Data processing agreement

• Controller: the studio using a Werkbank account (“the Studio”).
• Processor: Wabi-Sabi Livingware, trading as Werkbank, a sole proprietorship with KvK number 99427214 and VAT number NL005385788B45.

This agreement is annexed to, and forms part of, the Werkbank terms of use.

Werkbank processes personal data solely on behalf of the Studio, to deliver the service: tracking work through the production process, kiln scheduling, cost allocation, course and booking administration, and sending the related messages to students. The agreement lasts for as long as Werkbank processes personal data for the Studio.

• Data subjects: students and other participants the Studio enters into Werkbank; the Studio's team members.
• Data: name, e-mail address, phone number, booking/student number, status-link token, enrolments, attendance, pickup moments, agreement to studio policy, breakage records (incl. any photo and note), outstanding firing costs, marketing consent, and send logs. See the privacy statement for the full list.
• Werkbank does not process, and does not ask for, special categories of personal data. Free-text fields can unintentionally contain more sensitive information; the Studio is responsible for that.

Werkbank processes personal data only on the basis of documented instructions from the Studio, as set out in this agreement and the service itself, unless a legal obligation requires otherwise. Werkbank does not use the data for its own purposes and does not sell it.

Werkbank takes appropriate technical and organisational measures, including: encrypted transport (HTTPS/HSTS), password hashing with argon2id, lockout and rate-limiting against brute-force attacks, per-studio data isolation with role-based access, and filtering personal data out of error monitoring and analytics. See the privacy statement, section 6.

The studio gives every employee, teacher and volunteer their own personal account and does not share login details. This limits access to personal data to those who need it and keeps it traceable to individuals.

The Studio gives Werkbank general authorisation to engage the sub-processors listed below. Werkbank announces changes in advance; the Studio may raise a reasoned objection.

Transfers outside the EEA only take place on a valid legal basis: an adequacy decision or the EU Standard Contractual Clauses (SCCs), with supplementary measures where needed.

Werkbank assists the Studio, to the extent reasonably possible, in responding to requests from data subjects (access, correction, deletion, portability) and with data protection impact assessments and consultations with the supervisory authority. In the app, the Studio can view, correct, export and delete students itself.

Werkbank informs the Studio without undue delay after becoming aware of a personal data breach, with the information the Studio needs to meet its own notification obligations. Report to sam@getwerkbank.app.

After the service ends, Werkbank deletes the Studio's personal data, or returns it on request, unless retention is legally required. The Studio can export its data itself at any time, on any plan and also after cancelling, via Account › Stop using Werkbank: your customer, work and money data as files (CSV and invoices as PDF), plus a list of temporary download links for the photos.

If the Studio deletes the studio itself, all associated data is deleted immediately and the photos are removed from file storage as soon as possible. If the Studio's subscription ends (cancelled or unpaid) and nobody from the Studio logs in for 90 days afterwards, Werkbank warns the owner by email 30 and 7 days beforehand and then deletes the studio with all data and photos, as well as user accounts that no longer belong anywhere else. Logging in again restarts the 90 days. Invoices that Werkbank issues to the Studio itself are kept for 7 years (tax retention duty).

On request, Werkbank provides the Studio with the information needed to demonstrate compliance with Art. 28 GDPR, and cooperates with audits. Werkbank and the Studio agree reasonable scheduling, confidentiality and any reasonable costs in writing beforehand.