General terms and the data processing agreement.
The agreements between stipt and your business, and how we process personal data on your behalf.
On this page
- General Terms and Conditions Stipt B.V.
- 1. Definitions
- 2. Applicability
- 3. Offer and formation
- 4. The Services
- 5. AI functionality
- 6. Prices and payment
- 7. Term and termination
- 8. Customer data
- 9. Confidentiality
- 10. Personal data
- 11. Liability
- 12. Force majeure
- 13. Intellectual property
- 14. Other provisions
- 15. Applicable law and disputes
- Annex 1: Data Processing Agreement
- Parties
- 1. Definitions
- 2. Order of precedence
- 3. Subject matter and instructions
- 4. Duration
- 5. Security
- 6. Confidentiality
- 7. Sub-processors
- 8. Transfers outside the EEA
- 9. Personal data breaches
- 10. Assistance to the Controller
- 11. Requests from authorities
- 12. Audits
- 13. Deletion and return
- 14. Liability
- 15. Applicable law
- Schedule 1A: The processing
- Schedule 1B: Sub-processors
- Schedule 1C: Technical and organizational measures
Version 12 November 2026. English translation for convenience; the Dutch version prevails.
General Terms and Conditions Stipt B.V.
English translation for convenience. In the event of any conflicting meaning, the Dutch version prevails.
1. Definitions
1.1 In these Terms and Conditions:
- Customer: the legal entity or business that has entered into an Agreement with Stipt for the Services;
- Services: the Core Service and any Additional Services;
- Core Service: making the Software available via the cloud as configured for the Customer;
- Additional Services: onboarding and implementation, training, consultancy, custom work or other activities described in the offer or agreed in writing;
- Agreement: the entirety of the offer, these Terms and Conditions, the Data Processing Agreement and any written supplements;
- Software: the SaaS platform offered by Stipt under the name "Stipt", including the mobile and web applications and the AI functionality ("dot");
- AI functionality: components of the Software that generate, classify, summarize or answer content with the aid of artificial intelligence;
- Data Processing Agreement: the annex to these Terms and Conditions concerning the processing of personal data (Annex 1, with Schedules 1A to 1C);
- Stipt: Stipt B.V., with its registered office at Gedempte Oude Gracht 101 C, 2011GN Haarlem, Chamber of Commerce (KvK) 42115688, VAT ID NL869800383B01;
- Terms and Conditions: the most recent version of these general terms and conditions.
2. Applicability
2.1 These Terms and Conditions apply to all offers made by Stipt and to all agreements between Stipt and the Customer.
2.2 If these Terms and Conditions have been provided to the Customer in a language other than Dutch, the Dutch version prevails in the event of any difference in meaning.
2.3 In the event of a conflict between these Terms and Conditions and the offer or any other part of the Agreement, the offer or that other part prevails. The Data Processing Agreement prevails where the processing of personal data is concerned.
2.4 General terms and conditions of the Customer, including industry terms and conditions, do not apply and are expressly rejected.
2.5 Stipt supplies to businesses only. The Customer declares that it acts in the course of a profession or business and warrants that the person who signs for it or starts the subscription is authorized to do so. Users to whom the Customer grants administrator rights in the Software are authorized to add seats and extra modules, purchase credits and change other settings that entail costs on its behalf.
3. Offer and formation
3.1 Offers made by Stipt are without obligation, unless the offer states a period for acceptance; during that period Stipt cannot revoke the offer. The Agreement is formed upon acceptance of the offer by the Customer: in writing (signature, including digital signature, or confirmation by email), in the Software in accordance with article 3.3, or when Stipt commences performance.
3.2 Offers are based on the information provided by the Customer. The Customer warrants that this information is accurate and complete.
3.3 If the Customer starts a subscription in the Software, the overview that the Software shows before payment constitutes the offer. It sets out the seats and extra modules with their prices, the payment method, the start date, the term, the notice period, the renewal and the address for notice of termination. The Customer accepts that offer by agreeing in the Software to these Terms and Conditions and the Data Processing Agreement and completing the payment. Stipt then confirms the Agreement by email.
3.4 If the Customer already uses the Software before the subscription starts, for example to set up the workspace, these Terms and Conditions and the Data Processing Agreement also apply to that use. Setting up the workspace by the Customer itself is free of charge, except for the use of AI functionality, which is charged in credits (articles 5.5 to 5.8). Onboarding by Stipt staff, such as setting up the workspace, transferring data or training, is an Additional Service: the parties agree its content and price in writing in advance, and Stipt only starts after that agreement. As long as there is no subscription, either party may end the use at any time; article 7.5 then applies to the Customer's data, and whatever onboarding Stipt has already performed remains payable.
4. The Services
4.1 For the duration of the Agreement, Stipt grants the Customer a non-exclusive, non-transferable right to use the Software for the seats (users) and the modules set out in the offer and as subsequently adjusted in the Software (article 6.7).
4.2 The Customer may use the Services solely for its own business operations. Access is provided via personal accounts; accounts may not be shared. The Customer is responsible for keeping login credentials confidential and for all use that takes place via its accounts. The Customer is also responsible for the security of its accounts, including enabling available security settings such as two-step verification, and for damage resulting from misuse of its accounts. The Customer determines per user which rights that user has in the Software, such as what they can see and change, and is responsible for those settings.
4.3 The Customer is responsible for the equipment and internet access required to use the Software.
4.4 Stipt uses reasonable efforts to keep the Software available and functioning properly, but does not guarantee uninterrupted availability. Where reasonably possible, Stipt carries out scheduled maintenance outside office hours.
4.5 Stipt provides updates and improvements to the Software when it deems this necessary. Updates are free of charge. Stipt may change functionality, provided that the core functionality of the modules purchased is preserved.
4.6 Stipt provides support during office hours for the use of the Software.
4.7 Stipt is not responsible for the operation of integrations with third-party software or services used by the Customer, to the extent that the malfunction lies outside Stipt's sphere of influence. This also applies to third-party services with which the Customer connects the Software or for which the Customer holds its own account or contract, such as WhatsApp (Meta), Twilio (telephony) and email, accounting and payment providers: Stipt is not liable for their malfunctions, changes to their terms, or the restriction, blocking or termination of their service or of the Customer's account.
4.8 The Customer and its users do not use the Software in breach of the law or the Agreement, and do not use it to copy, modify, reverse-engineer, resell or make the Software available to third parties, to circumvent security or test it without permission, or to load the Software in a way that endangers the service to others. Stipt may (partly) suspend access to accounts or to the Services in the event of such a breach, in the event of a security risk or on the order of an authority, and will, where possible, notify the Customer in advance. In the event of a suspension due to a breach by the Customer, the fee remains due.
4.9 The Customer is responsible for the content, accuracy and lawfulness of the data that it and its users enter into the Software or send through the Software, including messages to end customers and compliance with statutory consent requirements and with the terms of messaging channels such as WhatsApp, and indemnifies Stipt against third-party claims arising from it, except in the event of intent or deliberate recklessness on the part of Stipt.
4.10 Stipt may engage third parties for the performance of the Agreement. Sub-processors are governed by the Data Processing Agreement.
4.11 Stipt is not responsible for the results of calculations performed by the Software, such as prices, VAT, commissions, payouts, schedules and travel times, nor for decisions or actions of the Customer based on those results. The Customer checks those results before using, sending or paying them. If the Customer makes the remuneration or payout of persons depend on results calculated by the Software, such as a level in a payout formula, it chooses and checks those settings itself and ensures human review and an opportunity to object where the law requires this. The Software does not provide tax, accounting or legal advice.
4.12 Stipt endeavors to remedy defects in the Software, but does not guarantee that it can, nor within what period. Messages about remedy and turnaround time are indicative and never an obligation of result or a strict deadline.
4.13 The Software is not a substitute for the Customer's statutory records. The Customer remains responsible for its own statutory retention and record-keeping obligations, including invoices and bookkeeping, and also keeps copies of important data and documents outside the Software, for example via the export functions.
4.14 Stipt may supply the same or similar services and software to third parties, including competitors of the Customer. There is no exclusivity or non-compete, unless the parties have expressly agreed so in writing.
4.15 The Telephony module works with the Customer's own account with Twilio. The Customer purchases phone numbers, calls and call minutes in its own name and for its own account directly from Twilio, also when it buys a number from within the Software. Stipt is not a provider of an electronic communications service or network and is not a party to the agreement between the Customer and Twilio. Stipt supplies the software with which the Customer uses its telephony and charges the fee for the module for it (article 6.1); Stipt charges the processing by the AI phone assistant in credits (article 5.5).
4.16 With the Self-billing module, the Customer issues invoices in the name and on behalf of its contractors (self-billing). The Customer makes the arrangements with each contractor that VAT legislation requires for this, including a prior agreement and a procedure by which the contractor accepts each invoice, and is responsible for the accuracy of the invoices and for payment. Stipt does not make payments on behalf of the Customer.
5. AI functionality
5.1 The Software includes AI functionality that can, among other things, classify and summarize messages, draft responses and, if enabled by the Customer, respond automatically to the Customer's end customers, such as via the WhatsApp assistant and the AI phone assistant, and carry out actions set up by the Customer, such as reviewing completed forms.
5.2 AI-generated output is a tool, not advice. Output may contain inaccuracies. The Customer decides which AI functionality is enabled and with which settings, and remains responsible for the communication with its end customers conducted with the aid of the Software. Stipt is not liable for damage resulting from AI output that the Customer uses or sends.
5.3 Where AI functionality communicates independently with the Customer's end customers (such as the WhatsApp assistant and the AI phone assistant), Stipt makes clear in that communication that the end customer is communicating with an AI assistant, in accordance with the EU AI Act.
5.4 Stipt does not use the content of customer data to train generic AI models. Processing by AI sub-processors is governed by the Data Processing Agreement.
5.5 AI functionality is paid for with credits. Each workspace receives a monthly bundle of credits, the size of which is shown in the Software and depends on the number of internal users; whatever is left at the end of the month lapses. The Customer can purchase additional credits at the price the Software shows at the time of purchase; purchased credits are valid for the period stated there.
5.6 How many credits an action costs depends on the AI model used and the extent of the processing, such as the length of texts and, for the AI phone assistant, the call duration and the number of spoken characters. The Customer can see the consumption per function in the Software. The consumption per function follows the costs of the underlying AI models; an adjustment applies only to processing thereafter. Stipt announces an increase in the consumption per function that does not result from higher costs of the AI models at least one month in advance.
5.7 If automatic top-up is switched on, Stipt purchases credits on behalf of the Customer as soon as the balance falls below the threshold shown in the Software, for the amount shown there, and charges this via the Customer's payment method. Automatic top-up is switched on by default; an administrator can switch it off in the Software and adjust the threshold and the amount.
5.8 Credits are not refunded, also not upon termination of the Agreement, and lapsed credits do not return.
5.9 AI functionality that analyzes the work of the Customer's employees or contractors, such as weekly reports, is a tool for the Customer's management. It is not intended to decide independently on employment conditions, remuneration, assessment, promotion or termination of the employment relationship or engagement of persons; the Customer takes such decisions itself.
6. Prices and payment
6.1 The fee for the Services is stated in the offer. It consists of an amount per seat per month, depending on the user's role (Admin, User or Mobile only), and an amount per month for each extra module that the Customer switches on. A seat is every user with an active account in the Customer's workspace, including a field technician or staff member of a partner company working for the Customer through the portal; an invited user counts as soon as they activate their account. An extra module is charged per Admin seat and per User seat for as long as the module is switched on for the Customer, also if the Customer hides the module for one or more users; no module fee is due for a Mobile only seat. AI functionality is charged in credits (articles 5.5 to 5.8). Amounts are exclusive of VAT.
6.2 When entering into the Agreement, the Customer chooses whether Stipt invoices the fee for seats and modules monthly or annually in advance, unless the offer provides otherwise. For annual payment in advance, the lower rate stated in the offer applies and Stipt invoices the amount for twelve months in advance. The choice does not change the term: also when paying monthly, the Customer owes the fee until the end of the term (article 7), for the seats and extra modules that apply under article 6.7. Stipt invoices Additional Services upon formation of the Agreement or upon completion.
6.3 The payment term is 14 days from the invoice date. If the Customer has registered a direct debit mandate or a payment card with Stipt's payment provider, Stipt may collect the amounts due with it on or after the invoice date, including for interim invoices (article 6.7) and automatically purchased credits (article 5.7). In the event of late payment, the Customer owes the statutory commercial interest without notice of default being required. In the event of non-payment, Stipt may suspend the Services after the Customer has been given a reminder and a reasonable period to perform.
6.4 Extrajudicial collection costs amount to 15% of the outstanding claim, with a minimum of EUR 250.
6.5 Stipt may adjust prices once per calendar year in line with the CBS Consumer Price Index, plus a surcharge, at Stipt's discretion, of no more than 10%. Price changes take effect as of the next renewal date and are announced at least three months in advance, so that the Customer can still terminate.
6.6 The Customer is not entitled to suspend or set off its payment obligations.
6.7 The number of seats and extra modules follows usage. An administrator of the Customer adds seats in the Software by inviting a user or changing a role, and switches on extra modules there; the Software shows the price when doing so. Such an addition is a supplement to the Agreement. For an added seat or a switched-on extra module, the Customer owes the rate from the offer, pro rata for the remaining days of the current billing period; Stipt may invoice this in the interim. A removed seat, a lowered role or a switched-off module counts until the end of the current billing period; after that, the fee for it lapses. Amounts already paid are not credited.
6.8 Costs of third-party services that the Customer purchases itself, such as phone numbers and call minutes from Twilio for the Telephony module, are not included in the fee. The Customer pays these directly to that third party.
7. Term and termination
7.1 The Agreement has the term set out in the offer. In the absence of any agreement to the contrary, the term is 12 months from technical delivery or, for a subscription that the Customer starts itself in the Software, from the start date of that subscription. This also applies when paying monthly.
7.2 Either party may terminate the Agreement in writing effective at the end of the current contract period, subject to a notice period of 2 months. The Customer terminates by email to the termination address stated in the Agreement or, for a subscription that it starts itself in the Software, to the termination address that Stipt states at stipt.ai/contact; a termination that is not made in that manner or not made on time is not valid. Termination during the term is not possible, except on the basis of article 7.3 or article 14.1, or by switching in accordance with article 7.8. Without notice of termination, the Agreement is tacitly renewed each time for 12 months, or for the period specified in the offer.
7.3 Either party may terminate the Agreement in writing with immediate effect if: a) the other party attributably fails to perform a material obligation and that failure has not been remedied within 14 days after written notice of default; b) the other party has been declared bankrupt, has applied for or been granted a suspension of payments, is dissolved or ceases its activities; c) a situation of force majeure persists for more than 30 days.
7.4 Upon termination, on any ground, all claims of Stipt against the Customer become immediately due and payable. Fees already paid are not refunded, except for fees for seats and modules paid in advance for the period after a termination by the Customer pursuant to article 7.3, and except as provided in article 7.7.
7.5 After the end of the Agreement, on any ground, the Customer can retrieve its data for at least 30 days (the retrieval period); after switching in accordance with article 7.8, the retrieval period starts when the transitional period ends. The Customer chooses whether Stipt returns the data by export or deletes it immediately. Exportable data comprises all data that the Customer and its users have entered into the Software or that has been received or created through the Software on its behalf, together with the related activity history, including contacts, records and their fields, messages and attachments, appointments, forms with photos and signatures, quotes, invoices and documents, and the configuration that the Customer has set up itself, such as fields, statuses and templates. Not exportable are Stipt's source code, prompts, internal models, configuration and security data, and data of other customers. The export takes place through the export functions in the Software and, for data without an export function of its own, as a full export delivered by Stipt on request in a common, machine-readable format (JSON/CSV with the associated files). After the retrieval period, or earlier if the Customer asks for immediate deletion, Stipt deletes the data in accordance with the Data Processing Agreement.
7.6 Articles 7:404, 7:407(2) and 7:408(1) of the Dutch Civil Code do not apply. The Customer can therefore not terminate the Agreement during the term, except on the basis of article 7.3 or article 14.1 or by switching in accordance with article 7.8, and remains liable for the fee until the end of the current contract period for the seats and extra modules that apply under article 6.7, even if it uses less of the Services or none at all, subject to article 7.7.
7.7 If the Agreement ends before the end of the current contract period through switching in accordance with article 7.8, or because Stipt terminates it on the basis of article 7.3 under a or b because the Customer is in attributable breach or insolvent, the Customer owes a fee for early termination. That fee equals the fee the Customer would have owed for the remainder of the current contract period, less the costs that Stipt saves as a result of the early termination. In doing so, Stipt takes as its basis the seats and extra modules at the time of the announcement of the switch or of the termination. Amounts the Customer has already paid in advance for that period are set off against this fee; Stipt refunds any surplus. In the event of termination by Stipt, this is without prejudice to its right to compensation for other damage.
7.8 The Customer may at any time, including during the term, request Stipt in writing to switch to another provider or to port its data to an on-premises environment, in accordance with the Data Act (Regulation (EU) 2023/2854). The following applies: a) the Customer gives notice of the switch with a notice period of 2 months; b) after that period a transitional period of 30 days follows. During that period the Agreement continues, Stipt provides reasonable assistance with the switch, maintains the Services with due care, informs the Customer of known risks to continuity and maintains a high level of security. If 30 days is technically unfeasible, Stipt notifies the Customer within 14 working days of the request, with a justification and an alternative transitional period of no more than 7 months. The Customer may extend the transitional period once; c) Stipt provides the information the Customer needs for its switch, including the available procedures, methods and formats for the export and their limitations; d) the Agreement ends once the switch has been completed and Stipt has confirmed this to the Customer or, if the Customer only wants its data deleted, at the end of the notice period; the retrieval period of article 7.5 applies thereafter; e) Stipt does not charge for the switch itself. The regular fee continues until the Agreement ends, and article 7.7 applies to the remainder of the current contract period.
8. Customer data
8.1 Any rights and claims to the data that the Customer, its users or its end customers enter into the Software remain with the Customer or the other rightholder. Stipt acquires no rights to that data and may only process it to the extent necessary for the performance of the Agreement.
8.2 Stipt ensures periodic backups of the Customer's data and takes appropriate technical and organizational security measures, including at least the measures in Schedule 1C of the Data Processing Agreement.
8.3 Stipt may collect and use aggregated and anonymized usage data about the use of the Software for the improvement and optimization of the Software. This data cannot be traced back to the Customer or to natural persons.
9. Confidentiality
9.1 The parties treat all information and materials that they receive from each other or to which they gain access in the context of the Agreement as confidential, and do not make these available to third parties without the prior written consent of the other party. This obligation does not apply to information that was already public or that becomes public through no fault of the receiving party.
9.2 Confidentiality does not prevent a party from disclosing information: a) to its employees, advisers (such as accountants and lawyers), sub-processors and other auxiliary persons, to the extent they need that information for the performance of the Agreement or for advice about it and are themselves bound by confidentiality; b) to the extent a statutory provision, a court decision or an order of a competent authority requires it to do so; it informs the other party in advance, to the extent permitted; c) to third parties with whom the Customer itself shares data, or has data shared, through the Software, such as linked partner companies, end customers and third-party services that the Customer connects.
9.3 This article remains in force after the end of the Agreement.
10. Personal data
10.1 To the extent that Stipt processes personal data on behalf of the Customer in the performance of the Agreement, Stipt is the processor and the Customer is the controller within the meaning of the GDPR. The Data Processing Agreement (Annex 1) applies to that processing and forms an integral part of the Agreement.
11. Liability
11.1 Stipt's total liability, on any ground whatsoever (including tort), for damage suffered by the Customer in connection with the Agreement is limited, per calendar year and for all events combined, to direct damage and to the amount paid by the Customer to Stipt under the Agreement in the 12 months preceding the first event causing damage in that calendar year (exclusive of VAT), with a maximum of EUR 100,000.
11.2 Stipt is not liable for indirect damage, including consequential damage, loss of profit, missed savings, damage due to business interruption or loss of data to the extent that the Customer could reasonably have exported or backed up that data itself.
11.3 The limitations in this article do not apply to the extent that the damage results from intent or deliberate recklessness on the part of Stipt or its executives, and do not apply to the extent that liability cannot be limited under mandatory law.
11.4 Stipt indemnifies the Customer against third-party claims alleging that the Software infringes their intellectual property rights, up to a maximum of EUR 20,000 per claim, provided that the Customer informs Stipt without delay and leaves the handling of the claim to Stipt.
11.5 Any claim of the Customer against Stipt lapses 12 months after the Customer became aware, or could have become aware, of its existence, unless legal proceedings have been initiated within that period.
11.6 The Customer reports a failure by Stipt in writing and with a clear description within 30 days after it discovered or could have discovered it (article 6:89 of the Dutch Civil Code) or, if it reasonably could not do so within that period, as soon as possible thereafter. If it does not, its right to performance, repair and compensation for that failure lapses.
11.7 Stipt is only liable for a failure after the Customer has given Stipt written notice of default with as complete and detailed a description as possible, has set a reasonable period for remedy, and Stipt still remains in attributable breach after that period. This does not apply if performance is permanently impossible.
11.8 Direct damage means exclusively: a) the reasonable costs of determining the cause and extent of the damage, to the extent that the determination relates to direct damage; b) the reasonable costs of remedying Stipt's failure or of having the Service function again in accordance with the Agreement; c) the reasonable costs of preventing or limiting damage, to the extent that the Customer demonstrates that those costs have led to a limitation of direct damage.
11.9 The exclusions and limitations in this article and in article 12 also apply for the benefit of Stipt's directors, shareholders, employees, auxiliary persons and suppliers and of all others whom Stipt engages in the performance of the Agreement. This is an irrevocable third-party clause within the meaning of article 6:253 of the Dutch Civil Code. The Customer will not hold them personally liable, except in the event of intent or deliberate recklessness on the part of the person concerned and except to the extent mandatory law does not permit this.
12. Force majeure
12.1 Neither party is obliged to perform an obligation if it is prevented from doing so by force majeure within the meaning of article 6:75 of the Dutch Civil Code. Force majeure includes in any event: war, civil unrest, government measures, strikes, power or internet outages outside the sphere of influence of the party concerned, and non-attributable failures at suppliers.
12.2 A security incident or cyberattack by a third party, including a hack, ransomware, or theft or corruption of data, qualifies as force majeure, unless the Customer demonstrates that Stipt had not taken the measures in Schedule 1C of the Data Processing Agreement, or that those measures were manifestly inappropriate at that time in view of the state of the art and the known risks. Stipt's obligations under the GDPR and article 11.3 remain unaffected.
12.3 The party affected by force majeure notifies the other party in writing as soon as possible. Obligations are suspended for the duration of the force majeure. If the force majeure lasts longer than 30 days, either party may terminate the Agreement in writing with immediate effect, without any obligation to pay damages.
13. Intellectual property
13.1 All intellectual property rights in the Software, the Services and everything that Stipt makes available under the Agreement are vested in Stipt or its licensors. The Customer only acquires the right of use set out in article 4.1.
13.2 No transfer applies to the Customer's data: article 8.1 applies.
13.3 Stipt may freely use, without compensation, ideas, suggestions, feedback and requests of the Customer regarding the Software and incorporate them into the Software. All rights in adaptations, extensions and custom work that Stipt develops for or at the request of the Customer rest with Stipt, even if the Customer has paid for or contributed to it, unless the parties agree otherwise in writing. Stipt may also offer these to other customers; Stipt does not use the Customer's data and set-up for that purpose.
14. Other provisions
14.1 Stipt may amend these Terms and Conditions. Stipt announces material amendments at least one month in advance. If an amendment demonstrably and more than insignificantly worsens the Customer's position, the Customer may terminate the Agreement effective as of the date on which the amendment takes effect.
14.2 The Customer may not transfer the Agreement to a third party without the prior written consent of Stipt. Stipt may transfer the Agreement to a group company or in the context of a transfer of its business; Stipt informs the Customer thereof.
14.3 If any provision of these Terms and Conditions proves to be void or voidable, the remaining provisions remain in force. The parties replace the provision in question, in consultation, with a valid provision that approximates the purpose and intent as closely as possible.
14.4 "In writing" includes email.
14.5 Stipt's records, including logs and billing data, constitute full evidence between the parties of the use of the Services and of the amounts owed by the Customer, subject to proof to the contrary by the Customer.
14.6 Additions and amendments to the Agreement are only valid if the parties have agreed them in writing or if the Customer accepts them in the Software, such as when adding seats and extra modules (article 6.7). Oral promises, including by Stipt employees, do not bind Stipt.
14.7 A party's failure or delay in invoking or exercising a right or provision does not constitute a waiver of that right. A waiver is only valid if made expressly and in writing.
15. Applicable law and disputes
15.1 These Terms and Conditions and the Agreement are governed by Dutch law.
15.2 Disputes are submitted exclusively to the competent court of the District Court of Noord-Holland (Rechtbank Noord-Holland).
Annex 1: Data Processing Agreement, with Schedule 1A (The processing), Schedule 1B (Sub-processors) and Schedule 1C (Technical and organizational measures).
Annex 1: Data Processing Agreement
English translation for convenience. In the event of any conflicting meaning, the Dutch version prevails.
Parties
- Stipt B.V., with its registered office at Gedempte Oude Gracht 101 C, 2011GN Haarlem, Chamber of Commerce (KvK) 42115688, hereinafter: Processor or Stipt; and
- the Customer as defined in the General Terms and Conditions, hereinafter: Controller.
This Data Processing Agreement forms an integral part of the Agreement and applies to every processing of personal data carried out by Stipt on behalf of the Controller.
1. Definitions
Terms such as personal data, processing, data subject, personal data breach, controller and processor have the meaning given to them by the GDPR (Regulation (EU) 2016/679, including the Dutch GDPR Implementation Act (Uitvoeringswet AVG)). Sub-processor: a third party engaged by Stipt that processes personal data on behalf of the Controller. EEA: all EU member states plus Liechtenstein, Norway and Iceland.
2. Order of precedence
In the event of a conflict between the Agreement and this Data Processing Agreement, this Data Processing Agreement prevails to the extent that the processing of personal data is concerned.
3. Subject matter and instructions
3.1 Stipt processes personal data solely on behalf of and on the basis of written instructions from the Controller, and not for its own purposes. The Agreement, this Data Processing Agreement and the settings the Controller selects in the Software (including enabling or disabling AI functionality and automations) constitute those instructions.
3.2 By way of derogation from 3.1, Stipt may process personal data if a provision of Union law or Dutch law requires it to do so. In that case, Stipt informs the Controller prior to the processing, unless that legislation prohibits this.
3.3 The processing concerns solely the personal data, categories of data subjects and purposes described in Schedule 1A. Stipt informs the Controller without delay if, in its opinion, an instruction infringes the GDPR.
3.4 If the Controller shares data through the Software with a linked partner company, Stipt does so solely on the Controller's instructions and within the permissions the Controller sets for this. What the partner company subsequently does with the data in its own workspace is the responsibility of that partner company and does not fall under this Data Processing Agreement. The Controller makes the arrangements with the partner company that the GDPR requires for this and informs the data subjects.
3.5 Stipt staff only have access to the Controller's personal data to the extent necessary for support, resolving errors and malfunctions, and the security of the Software. Where possible, they use read-only access in which email addresses, phone numbers and IBANs are masked. If they use AI tools for this, only those of a sub-processor listed in Annex 1B and under business terms under which the content is not used for training.
4. Duration
4.1 This Data Processing Agreement remains in force for as long as Stipt processes personal data on behalf of the Controller, including where this continues after the end of the Agreement. Provisions that by their nature are intended to survive (including confidentiality and article 10) remain in force thereafter.
5. Security
5.1 Stipt takes appropriate technical and organizational measures as referred to in article 32 GDPR to protect personal data against destruction, loss, alteration, unauthorized access and unlawful processing. The current measures are described in Schedule 1C; Stipt takes at least those measures. Stipt assesses periodically, and at least once a year, whether the measures are still appropriate in view of the state of the art and current risks.
5.2 Stipt may update the measures, provided that the level of security does not deteriorate.
6. Confidentiality
6.1 Stipt treats the personal data as confidential. Persons processing personal data under the authority of Stipt are bound by a duty of confidentiality.
7. Sub-processors
7.1 The Controller hereby grants Stipt general written authorization to engage sub-processors. The current sub-processors are listed in Schedule 1B and on Stipt's website.
7.2 Stipt informs the Controller by email at least 30 days in advance of an intended addition or replacement of a sub-processor, at the notice address in the Agreement or, if there is none, the owner of the Controller's workspace in the Software. Merely updating the list on the website does not count as notice. The Controller may object within that period in writing, stating its reasons. If the parties cannot reach agreement, the Controller may terminate the Agreement effective as of the date on which the change takes effect, without either party being liable for damages.
7.3 Stipt imposes on every sub-processor obligations that are at least equivalent to Stipt's obligations under this Data Processing Agreement. Stipt remains fully liable towards the Controller for performance by sub-processors.
8. Transfers outside the EEA
8.1 Stipt processes, and has processing carried out, within the EEA, unless a transfer to a third country is permitted under Chapter V GDPR (adequacy decision, EU-US Data Privacy Framework or standard contractual clauses, where necessary with supplementary measures). The current transfer situation per sub-processor is set out in Schedule 1B. For each sub-processor outside the EEA, Stipt assesses whether the personal data is in fact adequately protected in the country concerned, records that assessment, keeps it up to date and takes supplementary measures where necessary.
9. Personal data breaches
9.1 Stipt informs the Controller without undue delay, and no later than 72 hours after discovery, of a personal data breach that (possibly) relates to personal data of the Controller. To the extent known, Stipt provides: a) the nature of the personal data breach and the (suspected) cause; b) the categories of personal data and data subjects and the (estimated) numbers; c) the likely consequences; d) the measures taken and proposed, including measures to mitigate adverse consequences; e) a contact point for further information.
Stipt reports what is known as soon as it is known and supplements the information later; it does not wait until its investigation is complete before reporting.
9.2 Notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects is the responsibility of the Controller. Stipt does not independently notify the supervisory authority or data subjects, unless the Controller requests this in writing or the law requires Stipt to do so.
9.3 Stipt documents all personal data breaches, including the facts, consequences and corrective measures, and maintains a register thereof. Stipt has a written procedure for handling personal data breaches.
10. Assistance to the Controller
10.1 Stipt provides reasonable assistance in fulfilling the Controller's obligation to respond to requests from data subjects (access, rectification, erasure, restriction, portability, objection). If Stipt receives such a request directly, it forwards it without delay and does not handle it substantively itself.
10.2 Stipt provides reasonable assistance with data protection impact assessments (DPIAs) and prior consultation as referred to in articles 35 and 36 GDPR, to the extent that these relate to the processing under this Data Processing Agreement.
10.3 For assistance that materially exceeds normal service provision, Stipt may charge reasonable costs, subject to prior notification.
11. Requests from authorities
11.1 If Stipt receives a request or order from a Dutch or foreign authority for the provision of, or access to, personal data, Stipt informs the Controller without delay, unless this is legally prohibited. Where possible, Stipt follows the reasonable instructions of the Controller and provides no more than strictly necessary.
12. Audits
12.1 Upon request, Stipt makes available all information reasonably necessary to demonstrate compliance with article 28 GDPR, including summaries of security documentation and, where available, reports of independent security assessments (such as penetration test reports).
12.2 The Controller may, no more than once per year and upon reasonable notice of at least 14 days, conduct or have conducted an audit by an independent expert bound by confidentiality. The audit disrupts Stipt's business operations as little as possible and does not provide access to data of other customers of Stipt. Each party bears its own costs; if the audit reveals a material shortcoming on the part of Stipt, Stipt bears the reasonable costs and remedies the shortcoming as soon as possible. The limit of once per year does not apply if there is a specific reason for a further audit, such as a serious personal data breach or a specific indication that Stipt is not complying with this Data Processing Agreement.
13. Deletion and return
13.1 At the end of the Agreement, the Controller chooses whether Stipt returns or deletes the personal data. Return takes place by export during the retrieval period of article 7.5 of the General Terms and Conditions (at least 30 days): through the export functions in the Software and, for data without an export function of its own, as a full export delivered by Stipt on request in a common, machine-readable format. After the retrieval period, or earlier if the Controller asks for immediate deletion, Stipt deletes all personal data, unless a statutory retention obligation prevents this. If the Controller makes no choice, Stipt deletes the data at the end of the retrieval period.
13.2 Deletion comprises erasing the data from the production database and file storage and destroying the Controller's encryption key, as a result of which the data encrypted with it becomes permanently inaccessible. Personal data in backups is overwritten by the regular backup rotation no later than 35 days after deletion.
14. Liability
14.1 Liability under this Data Processing Agreement is governed by the provisions of article 11 of the General Terms and Conditions, on the understanding that the limitations contained therein do not apply to the extent that this would conflict with mandatory law, including article 82 GDPR.
14.2 The Controller warrants that the processing it instructs is lawful, that it has a valid legal basis for it and that it adequately informs data subjects. The Controller indemnifies Stipt against claims from data subjects or third parties arising from non-compliance with those obligations.
15. Applicable law
15.1 This Data Processing Agreement is governed by Dutch law. The dispute resolution provisions of the General Terms and Conditions apply.
Schedule 1A: The processing
Nature and purpose of the processing. Stipt provides a SaaS platform for customer communication and work organization for installation and construction companies. The processing comprises: storage and hosting; receiving, displaying and sending customer communication (email, WhatsApp and telephony) and emails that the Software sends on behalf of the Controller (such as quotes and appointment messages); for telephony via the Controller's own Twilio account: recording call data and, if the Controller turns on call recording, storing transcripts and summaries of calls in the Software (the recordings themselves remain in the Twilio account); public pages for end customers and partners (quote, scheduling, form and self-billing pages and the customer page); the portal and the mobile app for field technicians and partners, with push notifications; CRM and file management; quotes and invoicing; invoices in the name and on behalf of the Controller's contractors (self-billing); planning, including travel times from the starting address of field technicians; calculating levels and figures per employee or field technician based on work reviews and results, to the extent the Controller uses the Stipt level module; tracking equipment at project and storage addresses; panel layouts for solar panels based on public building and roof data; sharing data, on the Controller's instructions, with partner companies it has connected and with services it connects itself or sets up in workflows; support by Stipt (article 3.5); and, to the extent that the Controller and its users make use of it, AI-supported processing, namely: classification, linking to records, urgency assessment, routing and summarization of messages, calls and records; an assessment of customer satisfaction, which can change a status through rules set by the Controller; drafting responses; automated responses via the WhatsApp assistant (including, after confirmation by the end customer, rescheduling or cancelling appointments) and via the AI phone assistant (recognizing the caller, recording the request and transferring the call); the AI assistant dot (answering questions, analyses and reports, including weekly reports on the work of employees and field technicians chosen by the Controller, and proposals or actions within the user's permissions); checking completed forms and photos and, if the Controller sets this up, independently accepting or returning forms; filling in AI fields in records; remembering preferences and corrections within the workspace; and making documents and communication searchable via a knowledge base (retrieval augmented generation). AI processing takes place per request; the content is not used by the AI sub-processors to train generic models, and what dot learns stays within the Controller's workspace.
Categories of data subjects.
- (end) customers and prospects of the Controller and their contact persons, including callers;
- employees and users of the Controller, including field technicians, and staff of partner companies and independent contractors working through the portal or paid via self-billing;
- other persons appearing in the Controller's communication or documents (such as partners, advisors, suppliers).
Categories of personal data.
- name, address, place of residence, email address, phone number;
- content of communication: emails, WhatsApp messages, chat messages, notes, call reports, and transcripts and summaries of phone calls;
- call data: phone number, time, duration and outcome of calls; for the AI phone assistant also the caller's audio during the call (not stored);
- completed forms, photos and attachments, including photos of and around the home (site survey, execution, delivery);
- quote, order and invoice data, including price and product data;
- signatures (for quotes and deliveries);
- data about the home and installation, including energy consumption and preferences regarding PV systems or other installations;
- IBAN, Chamber of Commerce and VAT number, to the extent provided by the Controller or the data subject, and the earnings of contractors under self-billing;
- planning and appointment data, including the starting address of field technicians and the reason an appointment did not go ahead;
- data about the work of employees and field technicians: work reviews with reasons, levels, figures per person and weekly reports;
- location data: addresses and coordinates of homes and roofs, and the distance between the place where a photo was taken and the address of the record (not the place itself);
- data derived by AI, such as classifications, urgency, summaries, satisfaction scores and form reviews;
- account data of users (name, email, role, rights, activity in the platform, IP addresses and sessions, and device tokens for push notifications).
Stipt does not aim to process special categories of personal data (art. 9 GDPR). The Controller ensures that these are not unnecessarily included in communication or documents. An absence reason such as "Sick" on an appointment may be data concerning health; the Controller does not record a diagnosis or other medical details there.
Retention period. For the duration of the Agreement, plus the export and deletion periods set out in article 13.
Schedule 1B: Sub-processors
The current list is available at stipt.ai/privacy. Upon entering into this Data Processing Agreement, these are:
Engaged by default (a sub-processor only processes data to the extent the related functionality is used, such as WhatsApp or the knowledge base):
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application | EU (Germany) | n/a (EEA) |
| Supabase Pte. Ltd. | Database, file storage and authentication | EU (Frankfurt); established in Singapore | SCCs |
| Cloudflare, Inc. | Network security and handling of web traffic (reverse proxy, protection against attacks, captcha for password reset and the demo form) | Global network; established in the US | EU-US DPF / SCCs |
| Anthropic Ireland, Limited (processing by Anthropic, PBC) | AI processing (including classification, summarization, draft responses, AI assistant dot, WhatsApp assistant, AI phone assistant, call summaries, form review, weekly reports), and AI tools for support by Stipt (article 3.5) | US | SCCs |
| Cohere, Inc. | Making knowledge base and documents searchable (embeddings, reranking of search results) | US; established in Canada | SCCs |
| Meta Platforms Ireland Ltd | WhatsApp Business Platform (message traffic) | EU (Ireland); transfer to US possible | SCCs |
| Plus Five Five, Inc. (Resend) | Sending email from the Software (including quotes, appointment messages and system emails) | US | EU-US DPF / SCCs |
| Functional Software, Inc. (Sentry) | Error monitoring (personal data minimized) | EU (Germany, EU data location); established in the US | EU-US DPF / SCCs |
| Linear Orbit, Inc. | Handling of user reports about bugs and ideas (the text of the report, from which email addresses, phone numbers and IBANs have been removed, a summary, the reporter's first name and company name, a user ID and technical context such as page, role and browser; no screenshots) | EU (EU region); established in the US | SCCs |
| Apple Inc. | Push notifications to the mobile app on iOS (device token, the type of notification and a path in the app; no names or message content) | US | EU-US DPF / SCCs |
| Google LLC (Firebase Cloud Messaging) | Push notifications to the mobile app on Android (device token, the type of notification and a path in the app; no names or message content) | US | EU-US DPF / SCCs |
| Cobalt Mounting Systems [legal form and registered office to be completed] | Only when the Legplan module is used: calculation of the mounting structure and ballast (roof outline with coordinates, building height and panels; no names or contact details) | [to be completed] | [to be completed] |
Only if the Controller expressly chooses the relevant AI provider (not enabled by default):
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| OpenAI, LLC | AI processing (alternative AI provider) | US | EU-US DPF / SCCs |
| Google LLC (Gemini) | AI processing (alternative AI provider) | EU/US | EU-US DPF / SCCs |
| Mistral AI SAS | AI processing (alternative AI provider) | EU | n/a (EEA) |
Only if the Controller turns on the AI phone assistant (AI intake) (not enabled by default) and the call runs via Stipt's voice server:
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Deepgram, Inc. | Speech recognition during the call with the AI assistant (the caller's audio); no participation in model improvement, no storage after processing | EU (European processing endpoint); established in the US | SCCs |
| Eleven Labs Inc. | Voice of the AI assistant (the text the assistant speaks) | US | EU-US DPF / SCCs |
Not sub-processors of Stipt. Services with which the Controller itself has a direct relationship and which it itself connects to the Software do not process as a sub-processor of Stipt but on behalf of the Controller itself. This includes in any event: the Controller's own email provider (such as Microsoft 365, Google Workspace or its own IMAP/SMTP server), its own accounting package (such as Exact Online), its own Twilio account for telephony (numbers, calls, recordings and the transcription during the call; transcripts and summaries are stored by the Software, see Annex 1A) and integrations and automation steps configured by the Controller that send data to external services chosen by the Controller (such as a CRM integration or HTTP steps in workflows). Public (government) data services that are queried solely with address or location data to retrieve public building and yield data (PDOK, 3D BAG, PVGIS) likewise do not qualify as sub-processors. If the AI phone assistant runs via the voice service in the Controller's Twilio account (ConversationRelay), Twilio and the speech providers Twilio engages for this process the audio on behalf of the Controller.
Addresses, travel times and maps (independent controllers). For geocoding addresses, calculating travel times and map display, the Software shares only address and location data (and, for requests made from the browser, the user's IP address) with Google LLC (Maps Platform, as a fallback alongside the in-house route calculation) and the OpenStreetMap Foundation (Nominatim and map tiles). Under their own terms, these parties act as independent controllers, not as sub-processors of Stipt. No names, contact details or communication content are shared with them. If a user opens a navigation link from the Software, the address goes to the map or navigation app the user chooses.
Schedule 1C: Technical and organizational measures
- Encryption: layered encryption; login credentials and integration tokens encrypted at application level (AES-256-GCM) with a separate key per integration or per customer environment, email addresses and phone numbers in the contact file additionally encrypted at application level with the customer environment's key, all other data (including message content, which must remain searchable) encrypted at rest; TLS for all connections.
- Per-customer key management: each customer environment has its own encryption key for the contact data encrypted at application level; destroying that key at offboarding makes that data permanently inaccessible (crypto shredding).
- Access separation: strict separation between customer environments at database level (row level security on every table), tenant isolation at subdomain level and strict cookie isolation.
- Access management: personal accounts, role-based authorization with rights per user (including who sees prices and internal notes), sign-in with email address and password; two-step verification (authenticator app) available to users and enforceable per customer environment for administrators or for all internal staff (not for the portal for field technicians and partners, and not for field workers on a mobile device); active sessions and trusted devices can be reviewed and revoked; support access by Stipt read-only where possible, with email addresses, phone numbers and IBANs masked; Stipt's administrative access to the infrastructure limited to authorized personnel with multi-factor authentication.
- Network security: web traffic runs through Cloudflare (including protection against denial-of-service attacks and rate limiting); a network firewall limits administrative access to the servers (such as SSH and the admin panel) to authorized IP addresses.
- Logging and monitoring: activity logging in the platform, error monitoring, operational health monitoring with alerting.
- Minimization in logs: no names, email addresses or phone numbers in application logs; error reports are stripped of request content, cookies, IP addresses and user email addresses before they are sent, and no session recordings are made.
- Backups: daily automated backups and point-in-time recovery, with limited retention, stored in the EU (Frankfurt).
- Data location: hosting and storage within the EEA (Germany); processing outside the EEA only by the sub-processors and on the transfer mechanisms set out in Schedule 1B.
- Development process: separated development, staging and production environments; database changes first on staging, then on production; automated checks on every change to the main branch (type checking and build); dependency management with weekly automated update proposals.
- Personnel: duty of confidentiality for everyone with access to personal data.


