Data Processing Agreement (DPA)

AI analysis and separate training permissions

AI is used for the function requested by the customer with the content required for it. Selected documents, texts, images, where applicable voice recordings and tool results may contain personal data; automatic removal of all personal references is not promised. For the text and image model routes, the application currently requires EU endpoints, denied data collection and ZDR-capable providers. These routing requirements are not a commitment that brokering, operational metadata or all subcontractors are processed exclusively in the EU. Zero Data Retention does not mean unlimited freedom from storage for all parties involved and replaces neither a DPA nor a third-country transfer basis. This DPA does not permit the use of customer data for PlanElec.be's own training. In particular, a separate training permission does not replace a legal basis or authority for third-party data; PlanElec.be's own training is currently not active.

Input archive for imported files

The customer permits PlanElec.be to retain and analyse copies of the files it reads in through import functions (floor plans as image, PDF, DXF or DWG, Trikker and Sketch project files, templates for the AI schema reader), including intermediate formats and technical logs derived from them. The sole purpose is to analyse import errors and to improve the import and recognition functions; for this purpose PlanElec.be acts as an independent controller, and the purpose limitation under section 2 and the instruction requirement under section 5 do not apply to it. The copies are stored encrypted in the backup storage in the EU, separately from the project data. Only the PlanElec.be team has access; the copies are not disclosed to third parties and are not used to train AI models. They are deleted automatically, after 90 days for Sketch and after at most 24 months for Pro. The customer ensures that it is entitled to provide the files for this purpose. It may object to the retention at any time in text form to the contact named below; PlanElec.be then deletes the existing copies of its account and retains no further ones.

Parties

Customer: The customer named in the service agreement, represented by a person authorised to do so. The customer acts as controller or as processor for another controller. In the second case, PlanElec.be acts as a further processor; the customer ensures the required authorisation of its own principal and a permissible chain of instructions. The choice of a private or business account does not by itself determine the role under data protection law.

Processor: Stephan Behm, Heggen 34, 4837 Baelen, Belgium, enterprise number 1043.329.030 – operator of PlanElec.be.

1. Subject matter and duration

The subject matter is the project content processed on behalf of the customer in the planning and documentation of electrical installations: schematics, floor plans, uploaded documents, collaboration, approvals, exports and explicitly requested AI functions. Processing only begins on an agreed basis. The agreement applies during the commissioned processing and beyond the end of the service agreement for as long as PlanElec.be or its sub-processors still retain customer data.

2. Nature and purpose of the processing

Processing comprises collection by entry or upload, organisation, storage, retrieval, editing, analysis on instruction, provision to authorised collaborators, export, transmission on instruction, backup, restriction and erasure. The sole purpose is the provision of the commissioned planning and documentation services. Account, contract, payment and invoice management, PlanElec.be's own legal obligations and its own product analytics are processed under its own responsibility in accordance with the privacy policy, insofar as PlanElec.be itself determines the purposes and means. This delimitation does not permit the use of project content for advertising or for PlanElec.be's own training. Cockpit and the internal event bus are internal systems of the same operator, not separate sub-processors.

3. Categories of personal data

In the context of use, the following categories of data are processed in particular:

• Names, addresses and contact details entered by the customer of clients, owners, occupants, contact persons and collaborators.
• Property addresses, floor plans, room layouts, photos, drawings, technical installation and system data, insofar as they can be attributed to a natural person.
• Project names, free texts, uploaded documents, selected AI inputs and results, and personal content in commissioned support cases.
• User, organisation, project and transaction identifiers, permissions, timestamps and editing states required for collaboration and traceability.
• Special categories under Art. 9 GDPR and data under Art. 10 GDPR are not part of the commissioned standard service. They must not be entered without a separate written agreement on appropriate safeguards. Personal data that is not required is to be removed before upload or AI processing.

4. Categories of data subjects

The following groups of persons are affected by the processing:

• Clients and end customers of the customer, owners, developers, occupants and tenants.
• Employees, agents and other collaborators of the customer or of its clients.
• Other natural persons whose details the customer legitimately includes in project documents or commissioned communication.

5. Obligations of the processor

Pursuant to Art. 28(3) GDPR, the processor undertakes in particular as follows:

• PlanElec.be processes customer data only on documented instructions from the customer, including with regard to transfers to third countries. The service agreement, this DPA and the operating actions triggered within the agreed scope of functions constitute the initial instructions. Additional instructions are to be sent in text form to the contact named below; PlanElec.be documents them and verifies the sender's authority.
• Where Union or Member State law requires PlanElec.be to carry out a different processing, PlanElec.be informs the customer of that legal requirement in advance, unless that law prohibits such information on important grounds of public interest. If PlanElec.be considers an instruction to infringe data protection law, it informs the customer without undue delay and suspends the affected processing until the matter is clarified.
• PlanElec.be restricts access to authorised persons with a task-related need. They have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; this obligation continues after the end of their activity.
• Taking into account the nature of the processing, PlanElec.be assists the customer by appropriate technical and organisational measures in responding to requests for access, rectification, erasure, restriction, data portability and objections. PlanElec.be forwards requests received directly from data subjects without undue delay and answers them only on instruction or on the basis of a legal obligation.
• Taking into account the information available to it, PlanElec.be assists the customer with security, notifications of personal data breaches, data protection impact assessments and prior consultations under Art. 32 to 36 GDPR. The customer remains responsible for its own statutory deadlines.
• After becoming aware of a breach of the security of customer data, PlanElec.be informs the customer without undue delay via the customer's registered contact address. The notification states, as far as known, the nature and scope, the data subjects and records concerned, the likely consequences, the remedial measures taken or planned, and a contact person. Missing information is provided subsequently without undue further delay; an initial notification does not wait for the investigation to be completed. PlanElec.be documents the incident and the remedial measures and assists the customer with the assessment and notification.
• The customer is responsible for the lawfulness of its instructions, the information and legal bases required vis-à-vis data subjects, the allocation of its access rights and the accuracy of the data transmitted. The customer maintains a reachable contact address. This does not reduce PlanElec.be's own statutory obligations.

6. Sub-processors

The customer grants general written authorisation for the service providers listed below, insofar as they actually process customer data for the agreed function. For AI functions, the intermediary and the downstream model platforms are listed separately. Platform names designate the technical route and do not replace the identification of the contracting company in the supporting evidence. Independent controllers and internal systems are not sub-processors.

Before engaging further processors, PlanElec.be imposes on them by contract the same data protection obligations as set out in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures, and remains liable to the customer for their performance. Intended additions or replacements are notified to the customer in text form at least 30 days before access to its customer data, stating the service provider, task, processing locations and transfer basis; a silent change of the website is not sufficient. The customer may object within this period on reasonable data protection grounds. Until the matter is resolved, the new service provider objected to receives no access to the data concerned. The parties seek a suitable alternative. If no solution is possible, the customer may terminate the affected part of the service without penalty; prepaid fees for services no longer provided thereafter are refunded pro rata. The same protective obligations apply to further processing chains.

7. Processing locations and transfers to third countries

Processing exclusively within the EU is not agreed. In particular when brokering AI requests, delivering emails and in access or support services of international providers, data may be processed outside the EEA. PlanElec.be may carry out such transfers only within the scope of documented instructions and in compliance with Chapter V GDPR. Where no applicable adequacy decision applies, appropriate safeguards, in particular the appropriate Standard Contractual Clauses under Decision (EU) 2021/914, and the required assessment of the level of protection including supplementary measures are to be ensured. Where reliance is placed on the EU-US Data Privacy Framework, the recipient and the specific processing must be covered by a valid certification. A US address alone is not evidence. PlanElec.be makes the relevant evidence available to the customer on request, subject to the protection of legitimate confidentiality interests. If there is no sound basis, the transfer concerned must not take place.

8. Technical and organisational measures (annex)

PlanElec.be ensures a level of protection appropriate to the risk in accordance with Art. 32 GDPR. The following measures specify the safeguards owed for the processing on behalf of the customer; technical developments must not reduce the agreed level of protection:

• Access and permissions: authenticated user access, project- and organisation-based permission checks on the server, restriction of administrative access to authorised persons, and withdrawal of permissions no longer required. Access credentials and service keys are to be protected against disclosure.
• Transmission and separation: encrypted public data transmission via HTTPS/TLS; separation of tenants by permission checks and protection of stored files against unauthorised retrieval. End-to-end encryption that also excludes the operator is not promised.
• Integrity and traceability: checking of inputs and changes, traceability of relevant editing operations, and security-relevant logs with content limited to what is necessary. No unrestricted inclusion of project content in analytics or error logs.
• Availability and recovery: data backups and documented recovery procedures; access protection and limited retention also for backups. Recoverability and the effectiveness of the safeguards are to be tested regularly and after significant changes.
• Operations and organisation: procedures for security updates, vulnerability handling, data protection incidents, erasure requests and the oversight of further processors; data protection instruction of the authorised persons.
• Data minimisation and erasure: restriction of transmitted content to the respective task, purpose-bound retention, blocking and erasure on instruction, and controlled handling of backup copies in accordance with section 9.

9. Return, erasure and end of contract

When the commissioned processing ends, the customer chooses between return followed by erasure and immediate erasure. PlanElec.be provides the customer data in a commonly used electronic format and deletes existing copies, unless Union or Member State law requires retention. The export and the fulfilment of statutory data protection obligations do not depend on the purchase of a paid plan. Merely cancelling a subscription or switching to the free plan does not automatically end storage that is still commissioned. When an account is deleted, the normal recovery procedure provides a grace period of 30 days; on an explicit and permissible instruction, immediate erasure without this grace period is possible. Data subject to statutory retention is limited to the mandatory scope and blocked for other purposes. Backup copies must not be used for further regular processing; erasures are to be re-applied before renewed use following a restore. PlanElec.be informs the customer of the backup and final erasure periods applicable to its commission and confirms completed erasure on request. Further processors delete in accordance with the terms agreed with them. The obligations of this DPA continue until final erasure.

10. Evidence and inspections

PlanElec.be makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the customer or an auditor mandated by the customer. Existing suitable reports may be used initially but do not replace a right of inspection where one is required. Audits are organised with reasonable prior notice in such a way that other customers, confidential information and security remain protected. Audits by the customer take place no more than once per calendar year unless a justified suspicion, a data protection incident or a request from an authority requires an additional audit. The customer bears the costs of its audit. With regard to further processors, PlanElec.be exercises audit rights within the scope of the audit rights agreed with them, primarily by means of their certifications and audit reports. PlanElec.be immediately points out an audit instruction that it considers unlawful.

11. Order of precedence and liability

In the event of conflict, the data protection obligations of this agreement for the processing on behalf of the customer take precedence over the general terms of use. Mandatory data protection law, in particular the rights of data subjects and Art. 82 GDPR, remains unaffected. Internationally agreed Standard Contractual Clauses retain their intended precedence. Amendments to this DPA require a valid agreement; a mere change to this page does not replace it. The provision on announced changes of sub-processors remains unaffected. Otherwise, the governing law and place of jurisdiction of the terms of use apply.

12. Contact and instructions

Please send data protection requests, documented instructions and requests for contractual evidence to: privacy@planelec.be

Delimitation of other recipients

Mollie processes payment data for its regulated payment services as an independent controller. Recommand (BRBX BV) supports PlanElec.be with its own invoicing. PostHog is used for PlanElec.be's own product analytics and technical diagnostics; project content does not belong in analytics events. Insofar as they are not carried out on behalf of the customer, these processing operations are explained in the privacy policy and are not authorised by this DPA as processing on behalf of the customer. For the PV yield forecast, PlanElec.be transmits, only at the customer's request, coordinates of the project location and technical system parameters without names to the public PVGIS service of the Joint Research Centre of the European Commission.