Data Processing Agreement

The terms for the personal data you, as a Heli HQ customer, process about your leads and clients. Version 6, 25 October 2026. This English version applies to customers established outside the Netherlands; for customers in the Netherlands the Dutch version applies.

1. Parties and subject

This agreement applies between the Customer (controller) and Heli HQ, Papaverweg 34, 1032 KJ Amsterdam, the Netherlands, KvK 96162996 (processor). It forms part of the Terms of Service, is concluded when the Customer creates an account and applies as long as the account exists. It is intended to meet Article 28 of the EU GDPR and of the UK GDPR, the Swiss Federal Act on Data Protection, and the service provider requirements of US state privacy laws such as the CCPA, to the extent they apply.

2. What we process and why

The Customer uses Heli HQ to run its business. In doing so we process, on behalf of the Customer, personal data of the Customer's leads, clients, staff and contact persons: contact details (name, email address, phone number, address), appointments and bookings, packages and payment statuses, quotes, invoices and documents, notes and messages, answers to onboarding forms, and data that comes in through integrations (such as leads from a form on the Customer's website or from Meta lead forms). We process this data only to provide the Service, on the Customer's documented instructions, for the duration of the Agreement.

Special categories of data. The Service is not intended for special categories of personal data, such as health data. If the Customer nevertheless collects such data, for example in an onboarding form, the Customer is responsible for having a valid legal basis and informing the data subjects properly. The Heli HQ WordPress plugin does not forward fields with passwords, payment details (card numbers, IBAN), national identification numbers or health data, and sets its source cookie only after the visitor accepts marketing cookies. The Customer is responsible for the cookie banner on its own website.

3. Obligations of Heli HQ

• We process the data only on the Customer's documented instructions, as they follow from this agreement and the use of the Service, and never for our own purposes. If we believe an instruction infringes applicable data protection law, we tell the Customer immediately.
• Everyone at Heli HQ with access to the data is bound by confidentiality.
• We take appropriate technical and organisational measures; see the annex below.
• We assist the Customer with requests from data subjects (access, correction, erasure, portability, objection), with data protection impact assessments and with any prior consultation of a supervisory authority, as far as can reasonably be expected of us.
• In case of a personal data breach affecting the Customer's data, we inform the Customer without undue delay and no later than 48 hours after discovering it, with, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. This allows the Customer to meet its own notification duty within 72 hours.
• What the Customer deletes in the Service (such as a lead, client or file) we keep for thirty more days and then erase permanently, including from storage. If the Customer sent a client an invoice, or a signed document, accepted quote or payment belongs to that client, we anonymise the client and keep those records, so the Customer can meet its record-keeping obligations.
• We make available the information needed to demonstrate compliance with this agreement, for example by answering questions or, after consultation and at the Customer's expense, allowing an audit.

4. US state privacy laws

Where the CCPA or a similar US state law applies, Heli HQ acts as the Customer's service provider (or processor) and: does not sell or share the Customer's personal information; does not retain, use or disclose it for any purpose other than providing the Service, including outside the direct business relationship with the Customer; does not combine it with personal information from other sources except as permitted by law; complies with the applicable law and provides the same level of privacy protection; and notifies the Customer if it can no longer meet its obligations. The Customer may take reasonable steps to stop and remediate unauthorised use.

5. Sub-processors

The Customer authorises us to engage the sub-processors below. We have agreements with each of them that are at least equivalent to this agreement, and we remain fully responsible to the Customer for their performance.

Integrations the Customer switches on itself, such as Google Calendar and Drive, its own Stripe or Mollie account, Meta, Instantly, Klaviyo, Fathom, Jortt, Xero, QuickBooks and Microsoft Clarity, we use on the Customer's instruction. The Customer has its own agreement with those services; they are not sub-processors of Heli HQ. Data that comes in through a Google integration is used only for the feature the Customer switched on, in line with the Google API Services User Data Policy, including the Limited Use requirements.

We announce new sub-processors at least thirty days in advance by email. The Customer may object within that period and, if we cannot accommodate the objection, cancel the Agreement.

6. International transfers

The data is stored in the European Union. Where a sub-processor processes data outside the European Economic Area, the United Kingdom or Switzerland, or is based there, transfers take place on the basis of an adequacy decision (such as the EU-US Data Privacy Framework and its UK and Swiss extensions, where the sub-processor is certified) or otherwise on the basis of the European Commission's Standard Contractual Clauses (Module 3, processor to processor) and, for UK data, the UK International Data Transfer Addendum, with supplementary measures where needed. Where the Customer is established outside the EEA and receives data from Heli HQ, the Standard Contractual Clauses (Module 4, processor to controller) apply to that transfer to the extent required, and are incorporated by reference.

7. Obligations of the Customer

The Customer ensures that it may lawfully process the data and entrust it to Heli HQ, that it informs its own data subjects, and that its Users handle sign-in details carefully. If the Customer collects payments from its own clients through Heli HQ, it is responsible for a valid mandate or authorisation and any legally required pre-notification to its clients.

8. End of the agreement

The Customer can export all its data at any time under Settings, Export everything. If the Customer deletes its Workspace, it is no longer accessible immediately, so the Customer exports first. No later than thirty days after deletion we permanently erase all of the Customer's data, including files in storage and backups within their cycle. The Customer exports the invoices it sent to its own clients through Heli HQ before deletion; the legal record-keeping obligation for those lies with the Customer. Heli HQ only keeps the invoices Heli HQ itself sent to the Customer, for seven years, because of Dutch tax law.

9. Liability and law

Liability is governed by the Terms of Service. This agreement is governed by the laws of the Netherlands, and the court in Amsterdam has exclusive jurisdiction, without prejudice to the rights of data subjects and supervisory authorities under applicable data protection law.

Annex: security measures

• Encryption: all connections via HTTPS (TLS); passwords stored hashed; integration keys and bank account numbers stored encrypted.
• Access: every team member has their own sign-in, with a confirmation code by email on a new device; passwords found in public breaches are refused.
• Permissions: for each team member the Customer decides which parts they can see; the database enforces this per table.
• Separation: data of different customers is separated per Workspace and shielded by the database.
• Availability: daily backups by the database provider.
• Logging: errors and important actions are logged and deleted after ninety days.
• Links with access: links to quotes, invoices and documents contain an unguessable code; only a hashed version of it is stored in the database.