iqanywhere data processing agreement
Version 21 October 2026
1. Parties and applicability
This agreement forms part of the iqanywhere terms between the business customer (controller, or processor with their client's permission) and iqsoftware, a sole proprietorship, KvK 78400732, Lissabonpromenade 15, 3541 DP Utrecht (processor/subprocessor). The privacy statement applies to our own account, tax and security administration. This agreement applies to processing on behalf of the customer, for the duration of the service and necessary winding-up. In the event of a conflict concerning personal data, it takes precedence over the terms of use.
2. Processing scope and data
The purpose is to establish, secure and support remote assistance authorised by the customer. Operations include receiving, transmitting, making technically accessible, recording permissions and necessary metadata, security, recovery and deletion. Data subjects may include the customer, employees, clients and other people whose data appear on screen or in supported transfers. Categories are identification/contact details, device/network data, permissions, connection metadata and content the customer makes available during the session. Special-category or criminal-offence personal data are not a required component; the customer assesses in advance whether their specific use requires appropriate additional safeguards and discusses them with us.
3. Instructions and confidentiality
We process data only on documented instructions, including this agreement and the choices of authorised users, unless a legal obligation requires otherwise. We inform you of such an obligation in advance unless prohibited. We report an instruction that we consider unlawful and suspend the relevant part where necessary. The customer ensures a valid legal basis, information for data subjects and authority to grant access. Only authorised people bound by confidentiality receive necessary access. Customer content is not used for advertising or model training.
4. Security and incidents
Measures include restricted access, optional 2FA, explicit or saved/revocable permission, encrypted transport, signed software, separation of customer access rights, security updates, limited technical records and encrypted backups with recovery checks. The specific arrangements and limitations are explained on request. The customer secures their own endpoints and accounts. No complete end-to-end encryption or absolute security is promised.
We notify the customer of a personal data breach relating to the processing without undue delay via the known contact address. We provide available information about its nature, the data and people affected, likely consequences and measures taken, supplement missing information as soon as possible and cooperate in investigation and mitigation. The customer determines their own notification obligations; we provide support so that statutory deadlines can be met.
5. Subprocessors and transfers
The customer gives general authorisation for the subprocessors necessary for iqanywhere: OVHcloud (server hosting) and, to the extent that data processed on the customer's behalf pass through it, Cloudflare (web hosting, DNS and security). Invitation and account emails are processed on our own hosted mail server. Stripe processes payment and tax data under its own roles and terms and is not a recipient of screen sessions. MeshCentral is self-hosted software, not an external storage service.
We impose at least equivalent protection obligations on relevant subprocessors and remain responsible for their processing under this agreement. We notify the customer at their contact address of a planned addition or replacement at least thirty days in advance. The customer may raise a reasoned objection within that period; we seek a suitable alternative. If that is not possible, the customer may terminate the affected part with a refund of unused subscription fees.
Transfers outside the EEA take place only with a valid GDPR basis, such as an applicable adequacy decision or standard contractual clauses and, where necessary, additional safeguards. On request, we provide information about the parties, locations and safeguards used, while protecting other customers and trade secrets.
6. Assistance and verification
We provide reasonable assistance with access, correction, transfer, deletion, restriction, objection, security, breach notifications and, where necessary, a DPIA or prior consultation. We forward data subjects' requests concerning customer content to the customer. We provide information to demonstrate compliance and cooperate with reasonable audits by the customer or an independent auditor. Agree the scope, confidentiality and schedule in advance, without obstructing necessary urgent action or statutory supervisory powers. Any exceptional costs are agreed in advance; this does not remove our statutory obligations.
7. End of processing and deletion
At the end of the processing, we delete personal data stored on the customer's behalf or, at the customer's choice and request, return them first, generally within thirty days of a verified request. Legally required retention remains limited to that purpose. Access permissions are revoked. Data in encrypted, protected recovery backups disappear through backup rotation; on recovery, deletions are reapplied before the service becomes public. We confirm completion. The customer deletes or retains their own local app data and copies in accordance with their own obligations.
Contact
Requests, instructions and incidents: support@iqsoftware.nl. State your customer/account email address and the computer or processing concerned; do not send passwords or access codes.