F-Register data processing agreement

Version 1.3. Final, adopted on 29 October 2026. Applies following actual acceptance by an authorised representative on a new application, or according to the applicable procedure for an existing customer. The Dutch text prevails if translations differ, without restricting mandatory rights.

This agreement is between F-Register, Banjaard 19, 2134 WS Hoofddorp, Netherlands, Chamber of Commerce 92549705, VAT NL004966153B65, and the installation business applying for or using the environment (Customer).

The Customer is normally controller of personal data in its environment and F-Register processor. If the Customer processes for a business operator, F-Register is subprocessor and the Customer ensures the required instruction and authorisation. Actual statutory roles are not changed by a label. F-Register is controller for its own website, applications, billing and business relationship, as described in the privacy notice.

An authorised representative accepts on the Customer’s behalf. We record name, capacity, time, language, version and exact archived-text hash. Existing agreements are not replaced on the basis of assumed or retrospective acceptance.

1. Instruction, scope and duration

F-Register processes only documented Customer instructions to deliver, secure, maintain, support, restore, export and erase the service. The agreement, chosen modules and demonstrable instructions together form the instruction. Necessary security/login monitoring and temporary support are included where they serve this instruction; independent purposes are separately explained.

Processing includes collection, recording, organisation, consultation, alteration, calculations, instructed disclosure, security, storage, export and erasure. Data may include customer/employee/contact details, addresses, locations, installations, work orders, planning, audit and refrigerant records, photos, documents, signatures and communications. Data subjects include customers, employees, contacts, suppliers and people appearing in documents/photos. Special-category data and national identifiers are not intended; necessary exceptions require prior written agreement.

Processing continues during the service and termination handling in section 6. The Customer determines necessity, access and its statutory retention obligations. We do not use tenant content for our own marketing.

2. Security, confidentiality and support

We implement and periodically review proportionate technical and organisational measures described in Annex 1. People with access are bound by confidentiality. We do not reduce the agreed protection without appropriate replacement measures.

Temporary support requires advance, one-time approval by an authorised customer administrator for purpose, duration (maximum 24 hours) and level: View or View and modify. Access is limited to the permitted operations. Existing secrets remain hidden. Support cannot create permanent users, change personal roles/passwords/MFA, erase customers or download a complete export. Only the customer administrator activates, rotates or deletes API clients and webhooks. Support can prepare an inactive API draft but cannot choose or retrieve an incoming key.

Access ends on withdrawal, expiry or termination of the operator’s monitor session. Restart requires monitor MFA and fresh customer approval. The customer can revoke access and consult session evidence; change logs contain necessary references and no secret values or full request payloads.

3. Subprocessors and external integrations

The Customer grants general authorisation for these instructed services:

F-Register operates its own servers and software on hardware supplied by Worldstream in the Netherlands. For that hardware service Worldstream has no management access to server content and provides no server-backup service. F-Register controls software, encryption, access, security and its backups; Worldstream is not listed as a subprocessor for this described hardware-only role.

We impose appropriate data-protection obligations on subprocessors and remain responsible for instructed outsourcing. We notify intended additions/replacements at least 30 days in advance, describing the party, service, location and safeguards. The Customer may object on substantiated data-protection grounds within 14 days of receipt. We seek an appropriate solution, including an equivalent alternative. If none is possible, the Customer may end the affected service before the change without penalty and retrieve data under section 6. We document notices and objections; a different valid instruction must be written.

Transfers outside the EEA require an applicable GDPR transfer mechanism and safeguards. An EU storage location alone does not prove that every access remains in the EEA. We provide relevant chain information on request. Integrations selected by the Customer, such as Teamleader or WhatsApp, belong to its own recipient/processor chain where those parties act on its instructions. External transmission requires the relevant customer configuration; integration settings do not authorise unrelated uses.

4. Assistance, incidents and audits

We assist, considering the nature of processing and information available to us, with rights requests, security, impact assessments and prior consultation. The Customer decides the response for its data; we redirect direct requests appropriately and do not act without authority.

We notify a personal-data breach without undue delay and at the latest within 48 hours after awareness to the designated customer contact. This maximum never justifies waiting when earlier notification is possible. We initially provide available information on nature, categories, approximate scope, consequences, measures and contact point, and supplement without undue delay. The Customer assesses notifications to authorities and people. We notify on its behalf only on express written authority. Our incident contact is privacy@f-register.nl; the customer contact is its applying representative or a subsequently designated contact.

We provide necessary compliance information and cooperate with reasonable audits/inspections, with agreed scope and arrangements protecting confidentiality and other customers. This does not restrict statutory inspection rights.

5. Lawful instructions and statutory records

We process on instruction unless applicable law requires otherwise and then inform the Customer in advance unless prohibited. We notify the Customer if an instruction in our view infringes applicable data-protection law. Retention exceptions apply narrowly, not to whole dossiers without necessity. Applicable F-gas records require at least five years under the relevant rules. The Customer identifies the required records and identification; erasure cannot destroy mandatory evidence. We facilitate targeted deletion/restriction or explain a justified block.

6. Export, switching and erasure

The standard free export uses CSV, original files and a manifest of categories, relationships and checksums. Passwords, tokens, MFA secrets/recovery codes and keys are excluded. We agree the actual categories, secure delivery, completeness checks and switching plan in writing.

After the agreed transition ends, the export remains retrievable for at least 30 calendar days. Ordinary termination uses the longer of one calendar month and 30 calendar days from the agreed end date. A later written retrieval date prevails. Retrieval never starts before a switching transition ends; the terms explain continuity and transition arrangements.

After completion and expiry we erase tenant content and related copies unless a narrowly applicable legal obligation requires retention. A lawful earlier erasure instruction must be express and cannot defeat mandatory retention or minimum switching rights. Active service is not terminated early to shorten retrieval. Backups have the limited retention in Annex 1; we plan disposal so residual copies disappear in time. Restore cannot silently reactivate erased data. Failures or missing evidence remain open issues, not completed destruction. We provide retention, delivery and deletion information on request.

7. Final provisions

This DPA forms part of the service agreement. A specific written data-protection addendum prevails where applicable; mandatory rights remain unaffected. Questions: info@f-register.nl; privacy/security incidents: privacy@f-register.nl.

Annex 1 — technical and organisational measures

Restricted account emergency recovery

For proven lockout or ended authority, an appointed F-Register reset administrator may restore or deactivate only the designated account. By accepting this DPA the Customer gives that limited security instruction. We verify identity and authority, require monitor MFA and password confirmation, and record reason, actor, target and time. An MFA reset clears relevant secrets/recovery codes and ends sessions; deactivation also prevents ordinary login. The operation grants no general access to customer content. Identification is limited to account ID, name, email, role, active status and MFA status. Minimal recovery/support evidence is retained at most two years after closure, except a specifically documented statutory necessity.