Data processing agreement for consulting

Version 0.1 · 17 October 2026 · Items in [square brackets] are being finalised. A signable copy of this agreement is available on request via the contact page. The customer accepts it by ticking the box for it on the contact form when requesting consulting (section 15).

This English text is a translation; in case of differences the Dutch text prevails.

1. Parties and roles

This agreement is between the customer who commissions consulting work from us (the controller) and [Matso legal entity name and form], KvK [KvK number], [address], the Netherlands (the processor, "we"). It applies to all personal data we process on the customer's behalf while carrying out that work (the engagement). It does not cover the use of our software, for which the separate data processing agreement applies.

2. What processing this covers

• Subject matter: consulting work for the customer — for example building or reviewing reports, data models and KPI definitions — carried out inside the customer's own environment, such as Power BI or Microsoft Fabric.
• Duration: the term of the engagement, until our access ends as described in section 11.
• Nature and purpose: viewing and analysing data, and building or changing reports and models, within the rights the customer gives the guest account (section 4), solely to carry out the engagement.
• Types of personal data: the personal data in the part of the customer's environment that the guest account can reach — for example names, business email addresses and roles of the customer's people, and personal data in the datasets behind the reports. The customer determines that content and decides what the guest account can reach.
• Categories of data subjects: the customer's employees and other users of its environment; and individuals whose data the customer holds in the datasets we work with.

3. Instructions

We process personal data only on the customer's documented instructions: its request for the engagement and its further written instructions (email is enough). We use the data only to carry out the engagement, not for our own purposes. We will inform the customer if, in our view, an instruction violates the GDPR or other applicable data protection law.

4. Working in the customer's environment

• We work only inside the customer's own environment, through a named guest account in the name of the person who works on the engagement (the guest account), which the customer creates and controls. The customer decides what the guest account can see and do, and can block or remove it at any time.
• No copies or extracts of personal data leave the customer's environment — not to our own devices, not to our own systems, not anywhere else — except what the customer asks us to make in writing.
• A copy that the customer asks for in writing is used only for the engagement and is deleted at the end of the engagement (section 11).

5. Confidentiality

Everyone who works on the engagement under our authority is bound by confidentiality obligations and has access to personal data only to the extent needed for the engagement. We access personal data in the customer's environment only to carry out the engagement, or where required by law.

6. Security (Article 32)

We implement appropriate technical and organisational measures for our access to the customer's environment. We follow the security settings that the customer's environment applies to the guest account, for example multi-factor authentication. The security page describes how we handle access to the customer's environment.

7. Sub-processors

We use no sub-processors for consulting work, so none is listed. We will announce any intended addition at least 30 days in advance, giving the customer the opportunity to object. The platforms the customer's environment runs on, and the customer's own providers, are not our sub-processors.

8. Data subject rights

If a data subject contacts us directly about data we process for the customer, we forward the request to the customer without undue delay. Taking into account the nature of the processing, we assist the customer with appropriate measures; because the data stays in the customer's environment, the customer's own tools are the first line of that assistance.

9. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, and provide the information reasonably needed for the customer's own notification duties under Articles 33 and 34 GDPR: the nature of the breach, the categories and approximate numbers involved, likely consequences, and the measures taken.

10. Assistance with DPIAs

We provide reasonable assistance with data protection impact assessments and prior consultations with the supervisory authority, insofar as they concern the processing in the engagement.

11. End of the engagement

At the end of the engagement, or earlier if the customer asks, our access ends: we stop using the guest account and hand it back to the customer, who removes it. We delete any copy made at the customer's written request. On request we confirm in writing that access has ended and that the copies are deleted.

12. Audits

We make available the information reasonably necessary to demonstrate compliance with this agreement. The customer may audit compliance at most once per year, on 30 days' notice, during business hours, without disrupting operations, at its own cost, and under confidentiality. We may satisfy an audit request with a recent independent report where one exists.

13. International transfers

Personal data stays in the customer's own environment, and the customer decides where that environment is hosted. We transfer personal data to a country outside the EEA — including by accessing it from there — only on the customer's documented instructions.

14. Liability and governing law

Liability under this agreement follows the liability provisions agreed for the engagement in writing. This agreement is governed by Dutch law; disputes go to the competent court in [Amsterdam], the Netherlands.

15. Acceptance and versions

The customer accepts this agreement by ticking the box for it on the contact form when requesting consulting, or by signing a copy. The person who ticks the box confirms that they may accept on the customer's behalf. We store the accepted version with the request. A later version applies only to an engagement for which the customer accepts it.