This translation is provided for readability. In the event of any discrepancy, the Dutch version prevails.
1.1 CNMedia: CNMedia, registered with the Chamber of Commerce under number 82910030, having its office at Gerrit Peuscherstraat 393, 7558 BJ Hengelo (the Netherlands), reachable via [email protected] and https://cnmedia.nl, which enters into the agreement as supplier.
1.2 Client: any natural person, legal entity or other organisation that enters into an agreement with CNMedia or negotiates about one. Where these terms distinguish between a business client and a consumer, the special arrangement included for that purpose applies.
1.2a Consumer: a client who is a natural person and who acts for purposes outside his trade, business or profession.
1.3 Agreement: any agreement between CNMedia and client, including quotations, order confirmations, subscriptions, licences, SLAs, data processing agreements and further written arrangements.
1.4 Services: all work, products and services performed or to be performed by CNMedia, including BusLinq/SaaS, custom-developed software and other bespoke solutions, WordPress websites, hosting, domain names, management, maintenance, support, consultancy, integrations and related IT services.
1.5 BusLinq: the SaaS solution offered by or on behalf of CNMedia with the functionality as described from time to time in the agreement, the product documentation or the user environment. The primary website is https://buslinq.nl. CNMedia may also offer BusLinq through country-specific domain names, including .de, .be, .it, .at, .ch, .fr and .es. The domain used does not change the identity of CNMedia as contracting party, unless expressly stated otherwise.
1.6 User: a natural person who has access to a service or an account under the responsibility of the client.
1.7 Client data: all data, files, content, personal data and other information that client or users enter, upload, supply or have processed through a service.
1.8 In writing: by letter or electronic communication, including e-mail and a client or ticket system used by CNMedia, provided the sender can be established with sufficient certainty.
2.1 These general terms and conditions apply to all offers, quotations, agreements and services of CNMedia, unless expressly agreed otherwise in writing.
2.2 Purchasing conditions or other terms of the client are expressly rejected.
2.3 Deviations are only valid if agreed in writing and apply exclusively to the agreement to which they relate.
2.4 In the event of conflict the following order applies, unless agreed otherwise in writing: (a) a signed or expressly accepted specific agreement or order confirmation, (b) a product-specific annex/SLA/data processing agreement, (c) these general terms and conditions, (d) other documentation.
2.5 Additional terms of third parties may apply to products or services of those third parties. CNMedia informs the client about this where those terms are directly relevant to use or delivery.
2.6 For consumers, provisions that by their nature are intended only for business clients do not apply. In so far as a provision conflicts with mandatory consumer law, the mandatory law prevails.
2.7 Where an agreement is concluded with a consumer at a distance or off premises, CNMedia provides the pre-contractual information required by law and the statutory right of withdrawal applies, unless a valid statutory exception applies to it.
2.8 If a consumer expressly requests that a service, including domain registration or hosting, starts during the withdrawal period, CNMedia may begin performance. In so far as required by law, CNMedia first obtains the consumer's express statement or acknowledgement needed for payment of services already performed or for the lapse of the right of withdrawal after full performance.
2.9 If a provision is void or voidable, the remaining provisions remain in force. The parties will replace the invalid provision with a valid provision that approximates its purpose and intent as closely as possible, in so far as the law permits.
3.1 All offers and quotations of CNMedia are without obligation, unless a period of validity or binding force is stated in them.
3.2 The client warrants the accuracy and completeness of all information on which CNMedia bases its offer, planning or price.
3.3 An agreement is formed as soon as the client accepts an offer of CNMedia in writing, places an order that CNMedia accepts, actually starts using a service after having been informed of the applicability of these terms, or CNMedia starts performance at the client's request.
3.4 Obvious calculation, writing and programming errors in offers, price statements and documentation do not bind CNMedia.
4.1 All prices are exclusive of VAT and other government-imposed levies, unless expressly stated otherwise.
4.2 BusLinq subscriptions are invoiced once a year in advance, unless agreed otherwise in writing. Other subscriptions and recurring services are invoiced in advance according to the period stated in the agreement. Other work is invoiced periodically, according to time spent or on agreed milestones.
4.3 Invoices are payable within 14 days of the invoice date, unless a different payment term has been agreed in writing.
4.4 The client is not entitled to suspend or set off payments, except in so far as mandatory law permits this.
4.5 In the event of late payment by a business client, the statutory commercial interest is due without further notice of default. Reasonable extrajudicial and judicial collection costs are for the account of the client. For a consumer, only the statutory rules on default, interest and collection costs apply.
4.6 In the event of payment default, after a reasonable written warning where appropriate, CNMedia may suspend performance or access to services in whole or in part. Payment obligations continue to run during suspension.
4.7 CNMedia may adjust prices for recurring services annually. For business clients: in the event of an increase that exceeds the consumer price index (CPI) by more than 5 percentage points, the recurring service concerned may be terminated as at the effective date of the increase, unless the increase follows from taxes, demonstrable third-party costs, changed legislation or a price mechanism agreed in writing. For consumers, the mandatory rules on price changes and termination always apply.
5.1 An agreement is entered into for the term stated in the agreement. For BusLinq an initial term of at least twelve months applies. If no term is stated for a business recurring service, an initial term of twelve months applies.
5.2 For business clients, a fixed-term agreement is tacitly renewed after expiry by twelve months each time, unless one of the parties terminates in writing at the latest three months before the end of the current term, or a different period is stated in the agreement. For consumers, after any tacit renewal, the possibility of termination and the notice period prescribed by mandatory consumer law apply.
5.3 An agreement for an indefinite term may be terminated in writing with a notice period of three months, unless agreed otherwise.
5.4 Early termination of a fixed-term agreement is only possible if expressly agreed or on the basis of article 22.
6.1 CNMedia performs its services with care and to the best of its ability. Unless a specific result is expressly guaranteed, this concerns a best-efforts obligation.
6.2 The client provides in good time all information, access, decisions, approvals, facilities and cooperation reasonably required for performance.
6.3 The client is responsible for the accuracy, completeness and lawfulness of the information, specifications, content and client data supplied.
6.4 Delay or additional work caused by untimely or incomplete cooperation of the client is for the client's account and risk. CNMedia may adjust planning and deadlines accordingly.
6.5 The client is responsible for selecting the services for its intended use and for setting up its own processes, equipment, network connections and user organisation, unless agreed otherwise in writing.
7.1 Stated delivery, implementation and completion deadlines are target dates, unless they are expressly designated as a strict deadline.
7.2 CNMedia is only in default upon exceeding a deadline after the client has given CNMedia written notice of default and a reasonable further period has passed unused, unless performance is permanently impossible.
7.3 Changes to scope, specifications, integrations, planning or working method may affect price and deadlines.
7.4 Work outside the agreed scope qualifies as additional work and may be invoiced by CNMedia at the agreed or customary rates. CNMedia may require additional work to be confirmed in writing in advance.
8.1 CNMedia may engage third parties and suppliers in performing the agreement.
8.2 With external platforms, hosting providers, APIs, payment providers, mapping services, communication providers, app stores and other third-party services, availability, operation, price and regulation may lie outside the control of CNMedia.
8.3 CNMedia is not responsible for failures, changes or discontinuations at third parties, in so far as these cannot be attributed to CNMedia. CNMedia may offer necessary alternatives or adjustments and pass on the reasonable costs involved where the cause lies outside its control.
8.4 If the client itself prescribes a third party, integration or supplier, the client bears the risk regarding suitability, licences, continuity and cooperation of that third party.
9.1 All intellectual property rights in services, software, BusLinq, source code, models, formats, designs, methods, templates, documentation, database structures, scripts, concepts, know-how and other materials of CNMedia remain vested in CNMedia or its licensors.
9.2 The client only obtains the right of use expressly granted to it in the agreement. That right is in principle non-exclusive, non-transferable and non-sublicensable.
9.3 Transfer of intellectual property rights only takes place if expressly agreed in writing and after all amounts due in respect thereof have been paid in full.
9.4 Even where bespoke development is transferred, CNMedia retains the right to use and further develop generic knowledge, concepts, techniques, routines, modules, frameworks, ideas and non-client-specific components, provided no confidential information of the client is disclosed in doing so.
9.5 The client warrants that materials and client data supplied by it do not infringe the rights of third parties, and indemnifies CNMedia against third-party claims arising from those materials or instructions.
9.6 CNMedia may use the client's trade name and logo as a reference, unless the client objects in writing in advance or the parties have agreed confidentiality.
10.1 The parties treat as confidential information that is marked as confidential or whose confidential nature can reasonably be understood, and use it exclusively for the performance of the agreement.
10.2 The duty of confidentiality does not apply to information that is lawfully public, independently developed, lawfully obtained from a third party, or that must be disclosed by law or by order of an authority.
10.3 The parties may share confidential information with employees, advisers and engaged third parties who need that information for performance and who are subject to a reasonable duty of confidentiality.
10.4 These obligations continue after the end of the agreement for as long as the information retains its confidential nature.
11.1 Each party processes personal data in accordance with the privacy legislation applicable to it, including the General Data Protection Regulation (GDPR).
11.2 In so far as CNMedia processes personal data exclusively for the client as processor, the processing arrangement in Annex 2 applies, unless the parties conclude a separate data processing agreement.
11.3 The client is responsible for the lawfulness of the personal data and instructions it has processed through the services, including informing data subjects and having a valid legal basis.
11.4 The client will not process special categories of personal data, criminal data or data with an exceptionally high risk through BusLinq or other services, unless CNMedia has permitted this in advance in writing and appropriate additional arrangements have been made.
12.1 CNMedia takes appropriate technical and organisational security measures, suited to the nature of the service, the state of the art, the cost of implementation and reasonably foreseeable risks.
12.2 No security measure can guarantee complete protection. CNMedia therefore does not guarantee that security measures are effective in all circumstances.
12.3 The client is responsible for managing accounts, roles, rights, passwords, API keys and other access data, and for timely withdrawal of access of former or unauthorised users.
12.4 The client informs CNMedia without delay of suspected misuse, a security incident or unauthorised access, and follows reasonable security instructions of CNMedia.
12.5 CNMedia may take technical measures to protect the security and integrity of the services and to prevent misuse.
13.1 The total liability of CNMedia for attributable failure or on any other ground is limited to direct damage and never amounts to more than the value of the agreement to which the liability relates. The value of the agreement means the total fee excluding VAT that the client owes CNMedia for the agreed term of the agreement concerned. In the case of a renewed agreement, the total fee excluding VAT for the current renewal period counts as the value of the agreement. A lower liability limit included in a quotation, order confirmation or other written arrangement remains applicable unchanged, in so far as the law permits.
13.2 Any payment under a liability, professional indemnity or cyber insurance policy of CNMedia does not increase the maximum amount determined in article 13.1. The liability of CNMedia can therefore never exceed the applicable value of the agreement, even in the event of a higher insurance payment, in so far as the law permits.
13.3 CNMedia is not liable for indirect damage, consequential damage, lost profit, missed savings, loss of goodwill, business interruption, claims of the client's customers, or loss, corruption or unusability of data, except in so far as such damage is directly caused by intent or deliberate recklessness of CNMedia's management.
13.4 In so far as restoring data forms part of the service, the obligation of CNMedia is limited to restoring from the most recent usable back-up that should be available under the agreed back-up arrangement.
13.5 Limitations of liability do not apply in so far as they are impermissible under mandatory law, among other things in the case of damage caused by intent or deliberate recklessness of management.
13.6 A right to compensation only arises after the client has given CNMedia written notice of default with a reasonable further period, in so far as remedy is still possible. Claims lapse twelve months after the client became aware of the damage and of the possible liability of CNMedia, unless legal proceedings have been instituted before that time.
14.1 Neither party is obliged to perform in so far as it is prevented by a circumstance that cannot be attributed to it.
14.2 For CNMedia, force majeure includes failures or outages at energy, internet, telecommunications, cloud or data centre providers, cyber attacks that could not reasonably be prevented despite appropriate measures, government measures, war, terrorism, pandemics, strikes and shortcomings of suppliers outside the reasonable control of CNMedia.
14.3 If a force majeure situation lasts longer than 60 days, either party may terminate the part of the agreement not yet performed in writing without any obligation to pay damages. Services already performed remain payable.
15.1 CNMedia may suspend access to services or performance if the client is materially in default, does not meet payment obligations, endangers the security or continuity of the service, uses the service unlawfully, or where suspension is required by law or by order of an authority.
15.2 Where circumstances permit, CNMedia informs the client in advance and gives a reasonable opportunity to remedy. In urgent security or misuse situations CNMedia may act immediately.
15.3 Suspension does not release the client from payment obligations for the agreed term, unless the cause of the suspension is attributable to CNMedia.
16.1 During the term of the agreement, CNMedia grants the client a limited, non-exclusive, non-transferable and non-sublicensable right to use BusLinq and other agreed SaaS services over the internet within the package purchased and the associated modules, vehicle numbers, user numbers and any other licence metrics agreed in writing.
16.2 The client obtains no right to the underlying source code, object code, infrastructure or technical documentation, except in so far as CNMedia expressly makes these available to the client.
16.3 The client may not sell, rent out, sublicense, offer to third parties as its own service, reverse engineer, circumvent security measures of, or use the SaaS service to develop a competing service, except in so far as a statutory exception applies mandatorily.
16.4 The client is responsible for the acts of its users and ensures that they comply with the agreement and with reasonable instructions for use.
17.1 BusLinq is delivered with the functionality as described in the current agreement, quotation, product description or activated modules. Functionality not expressly agreed does not count as a guaranteed feature.
17.2 CNMedia may further develop, adjust, modernise BusLinq or replace components. CNMedia is not obliged to maintain particular functionality indefinitely, provided the core functionality of the purchased service is not materially eroded without good reason.
17.3 In the event of a material change that demonstrably substantially reduces the core functionality, CNMedia informs the client in advance where reasonably possible. If no reasonable alternative is offered, the client may terminate the directly affected component as at the effective date of the change.
17.4 Changes necessary for security, continuity, legislation, third-party terms or the prevention of misuse may be implemented without a prior right of termination, in so far as that is reasonable.
18.1 CNMedia aims for an availability target of 99.2% per calendar month for BusLinq, unless a different percentage has been expressly agreed in an SLA or agreement. That percentage is a service target and not a performance guarantee, unless the SLA expressly provides otherwise. In any event, announced maintenance, emergency maintenance, force majeure, failures at networks or services of third parties, and failures attributable to the client or its environment are disregarded in the calculation.
18.2 Planned maintenance, emergency maintenance, failures caused by client or third parties, internet or network problems outside the control of CNMedia, force majeure and agreed exceptions do not count as unavailability in calculating an SLA, unless the SLA provides otherwise.
18.3 CNMedia may temporarily take the service out of operation in whole or in part for preventive, corrective, adaptive, technical or security-related maintenance. CNMedia determines the planning and duration of maintenance at its reasonable discretion, taking into account, where reasonably possible, the interests and use of the client. Without a separate written arrangement, no fixed maintenance windows apply.
18.4 Support is provided through the channels designated by CNMedia or agreed with the client. Unless agreed otherwise in writing, no fixed support hours, opening hours, response times or resolution times apply. CNMedia handles support requests within a period reasonable in the circumstances and on the basis of a best-efforts obligation. CNMedia may adjust its support process, availability and the prioritisation of reports from time to time.
18.5 CNMedia may apply temporary workarounds or problem-avoiding measures until a permanent solution is available.
19.1 The client retains, where applicable, the rights to the client data. The client grants CNMedia, for the duration of the agreement, the rights necessary to host, process, copy, structure and technically use client data for delivery, security, support and improvement of the service.
19.2 The client is responsible for the content, quality, lawfulness, retention periods and any statutory archiving obligations relating to client data.
19.3 CNMedia may use aggregated and genuinely anonymised usage and telemetry data for analysis, security, capacity planning, product improvement and statistics, provided such data cannot reasonably be traced back to the client or an individual.
19.4 The client will not upload malware, unlawful content, infringing data or data whose processing through BusLinq manifestly entails disproportionate security risks.
19.5 The client and users are themselves responsible for checking the accuracy, completeness, currency and suitability of the data that is entered, imported, processed, calculated, generated, displayed or exported through BusLinq. This also applies to data and results arising from automatic calculations, planning, overviews, integrations with third parties, imports, synchronisations and other functionality of BusLinq.
19.6 CNMedia endeavours to have BusLinq function carefully, but does not guarantee that the service, the data processed in it, or the resulting calculations, reports, planning, overviews, recommendations or other results are at all times complete, accurate, up to date, available or free of errors. The client and users must independently verify data and results that are relevant to, among other things, operations, service provision, planning, safety, invoicing, staff deployment or compliance with legislation before relying or acting on them.
19.7 The risk of using data or results from BusLinq without appropriate verification lies with the client. CNMedia is not liable for damage arising from this, except in so far as there is an attributable failure for which CNMedia is liable under mandatory law and article 13. In all cases in which CNMedia is liable, total liability remains limited in accordance with article 13 and never amounts to more than the value of the agreement concerned.
20.1 CNMedia makes a back-up for BusLinq in principle daily. Primary back-up retention is 30 days, unless the agreement or SLA provides otherwise. Back-ups primarily serve continuity and recovery after incidents and do not replace the client's statutory retention or archiving obligations.
20.2 After termination of the agreement, the client has 30 days to secure the client data it requires and, in so far as available within the standard functionality, to obtain an export thereof in a common machine-readable format. The client is itself responsible for checking, downloading, exporting and securely storing that data in good time.
20.3 Non-standard migration, conversion, bespoke exports, assistance with handover or work after the end of the agreement may be invoiced at the rates then applicable.
20.4 After expiry of the export period, CNMedia may delete client data or make it inaccessible, subject to statutory retention obligations, back-up cycles and data that CNMedia must lawfully retain as an independent controller.
20.5 After expiry of the 30-day period referred to in article 20.2, CNMedia is not obliged to keep client data available, to restore it or to export it. CNMedia may thereafter delete the client data concerned or make it inaccessible, subject to statutory retention obligations and data still temporarily present in back-ups in accordance with the normal back-up and retention cycle. The risk that the client has not secured data in good time lies with the client.
21.1 The client and users use BusLinq exclusively for lawful business purposes and in accordance with the documentation and reasonable instructions of CNMedia.
21.2 It is not permitted to use the service for unauthorised access, security testing without permission, distributing malware, spam, fraudulent acts, excessive load, scraping on an unusual scale or infringing the rights of third parties.
21.3 If the client's use affects the stability, security or availability for other clients, CNMedia may apply technical restrictions and instruct the client to adjust its use.
21.4 Where licence metrics are based on numbers of users, vehicles, locations, messages or transactions, CNMedia may verify actual use and invoice any excess afterwards in accordance with the applicable rates.
22.1 A party may rescind the agreement in whole or in part on account of a material attributable failure, after the other party has been given written notice of default and a reasonable further period has passed unused, unless remedy is permanently impossible.
22.2 CNMedia may terminate the agreement with immediate effect if the client is declared bankrupt, ceases or liquidates its business, or if continuation cannot reasonably be required due to serious or repeated unlawful use.
22.3 Upon termination, all services already performed and instalments due become immediately payable. Fees paid in advance are not refunded, except for the part not delivered where the termination is exclusively the result of an attributable failure of CNMedia.
22.4 Upon the end, rights of use and access to SaaS lapse, subject to the time-limited export option under article 20.
23.1 The client may not transfer, pledge or have a third party take over rights or obligations under the agreement without the prior written consent of CNMedia.
23.2 CNMedia may transfer the agreement to a group company or a legal successor in the context of a merger, demerger, sale of business or transfer of the business unit concerned, provided the continuity of the service is not materially reduced by this.
24.1 CNMedia may amend these general terms and conditions where this is reasonably necessary in view of changed services, operations, legislation, security or market developments.
24.2 In the event of material changes, CNMedia informs the client at least 30 days before the effective date. If a change materially adversely affects the legal position of the client and is not necessary for legislation or security, the client may terminate the recurring service concerned in writing before the effective date.
24.3 Non-material, editorial or legally required changes may take effect at shorter notice.
25.1 Dutch law applies to all legal relationships between CNMedia and client. The Vienna Sales Convention is excluded.
25.2 The parties first attempt to resolve a dispute by mutual consultation at management level.
25.3 If consultation does not lead to a solution, disputes will be submitted to the competent court in the district where CNMedia has its registered office, unless mandatory law prescribes another court or the parties agree arbitration or mediation in writing.
26.1 Where CNMedia develops software, websites, integrations or other bespoke work, functionality and specifications are determined by the written arrangements. Implicit expectations or unconfirmed wishes do not form part of the scope.
26.2 If an acceptance test has been agreed, the client carries it out within the agreed period. Without an agreed acceptance test, the result is deemed accepted upon being taken into use for productive purposes or, if earlier, 14 days after delivery, unless the client reports specific reproducible material defects within that period.
26.3 A defect is a reproducible material deviation from expressly agreed functional or technical specifications. Minor deviations that do not materially hinder operational use do not stand in the way of acceptance.
26.4 After acceptance, remedy, changes and further development fall under maintenance, warranty or additional work in accordance with the agreement.
27.1 Hosting, domain registration, certificates and infrastructure are only supplied in so far as agreed. CNMedia may engage specialised third parties for this. BusLinq is hosted on a VPS at Hostinger in the Netherlands, technically managed by CNMedia. For other services of CNMedia, a VPS in Germany may additionally be used. Further information about relevant hosting and sub-processors is included in the current sub-processor or product specification.
27.2 Domain names are registered, where possible, in the name of the client or the holder designated by it. The client remains responsible for the accuracy of the registration data and for timely cooperation.
27.3 CNMedia is not liable for the loss of a domain name due to circumstances outside its control, including incorrect data of the client, disputes about trademark rights or decisions of registries, subject to an attributable failure of CNMedia.
27.4 The client may not use hosting contrary to law, public order, third-party rights or reasonable fair use and security rules.
27.5 For domain registration, the availability of the desired domain name is never guaranteed until the registration has been confirmed by the registry or registrar concerned. Where a registration is carried out at the express request of a consumer within the statutory withdrawal period, CNMedia applies the statutory rules on commencement of the service and on any payment for work already performed.
27.6 Where hosting or domain registration is supplied to a consumer, the statutory consumer rules on information, withdrawal, conformity, price change, renewal and termination apply in addition to this article. A provision deviating from these will not be applied to the detriment of the consumer.
28.1 Concepts, designs and media productions are delivered within the number of revision rounds and the scope set out in the agreement. Additional revisions or new directions count as additional work.
28.2 The client is responsible for the final check of texts, names, facts, prices, claims, rights, consents and other content before publication or production.
28.3 CNMedia is not responsible for the results of marketing, advertising or communication campaigns, such as turnover, reach, conversion or positioning, unless a specific result has been guaranteed in writing.
28.4 Costs of advertising platforms, printing, photography, music, stock material, fonts, licences and other third parties are for the account of the client, in so far as they are not expressly included in the price.
29.1 Advice and recommendations are based on the information and circumstances known at the time of the advice.
29.2 The client remains responsible for decisions, implementation and for assessing whether a recommendation is suitable for its organisation, regulation and risk profile.
29.3 CNMedia is not obliged to update advice automatically after delivery on account of later changes in technology, regulation or circumstances, unless this forms part of an ongoing service.
This annex supplements the general terms and conditions for BusLinq. BusLinq is sold in packages consisting of a combination of modules and an agreed licence scope, including numbers of vehicles and/or users. The specific package content, price and any additional limits are set out per quotation or order confirmation. In the event of conflict, the specific BusLinq quotation or order confirmation prevails.
| Subject | To be completed / standard arrangement |
|---|---|
| Subscription form | Packages with a composition of modules and licence scope |
| Licence metric | Modules + number of vehicles and/or users as stated in the quotation |
| Initial term | At least 12 months; specific term per package/quotation |
| Invoicing | Annually in advance |
| Support channel | [E-mail / ticket / telephone] |
| Support hours | [Working days, times, time zone] |
| Availability/SLA | Service target 99.2% per calendar month; deviations/credits only where agreed in writing in an SLA |
| Planned maintenance | [Window / announcement] |
| Back-up arrangement | Daily; primary retention 30 days; restore from the most recent usable back-up |
| Data export on ending | [Standard formats and any costs] |
| Data retention after ending | 30 days by default, then deletion in accordance with art. 20 |
| Sub-processors | Hostinger (BusLinq VPS hosting in the Netherlands) and further current sub-processors as published/stated by CNMedia |
| Hosting region | The Netherlands (BusLinq VPS at Hostinger) |
| Special personal data | Not permitted without prior written consent |
| Fair use / limits | In accordance with package/quotation; reasonable technical fair use and security limits |
For BusLinq it is advisable to publish a separate SLA and a current list of sub-processors alongside this. An SLA may, if CNMedia later considers this desirable, set out further technical arrangements concerning, among other things, measurement methods, support, maintenance, priorities and response times. Without such an express arrangement, support and maintenance remain flexible in accordance with article 18. BusLinq is currently hosted in the Netherlands.
This annex applies in so far as CNMedia processes personal data for the client as processor within the meaning of article 28 GDPR in performing a service.
B2.1.1 CNMedia processes personal data exclusively for the performance of the agreement and on the basis of documented instructions of the client, unless a statutory obligation requires different processing.
B2.1.2 The client is controller or acts with authority on behalf of the controller and determines the purpose and means of the processing.
B2.2.1 BusLinq may in any event process client data, personal data of employees and, depending on the client's use, personal data of passengers. Further categories of personal data, data subjects, purposes, duration and nature of the processing are set out in the agreement, the BusLinq product annex or a separate processing register/data processing schedule.
B2.2.2 Without written consent, the service is not intended for special categories of personal data or criminal data.
B2.3.1 CNMedia takes appropriate technical and organisational measures, including, where appropriate, access protection, logging, daily back-up management with a primary retention of 30 days for BusLinq, patch management, encryption in transit, secured VPS management and incident response procedures.
B2.3.2 CNMedia may change security measures, provided the level of protection is not materially reduced in a reasonable sense.
B2.4.1 Persons processing personal data under the responsibility of CNMedia are bound by an appropriate duty of confidentiality.
B2.4.2 CNMedia limits access to personal data to persons who need it for performance.
B2.5.1 The client gives general authorisation for the engagement of sub-processors. CNMedia maintains a current list of the relevant sub-processors.
B2.5.2 CNMedia imposes materially comparable data protection obligations on sub-processors for the processing concerned.
B2.5.3 CNMedia informs the client of intended material changes in sub-processors. The client may object within a reasonable period on reasoned data protection grounds. The parties will then seek a reasonable solution; if that is not possible, the directly affected component may be terminated.
B2.6.1 CNMedia informs the client without unreasonable delay after CNMedia has established a breach in relation to personal data that concerns processing for the client.
B2.6.2 CNMedia provides, in so far as reasonably available, information that the client needs to assess its statutory notification obligations. The decision and responsibility for notification to the supervisory authority or to data subjects remains with the client as controller.
B2.7.1 Taking into account the nature of the processing, CNMedia provides reasonable assistance with data subject requests, data protection impact assessments and prior consultation, in so far as this concerns the processing carried out by CNMedia.
B2.7.2 Work that clearly falls outside the normal service may be charged at the customary rates, unless the necessity arises directly from an attributable failure of CNMedia.
B2.8.1 CNMedia provides, on request, reasonable information enabling the client to assess compliance with this processing arrangement, preferably through existing documentation, certifications, reports or questionnaires.
B2.8.2 If this is insufficient and the client has reasonable grounds to doubt compliance, the client may, at most once a year and at its own expense, have an audit carried out by an independent expert bound by confidentiality, with reasonable prior notice and without unnecessary disruption of operations or security.
B2.8.3 CNMedia may limit an audit in so far as necessary to protect other clients, trade secrets, security or statutory obligations.
B2.9.1 For BusLinq, primary hosting takes place in the Netherlands. For other services of CNMedia, hosting may take place in Germany. Both locations are within the EEA. CNMedia may in addition engage sub-processors in accordance with article B2.5.
B2.9.2 If personal data is transferred outside the EEA, CNMedia ensures a valid transfer mechanism in so far as the GDPR requires this, such as an adequacy decision or applicable standard contractual clauses.
B2.10.1 Upon termination, CNMedia deletes or returns personal data in accordance with article 20 and the applicable product specification, unless statutory retention obligations require further storage.
B2.10.2 Deletion from BusLinq back-ups takes place in accordance with the normal back-up and retention cycle. Primary retention is 30 days. During that period, deleted data is not used again for operational purposes, other than for a necessary restore.