Data processing agreement

• Controller: the studio using a Werkbank account (“the Studio”).
• Processor: Wabi-Sabi Livingware, trading as Werkbank, a sole proprietorship with KvK number 99427214 and VAT number NL005385788B45.

This agreement is annexed to, and forms part of, the Werkbank terms of use.

Werkbank processes personal data solely on behalf of the Studio, to deliver the service: tracking work through the production process, kiln scheduling, cost allocation, course and booking administration, and sending the related messages to students. The agreement lasts for as long as Werkbank processes personal data for the Studio.

• Data subjects: students and other participants the Studio enters into Werkbank; the Studio's team members.
• Data: name, e-mail address, phone number, booking/student number, status-link token, enrolments, attendance, pickup moments, agreement to studio policy, breakage records (incl. any photo and note), outstanding firing costs, marketing consent, and send logs. See the privacy statement for the full list.
• Werkbank does not process, and does not ask for, special categories of personal data. Free-text fields can unintentionally contain more sensitive information; the Studio is responsible for that.

Werkbank processes personal data only on the basis of documented instructions from the Studio, as set out in this agreement and the service itself, unless a legal obligation requires otherwise. Werkbank does not use the data for its own purposes and does not sell it.

Werkbank takes appropriate technical and organisational measures, including: encrypted transport (HTTPS/HSTS), password hashing with argon2id, lockout and rate-limiting against brute-force attacks, per-studio data isolation with role-based access, and filtering personal data out of error monitoring and analytics. See the privacy statement, section 6.

The Studio gives Werkbank general authorisation to engage the sub-processors listed below. Werkbank announces changes in advance; the Studio may raise a reasoned objection.

Transfers outside the EEA only take place on a valid legal basis: an adequacy decision or the EU Standard Contractual Clauses (SCCs), with supplementary measures where needed.

Werkbank assists the Studio, to the extent reasonably possible, in responding to requests from data subjects (access, correction, deletion, portability) and with data protection impact assessments and consultations with the supervisory authority. In the app, the Studio can view, correct, export and delete students itself.

Werkbank informs the Studio without undue delay after becoming aware of a personal data breach, with the information the Studio needs to meet its own notification obligations. Report to sam@getwerkbank.app.

After the service ends, Werkbank deletes the Studio's personal data, or returns it on request, unless retention is legally required. The Studio can export its data at any time via Firing costs › Export. When a studio is deleted, all associated data is deleted.

On request, Werkbank provides the Studio with the information needed to demonstrate compliance with Art. 28 GDPR, and cooperates with audits. Werkbank and the Studio agree reasonable scheduling, confidentiality and any reasonable costs in writing beforehand.