overview of service providers
The following parties may be engaged, depending on the services used and their respective legal roles:Hosting, storage and technical infrastructure
Google Cloud
Hosting, storage and technical infrastructure
Cloudinary
Management and processing of images and media files
Combell
Hosting, storage and backup facilities
Boes Mailing Services
Processing and distribution of larger mailings
bpost / bpack
Postal processing and delivery
FedEx
Logistics and delivery
Externe AI-aanbieders
AI processing within Curator, where applicable
Mollie is used for payment processing. The processing of payment data and Mollie's precise contractual role are assessed separately.
Not every service provider listed above necessarily acts as a sub-processor. Where a service provider acts as a sub-processor, the provisions of Article 5 of this Agreement shall apply.
The final list of sub-processors shall identify, for each relevant party, the legal entity, the purpose of processing, the applicable processing locations and any international data transfers.
D. Data retention periods
Unordered newspapers in a user account
3 months after the last edit
Ordered newspapers in a user account
1 year
Temporary order fulfilment data
No later than 30 days after completion
Administrative data subject to legal retention requirements
In accordance with applicable statutory retention periods
Backups
In accordance with the backup retention cycle, to be confirmed
Different contractual arrangements may be agreed upon, provided they are legally valid and comply with applicable data protection legislation.
