General Terms and Conditions Calendarlink

You can download the terms in PDF format: English or Dutch.
‍
These terms and conditions apply to every offer and every service of Calendarlink and form an integral part of every agreement between you and Calendarlink. If you have any questions or comments after reading these terms and conditions, please feel free to contact us.

Registered name: TrendLink B.V.

Trade name: Calendarlink

Business address: Kromweistraat 8, 5066 BK Moergestel, the Netherlands

Website: calendarlink.com

Effective date: October 20, 2026

Article 1 – Definitions

The terms written with a capital letter in the General Terms and Conditions and in the Agreement have the meaning given to them below.

a. Offer: any offer by Calendarlink to provide services, in whatever form, including a quotation and an offer made online on the Platform that can be accepted there.

b. Subscriber: a person who, by means of a Calendar Subscription, subscribes to a series of Events managed by the Customer.

c. Account: the personal access to the Platform obtained by registration, consisting of a username and password or another login method offered by Calendarlink.

d. Customer: the natural person or legal entity that, acting in the course of a profession or business, creates an Account or enters into an Agreement with Calendarlink.

e. Calendar Subscription: the functionality by which the Customer shares a series of Events as a subscribable calendar, whereby changes are automatically updated in the calendar of the Subscriber.

f. General Terms and Conditions: these general terms and conditions, including Annex 1.

g. Administrator: the Team Member who manages the Account on behalf of the Customer and grants and revokes the rights of other Team Members.

h. Calendarlink: TrendLink B.V., trading under the name Calendarlink, established in Moergestel.

i. Participant: a person who uses a link shared by the Customer to add an Event to their calendar, visits an Event Page or completes an RSVP.

j. Enterprise Use: the use of the Platform under a Plan of the Enterprise package, which the Parties agree outside the Platform on the basis of an Offer and which may include an additional service description, additional services or different usage limits.

k. Event: a calendar appointment, one-off or recurring, created by the Customer on the Platform or generated by automated means.

l. Event Licence: the right to use the functionality of a paid Plan for one Event, during the period stated in the Offer.

m. Event Page: the web page generated by Calendarlink on which an Event is displayed to Participants and from which the Event can be added to a calendar.

n. External Service: a service of a third party that is connected to the Platform or is necessary for the operation of a functionality, including calendar, automation, communication and payment services.

o. Free Plan: the Plan that Calendarlink offers free of charge, with the functional limitations stated on the Platform.

p. Intellectual Property Rights: all intellectual property rights and related rights, including copyrights, database rights, domain names, trade name rights, trademark rights, design rights, neighbouring rights and patent rights, as well as rights to know-how.

q. Office Hours: the hours on a Working Day between 09:00 and 17:00 (Dutch time).

r. Customer Data: all data that the Customer, its Team Members, Participants or Subscribers enter, upload, generate or have processed by means of the Platform.

s. Agreement: the agreement between Calendarlink and the Customer under which Calendarlink makes the Platform available and of which the General Terms and Conditions form an inseparable part.

t. Party: Calendarlink or the Customer, and jointly: Parties.

u. Personal Data: personal data within the meaning of Article 4(1) of the General Data Protection Regulation.

v. Plan: the subscription type chosen by the Customer, with the functionalities and usage limits stated for it on the Platform.

w. Platform: the online service of Calendarlink accessible via calendarlink.com and its affiliated subdomains, including the associated application programming interface.

x. Trial Period: the period during which the Customer uses a paid Plan free of charge.

y. RSVP: the functionality by which the Customer requests data from Participants before they add an Event to their calendar.

z. In Writing: on paper as well as in electronic form, including by e-mail and via the Platform, provided that the identity of the sender and the integrity of the message are sufficiently established.

aa. Team Member: the natural person authorised by the Customer to use the Account.

bb. Confidential Information: all non-public information that the Parties receive from each other in connection with the Agreement and whose confidential nature has been indicated or is reasonably apparent, including the non-public functionality and security of the Platform, pricing arrangements and Customer Data.

cc. Data Processing Agreement: the data processing agreement included as Annex 1 to the General Terms and Conditions.

dd. Working Day: Monday through Friday, excluding the public holidays recognised in the Netherlands under the General Extension of Time Limits Act (Algemene termijnenwet) and the days on which Calendarlink has announced in advance that it will be closed.

Article 2 – Applicability and order of precedence

The General Terms and Conditions apply to every Offer of Calendarlink, to every Agreement and to every use of the Platform, including future Agreements.
The Data Processing Agreement is included as Annex 1 to the General Terms and Conditions and forms an integral part thereof. Acceptance of the General Terms and Conditions also constitutes acceptance of the Data Processing Agreement.
The applicability of purchasing conditions or other terms and conditions of the Customer is expressly excluded. Such conditions apply only if Calendarlink has expressly accepted them In Writing.
In the event of conflict between the applicable documents, the following order of precedence applies, whereby the document mentioned first prevails over the document mentioned later: the supplementary arrangements agreed In Writing between the Parties, the Offer, the General Terms and Conditions, and the terms and conditions of the Customer accepted In Writing by Calendarlink.
By way of derogation from the previous paragraph, the Data Processing Agreement prevails over the other parts of the Agreement insofar as it concerns the processing of Personal Data.
Deviations from the General Terms and Conditions apply only if Calendarlink has expressly accepted them In Writing.
The General Terms and Conditions are made available in several languages. In the event of any discrepancy between the language versions, the Dutch text prevails.

Article 3 – Formation of the Agreement and registration

An Offer in the form of a quotation is without obligation and valid for thirty (30) days from its date, unless a different period of validity is stated in the quotation. If the quotation is undated, this period starts on the day on which Calendarlink sent the quotation to the Customer.
The Agreement is formed by acceptance of an Offer by the Customer, or by registration of an Account on the Platform whereby the Customer accepts the General Terms and Conditions by ticking the box provided for that purpose.
By the acceptance referred to in the previous paragraph, the Customer also accepts the Data Processing Agreement.
Calendarlink makes the General Terms and Conditions and the Data Processing Agreement available to the Customer electronically before or upon the formation of the Agreement, in a manner that allows them to be stored and consulted later. The version, date and time of acceptance recorded by Calendarlink serve as proof thereof between the Parties, subject to proof to the contrary by the Customer.
The Customer registers exclusively in the course of a profession or business. The person who creates the Account and accepts the General Terms and Conditions warrants that they are authorised to do so and to bind the Customer.
Calendarlink is bound by an acceptance by the Customer that deviates from the Offer, even on minor points, only if Calendarlink expressly accepts that deviating acceptance In Writing.
The applicability of Article 6:227b(1) and Article 6:227c of the Dutch Civil Code is excluded.

Article 4 – Performance of the Agreement

Calendarlink endeavours to perform the Agreement as soon as possible and observes the care of a prudent service provider in doing so. Time limits communicated by Calendarlink or agreed between the Parties are indicative and never constitute firm deadlines.
Calendarlink makes the Platform available in the condition it is in at the time of use and with the functionalities that belong to the Plan chosen by the Customer.
The Customer provides Calendarlink with all cooperation that is necessary or desirable for the proper performance of the Agreement and provides all information that Calendarlink indicates, or that the Customer should reasonably understand, to be necessary for that purpose. Calendarlink has the right, but not the obligation, to verify the accuracy and completeness of this information.
If the Customer fails to provide the cooperation referred to in the previous paragraph, or if the information provided proves to be inaccurate or incomplete, Calendarlink has the right to suspend performance of the Agreement until the Customer has fulfilled its obligations. The fees owed by the Customer remain due in full during that period.
Calendarlink has the right to engage third parties in the performance of the Agreement. The related costs are borne by the Customer only if the Parties have so agreed.
Calendarlink has the right to adapt the manner of performance to changes in External Services, provided that the functionality of the Platform is not materially reduced as a result.

Article 5 – Access to and use of the Platform

By registering an Account, the Customer obtains the non-exclusive, non-transferable right to use the Platform as an online service during the term of the Plan and solely for the use intended under the Agreement within its own organisation or for the benefit of clients of the Customer. In the case of use for the benefit of clients, the Customer remains the contracting party of Calendarlink and remains responsible for the use of the Platform and for compliance with the Agreement by the persons to whom it grants access.
The Customer can add and remove Team Members through the Account. The Customer is responsible for managing Team Members and for granting and revoking rights, and warrants that Team Members comply with the Agreement.
An Account is personal and the login details are kept secret. The Customer uses a sufficiently strong password for each Account and immediately changes any default password provided by Calendarlink.
Calendarlink may assume that the person who logs in with an Account is authorised to do so on behalf of the Customer and that all actions performed from an Account take place under the direction and supervision and with the approval of the Customer.
If login details of an Account are suspected to have been lost or compromised, the Customer immediately takes all measures reasonably necessary to prevent misuse and immediately reports this to Calendarlink, so that additional measures can be taken.
Calendarlink has the right to restrict or suspend access to the Platform or to an Account if it has well-founded reason to believe that there is misuse, a security risk or conduct in breach of the Agreement. Calendarlink informs the Customer thereof as soon as possible.

Article 6 – Free plan and trial period

Calendarlink offers a Free Plan with the functionalities and usage limits stated on the Platform. The General Terms and Conditions apply in full to the use of the Free Plan.
Calendarlink has the right to change or restrict the functionalities and usage limits of the Free Plan and to discontinue the Free Plan. Calendarlink informs the Customer thereof in advance via the Platform or by e-mail, unless the change is of minor importance.
Calendarlink has the right to suspend or terminate an Account on the Free Plan if it has not been used for three (3) months. Upon termination, access to the Account and to the Customer Data contained therein lapses.
Calendarlink may offer the Customer a Trial Period for a paid Plan for the period stated in the Offer or on the Platform.
After the Trial Period ends, the paid Plan commences at the fee applicable at that time, unless the Customer cancels the paid Plan or reverts to the Free Plan via the Account before the end of the Trial Period.
Article 16 does not apply to the Free Plan and the Trial Period, and the limitation of liability set out in Article 23 applies.

Article 7 – Subscriptions, one-off event licence and enterprise

The Customer chooses a Plan. The Plan commences on the day on which Calendarlink makes the associated functionality available to the Customer.
A Plan is entered into for the period stated in the Offer and is automatically renewed for the same period each time upon expiry, unless the Customer cancels the Plan via the Account or reverts to the Free Plan before the end of the current period. In the case of Enterprise Use, by way of derogation, the Customer may cancel the Plan In Writing with effect from the end of the current period, subject to a notice period of three (3) months. In the case of Enterprise Use, this notice period also applies to reverting to the Free Plan.
The Customer may upgrade to a Plan with more functionalities during the term. The difference in fee is charged pro rata for the remaining period. A downgrade to a Plan with fewer functionalities takes effect on the first day of the next period.
Calendarlink may offer an Event Licence by which the Customer uses the functionality of a paid Plan for one Event. An Event Licence ends by operation of law upon expiry of the period stated in the Offer and is not renewed.
For Enterprise Use, including the integration of the Platform into the environment or application of the Customer, the Parties may make supplementary arrangements In Writing. Those arrangements leave the General Terms and Conditions otherwise unaffected.
The right of use under a Plan or an Event Licence is not transferable to third parties, except with the consent of Calendarlink given In Writing.

Article 8 – Scope of the service

The Platform enables the Customer to create Events, to generate Event Pages and links by which Participants add an Event to their calendar, to share Calendar Subscriptions, to collect RSVPs and to analyse their use, all with the functionalities that belong to the chosen Plan.
The Customer determines the content of Events, Event Pages and RSVP forms and is responsible for their accuracy and completeness, including the stated date, time, location and participation details.
Adding an Event to the calendar of a Participant or Subscriber, its display and the reminders generated by that calendar are carried out by the calendar service of the Participant or Subscriber. Calendarlink endeavours to provide the data required for this correctly and in a timely manner. Calendarlink has no influence on the operation, settings and availability of External Services and does not guarantee them.
A change or cancellation of an Event is offered by Calendarlink to the calendars in which the Event has been included. Whether and when that change is processed therein depends on the relevant External Service.
Calendarlink endeavours to display an Event in the time zone of the Participant and, where available, in the language of their browser.
Calendarlink does not guarantee any particular reach, number of Participants, attendance or other commercial result. Statements to that effect on the website or in other materials of Calendarlink are indicative and do not bind Calendarlink.

Article 9 – Participants, subscribers and RSVP

Participants and Subscribers are not parties to the Agreement. The Customer determines with whom it shares a link, an Event Page or a Calendar Subscription and in what manner.
The Customer warrants that it approaches Participants and Subscribers only in a manner permitted under applicable laws and regulations, including the rules on unsolicited electronic communications, and that it has obtained the consent required for that purpose.
The Customer determines which data it requests by means of RSVP and sets up the fields intended for that purpose itself. The Customer requests only data that is necessary for the purpose of the Event and refrains from requesting special categories of personal data and personal data relating to criminal convictions and offences.
The Customer informs Participants and Subscribers about the processing of their personal data and has a legal basis for that processing. Calendarlink processes that personal data as a processor in accordance with the Data Processing Agreement.
Calendarlink may send messages to Participants and Subscribers insofar as necessary for the performance of the Agreement, including confirmations and notifications of a change or cancellation of an Event.
Calendarlink has the right to make an Event, an Event Page or a Calendar Subscription inaccessible if it has well-founded reason to believe that its content is unlawful or in breach of Article 14. Calendarlink informs the Customer thereof as soon as possible.

Article 10 – Branding and white label

The Customer may provide Event Pages, invitations and messages with its own logo, colours and texts and may, insofar as the chosen Plan provides for this, switch off the mention of Calendarlink thereon.
The Customer grants Calendarlink a non-exclusive right to use the trademarks, logos and other materials supplied by it, solely insofar as necessary to display them on Event Pages, in invitations and in messages.
The Customer warrants that it is entitled to grant this right of use and that the materials supplied do not infringe the rights of third parties.
Switching off the mention of Calendarlink leaves the Intellectual Property Rights of Calendarlink unaffected and does not entitle the Customer to offer the Platform to third parties as its own service, except for arrangements In Writing as referred to in Article 7(5).
If Calendarlink offers the option of using a custom web address, the Customer is responsible for the management of that domain and for the necessary settings.
Calendarlink may change the design of Event Pages and the technical options for branding from time to time, with due observance of Article 15 and Article 27.

Article 11 – Analytics, tracking and conversion measurement

Depending on the Plan, Calendarlink makes analytics functionality available by which the Customer gains insight into, among other things, views, additions to calendars, origin of visitors, campaign parameters and RSVPs.
Insofar as the Plan provides for this, the Customer may run its own campaign parameters and third-party measurement tools on Event Pages, including conversion measurement by advertising platforms.
The Customer is responsible for the use of the measurement tools referred to in the previous paragraph. It has a legal basis, obtains the required consent for storing and reading information on the devices of Participants and informs Participants thereof.
Insofar as Calendarlink and the Customer jointly determine the purpose and means of a processing operation, the arrangement included in the Data Processing Agreement applies.
Calendarlink also processes data on the use of the Platform for security, combating misuse, invoicing, support, statistics and improvement of the Platform. Calendarlink is an independent controller for those processing operations.
Calendarlink may use usage data in aggregated form that cannot be traced to individuals for product development, reporting and comparative analyses.
The accuracy and completeness of measurement results depend on the settings of Participants, on External Services and on blocking software. Calendarlink does not guarantee the completeness of measurement data.

Article 12 – AI features, predictions and data enrichment

Calendarlink may offer functionality that, using automated techniques and artificial intelligence, makes suggestions, generates texts, supplements data or makes predictions regarding Events, Participants and Subscribers.
Calendarlink may use External Services to provide this functionality. The Data Processing Agreement applies to the processing of Personal Data in that context.
The outcomes of this functionality are indicative and may be inaccurate or incomplete. The Customer assesses the outcomes before using them and remains responsible for the content it publishes or sends.
Calendarlink does not use Customer Data to train general-purpose models of third parties and stipulates with its suppliers that the input provided to them is not used for that purpose.
Enrichment of data and predictions regarding Participants and Subscribers take place only on the instruction of the Customer. The Customer establishes whether there is a legal basis for this, informs the data subjects and refrains from any use whereby decisions with legal effects or similarly significant effects for the data subject are taken based solely on automated processing.
Calendarlink may change, restrict or discontinue this functionality. Article 15 and Article 27 apply mutatis mutandis.

Article 13 – Integrations, API and reasonable use

Calendarlink may offer connections with External Services and, insofar as the Plan provides for this, makes available an application programming interface by which the Customer creates, modifies and reads Events by automated means.
The use of an External Service is established between the Customer and its provider and is subject to the terms and conditions of that provider. Calendarlink is not a party to that relationship and does not guarantee the availability, operation and continuity of External Services.
The Customer is responsible for managing keys, tokens and other means of access to the interface and treats them as login details as referred to in Article 5.
Calendarlink may set reasonable technical limits on the use of the Platform and of the interface, including limits on the number of requests, the volume of data traffic and the frequency of automated actions.
If the use by the Customer exceeds those limits or endangers the stability or security of the Platform, Calendarlink may restrict or suspend that use and consults with the Customer on appropriate use.
Calendarlink may change or discontinue a connection or the interface if the External Service concerned changes or ceases to exist, or if technical or security reasons give cause to do so.

Article 14 – Rules of use

The Customer uses the Platform in accordance with the Agreement and with applicable laws and regulations, and ensures that its Team Members do the same.
The Customer does not use the Platform to offer or distribute material that is unlawful, infringes the rights of third parties, is misleading or violates the privacy of third parties.
The Customer refrains from actions that hinder other users of the Platform or that cause damage to systems or networks of Calendarlink or of its suppliers. If actions of the Customer cause hindrance, damage or danger to the functioning of those systems or networks, Calendarlink is entitled to take the measures it reasonably deems necessary to avert or prevent that danger.
If a third party notifies Calendarlink that material is being stored or distributed by or on behalf of the Customer which, according to that third party, infringes its rights or is otherwise unlawful, Calendarlink informs the Customer of that notification. The Customer then provides a reasoned response In Writing as soon as possible, but no later than within forty-eight (48) hours, after which Calendarlink decides which measures it takes. In cases that Calendarlink considers urgent, it may intervene immediately and informs the Customer thereof afterwards as soon as possible.
The Customer warrants that it, its Team Members and the Participants and Subscribers approached by it are not subject to sanctions or trade restrictions that preclude the use of the Platform, and that it does not use the Platform in breach of applicable sanctions and export regulations.
Calendarlink may set the Customer a reasonable period to remedy a breach of this article. If no remedy follows within that period, Calendarlink may restrict or suspend access in accordance with Article 5(6), without prejudice to its other rights.

Article 15 – Maintenance

Calendarlink has the right to temporarily take the Platform out of service for maintenance. Calendarlink endeavours to have such downtime take place outside Office Hours as much as possible and to inform the Customer thereof in good time in advance.
If Calendarlink considers downtime necessary for the secure operation of the Platform, it is entitled to take the Platform out of service immediately and without prior notice, so that it can take appropriate measures as soon as possible.
Calendarlink is not obliged to pay any compensation on account of downtime as referred to in this article.
Calendarlink has the right to modify the Platform from time to time, among other things to improve functionality, fix errors or discontinue parts of it. If a modification leads to a substantial reduction in functionality, Calendarlink informs the Customer thereof in advance In Writing or via the Platform.
Because the Platform is provided to multiple customers, a modification cannot be omitted solely with respect to the Customer. If a modification results in the loss of a functionality that is essential to the Customer, the Customer may terminate the Agreement In Writing with effect from the moment the modification takes effect, provided that it has notified Calendarlink thereof in advance In Writing.

Article 16 – Availability of the Platform

Calendarlink endeavours to keep the Platform available seven days a week, twenty-four hours a day.
In the event of an interruption of availability, Calendarlink endeavours to inform the Customer of its nature and expected duration.
The availability of the Platform also depends on External Services, on the internet connection and on the equipment of the Customer, of Participants and of Subscribers. Calendarlink is not responsible for such interruption.
Maintenance as referred to in Article 15 and a restriction or suspension that Calendarlink is entitled to impose under the Agreement do not count as unavailability.
Calendarlink endeavours to make backups of Customer Data regularly. The Customer remains responsible for keeping its own copy of the data essential to it.
A commitment to a specific availability percentage applies only if the Parties have agreed on it In Writing.

Article 17 – Support and complaints

Calendarlink provides support for the use of the Platform via the channels designated by it, to the extent that belongs to the chosen Plan.
Calendarlink endeavours to handle support requests adequately and within a reasonable period. A response or resolution time applies only if the Parties have agreed on it In Writing.
Support relates to the use of the Platform. Calendarlink performs work in the environment of the Customer or in an External Service only if so agreed and against the fee agreed for that purpose.
Calendarlink may set reasonable limits on the use of the forms of support offered and may determine and change their availability and channels from time to time.
When reporting an issue, the Customer provides the information that Calendarlink needs to assess and reproduce that report.
If the Customer is dissatisfied with the services, it reports this as soon as possible, but no later than thirty (30) days after it discovered or should reasonably have discovered the cause, via the channel designated by Calendarlink for that purpose, stating such substantiation that Calendarlink can deal with the complaint.
Calendarlink responds substantively to the complaint as soon as possible, but no later than fourteen (14) days after receipt. The Parties endeavour to reach a solution together.
Filing a complaint does not suspend the payment obligations of the Customer and leaves Article 23(5) and Article 23(6) unaffected.

Article 18 – Fees

The fee payable for a Plan and for an Event Licence is stated in the Offer or on the Platform. No fee is payable for the Free Plan.
All prices quoted by Calendarlink are in euros, unless expressly stated otherwise, and are exclusive of VAT and other government levies.
If the Customer is established outside the Netherlands, VAT is charged, reverse-charged or omitted in accordance with the applicable regulations. The Customer provides the required details for this purpose, including a valid VAT identification number, and warrants their accuracy.
All prices are subject to programming and typing errors. If a price is based on data provided by the Customer and that data proves to be inaccurate, Calendarlink has the right to adjust the price accordingly, even after the Agreement has been concluded.
Calendarlink is entitled to index its rates once a year in accordance with the most appropriate price index of Statistics Netherlands (CBS), provided that it informs the Customer In Writing or via the Platform at least one (1) month before the indexation takes effect. Calendarlink is also entitled to change its rates in the interim if the rates of its suppliers reasonably give cause to do so, as well as at each renewal of a Plan, in each case subject to a notice period of at least two (2) months.
If Calendarlink changes its rates other than on the basis of indexation or a statutory obligation, the Customer may cancel the Plan In Writing or via the Account with effect from the date on which the change takes effect.

Article 19 – Invoicing, payment and refunds

The fee for a Plan is charged before the start date and before each renewal. Usage-based fees are charged monthly in arrears. Calendarlink has the right to invoice electronically.
Payment is made through the payment service offered by Calendarlink, whereby the Customer registers a payment method and authorises Calendarlink to debit the amounts due on or after the due date. If invoicing takes place in another manner, a payment term of fourteen (14) days from the invoice date applies.
If a payment fails, Calendarlink may retry the payment for sixty (60) days. If payment is not made, Calendarlink may suspend access to the paid functionality, terminate the Plan or revert the Account to the Free Plan, without prejudice to the amounts outstanding remaining due.
An objection to the amount of an invoice does not suspend the payment obligation. In that case the Parties consult with each other. The Customer is not entitled to suspend any payment obligation or to set it off against a claim against Calendarlink, on any grounds whatsoever.
In the event of late payment, the Customer is in default by operation of law, without any notice of default being required. From the due date, Calendarlink is entitled to charge the statutory commercial interest referred to in Article 6:119a of the Dutch Civil Code, as well as all judicial and extrajudicial costs associated with collection.
Calendarlink is entitled to suspend performance of the Agreement if the Customer fails to pay an invoice on time, or if the financial position of the Customer deteriorates in a way that gives good reason to doubt its ability to pay. During the suspension, the periodic fees remain due.
Fees already paid are not refunded, not even in the event of early termination or a downgrade to a Plan with fewer functionalities. By way of derogation, Calendarlink refunds a fee paid if the Customer requests this within fourteen (14) days of payment and the relevant Event has not yet taken place at that time.

Article 20 – Intellectual Property Rights

All Intellectual Property Rights in the Platform, the documentation and the other materials supplied by Calendarlink are vested exclusively in Calendarlink or its licensors. The Customer obtains only the limited, non-transferable right of use described in the Agreement, for the duration of the Plan or of the Event Licence.
The Customer does not reproduce the Platform, does not modify it and does not subject it to reverse engineering, except insofar as mandatory law permits this.
All Customer Data remains the property of the Customer or of its licensors. Calendarlink does not assert any ownership claims to it.
The Customer grants Calendarlink a limited right of use with respect to Customer Data, solely insofar as reasonably necessary for the performance of the Agreement, including displaying, sending and making available Events to Participants and Subscribers. Article 11(6) continues to apply in full.
If the Customer makes suggestions for improving the Platform, Calendarlink is entitled to use them freely without owing any fee.
The Customer warrants that the Customer Data and the materials supplied by it do not infringe the rights of third parties. Article 24 applies.

Article 21 – Confidentiality

The Parties treat all Confidential Information they receive from each other as confidential and do not disclose it to third parties, except insofar as disclosure is necessary for the performance of the Agreement, results from a statutory obligation or a court order, or is made to advisers bound by confidentiality.
The Parties impose the obligation set out in this article on their employees and on the third parties engaged by them who have access to Confidential Information.
The obligation of confidentiality does not apply to information that was already public or becomes public without breach of this article, that the receiving Party has obtained lawfully and without a duty of confidentiality from a third party, or that it has developed independently without using the Confidential Information of the other Party.
If a Party is required by a statutory obligation or a court order to disclose Confidential Information, it informs the other Party thereof in advance, unless prohibited from doing so, and limits the disclosure to what is necessary.
In the event of a breach of this article, the Customer forfeits, by way of derogation from Article 6:92 of the Dutch Civil Code, an immediately payable penalty of EUR 2,500 per breach, increased by EUR 250 for each day the breach continues, up to a maximum of EUR 25,000 per breach, without prejudice to the right to performance, to cessation of the breach and to full compensation insofar as the damage exceeds the penalty, and without prejudice to the power of the court to mitigate. The penalty arrangement in this paragraph applies only in the event of a breach by the Customer and only for the benefit of Calendarlink. Calendarlink does not forfeit any penalty under this paragraph.
The obligations under this article remain in force for six (6) months after the end of the Agreement. For Confidential Information that is by its nature permanently confidential, including the non-public functionality and security of the Platform and pricing arrangements, these obligations remain in force for three (3) years after the end of the Agreement. Annex 1 applies to the processing of Personal Data.

Article 22 – Processing of personal data

Personal Data is processed in the performance of the Agreement. For that purpose, the Parties have entered into the Data Processing Agreement, which forms an integral part of the General Terms and Conditions as Annex 1 and which was accepted by the Customer upon the formation of the Agreement.
The Customer is the controller of the Personal Data it processes by means of the Platform, including the data of Team Members, Participants and Subscribers. The Customer establishes the legal basis for that processing and complies with the information obligations incumbent on it.
Calendarlink is an independent controller for the processing operations referred to in Article 11(5), in accordance with Article 7 of Annex 1. The privacy statement of Calendarlink applies to those processing operations.
Calendarlink processes Personal Data within the European Economic Area, except in the cases referred to in the Data Processing Agreement in which processing takes place outside the European Economic Area subject to appropriate safeguards.
Calendarlink engages sub-processors in accordance with the Data Processing Agreement. The current list of sub-processors is available via the Platform.
If, in the opinion of Calendarlink, an instruction of the Customer infringes applicable data protection laws and regulations, Calendarlink informs the Customer thereof without delay and may suspend execution of that instruction.

Article 23 – Liability

The liability of Calendarlink for an attributable failure in the performance of its obligations, in tort or on any other ground, is limited per event, whereby a series of related events counts as one event, to the amount the Customer owed to Calendarlink over the period of three (3) months preceding the event giving rise to the damage, exclusive of VAT. The total liability per calendar year never exceeds the fee payable over that calendar year.
The liability of Calendarlink is excluded for damage related to the use of the Free Plan or to use during the Trial Period.
Calendarlink is not liable for indirect damage, including lost revenue, missed attendance at an Event, missed opportunities, reputational damage, loss of data and damage resulting from an Event, a change thereto or a reminder not being displayed, not being displayed on time or being displayed incorrectly in the calendar of a Participant or Subscriber.
The limitations in this article also apply to warranties given by Calendarlink and to claims under the Data Processing Agreement, and lapse if and insofar as the damage results from intent or deliberate recklessness on the part of the management of Calendarlink.
Liability of Calendarlink arises only if the Customer gives it prompt and proper notice of default In Writing, setting a reasonable period to remedy the failure, and Calendarlink remains in attributable breach after that period. The notice of default contains as detailed a description of the failure as possible.
Any claim for damages by the Customer lapses by the mere expiry of twelve (12) months after the claim arose.
The limitations and exclusions in this article are also stipulated for the benefit of the directors of Calendarlink, its employees and the third parties engaged by it in the performance of the Agreement, who may invoke them directly.

Article 24 – Indemnification and accuracy of information

The Customer is responsible for the accuracy, reliability and completeness of all data, information and materials it provides to Calendarlink or processes by means of the Platform, including insofar as it has obtained them from third parties.
The Customer indemnifies Calendarlink against claims of third parties, including Participants, Subscribers, Team Members, clients of the Customer and supervisory authorities, relating to the Customer Data, the content of an Event or an Event Page, the manner in which the Customer has approached Participants and Subscribers, the use of measurement tools as referred to in Article 11 and of functionality as referred to in Article 12, or conduct of the Customer in breach of the Agreement.
The indemnity also covers claims based on an infringement of Intellectual Property Rights of third parties by the data and materials supplied by the Customer.
If the Customer provides files, software or data carriers to Calendarlink, it warrants that they are free of viruses and other harmful components.
The Customer provides Calendarlink upon first request with all cooperation in conducting a defence against a claim as referred to in this article. Calendarlink is entitled to conduct that defence itself, with the reasonable costs involved being borne by the Customer.

Article 25 – Force majeure

Neither Party can be held to perform any obligation if a circumstance beyond its control, which could not reasonably have been foreseen at the time the Agreement was concluded, eliminates every reasonable possibility of performance.
Force majeure also includes a failure in public infrastructure or in an External Service on which delivery depends and over which Calendarlink cannot exercise actual control, a failure due to malicious software, network attacks or attempts to circumvent security, a failure of a supplier that Calendarlink could not foresee and for which it cannot hold that supplier liable, domestic unrest, mobilisation, war, terrorism, pandemics, strikes, fire and floods, defects in goods or services whose use the Customer has prescribed, as well as prolonged unavailability of employees or third parties engaged by Calendarlink due to illness.
During a force majeure situation, the obligations of the Parties are suspended. Payment obligations relating to performance already rendered remain in full force.
If a force majeure situation lasts longer than sixty (60) days, each Party has the right to rescind the Agreement, without this giving rise to an obligation to pay compensation or to undo performance.

Article 26 – Promotion

During the term and after the end of the Agreement, Calendarlink is entitled to describe the services provided to the Customer for promotional purposes in the materials and channels it uses, whereby the trade name and the figurative mark and word mark of the Customer may be used by way of illustration.
If the Customer objects to the manner in which Calendarlink exercises this right, it may make this known In Writing. Calendarlink considers that objection in all reasonableness and makes adjustments where appropriate.
Calendarlink is entitled to display a reference to its services on Event Pages and in messages sent by it, except insofar as the chosen Plan gives the Customer the option of switching off that mention and the Customer has made use of that option.

Article 27 – Amendment of the Agreement

If the Customer wishes to amend the Agreement, it may submit a request to Calendarlink. Such an amendment applies only if Calendarlink has expressly accepted it In Writing.
Calendarlink is entitled to amend and supplement the General Terms and Conditions, including Annex 1, also with respect to existing Agreements.
Calendarlink notifies the Customer of an amendment via the Platform or by e-mail at least thirty (30) days before it takes effect.
Amendments of minor importance, amendments required by law and amendments in favour of the Customer may be implemented at any time with immediate effect and do not require prior notice.
If an amendment is not a case as referred to in the previous paragraph and the Customer does not accept that amendment, it may cancel the Plan In Writing or via the Account with effect from the date on which the amendment takes effect. Continued use of the Platform after that date constitutes acceptance of the amendment.
An amendment of Annex 1 that is necessary as a result of laws or regulations or of an instruction from a supervisory authority is implemented with due observance of the arrangement included in Annex 1 for that purpose.

Article 28 – Term and termination of the Agreement

The Agreement commences at the moment of registration and is entered into for an indefinite period. The term of a Plan and of an Event Licence is determined by Article 7.
The Customer may cancel a Plan or revert to the Free Plan via the Account with due observance of Article 7(2). The Customer may end use of the Free Plan at any time by deleting the Account.
Cancellation or termination does not release the Customer from the obligation to pay fees already due, nor does it give rise to an obligation to refund fees already paid. Article 19(7) continues to apply.
Calendarlink is entitled to rescind the Agreement in whole or in part if the Customer attributably fails to perform an essential obligation under the Agreement and that failure has not been remedied within a reasonable period set in a notice of default In Writing.
Calendarlink is entitled to suspend, rescind or terminate the Agreement without any notice of default being required if the Customer is declared bankrupt or has filed for its own bankruptcy, the Customer is granted a suspension of payments, the business of the Customer is dissolved or liquidated, or an attachment has been levied on part of its assets.
Calendarlink may terminate the Agreement or the relevant Plan In Writing subject to a reasonable notice period of at least three (3) months, among other things if Calendarlink discontinues the relevant Plan or ceases the Platform entirely. If the circumstances require a longer reasonable notice period, Calendarlink observes that longer period.
After the end of the Agreement, Calendarlink ends access to the Platform. Events, Event Pages, links and Calendar Subscriptions thereby lapse and are no longer accessible to Participants and Subscribers. The Customer ensures that it informs Participants and Subscribers thereof in good time.
The Customer may request a copy of the Customer Data for thirty (30) days after the end of the Agreement, insofar as the Platform provides for this. After that period, Calendarlink is entitled to delete the Customer Data, with due observance of Annex 1.
If, at the time of rescission, the Parties have already rendered or received performance, that performance and the related payment obligations are not subject to reversal of performance. Article 6:271 et seq. of the Dutch Civil Code do not apply.

Article 29 – Final provisions

Calendarlink is entitled to transfer the Agreement in whole or in part to a company belonging to its group as referred to in Article 2:24b of the Dutch Civil Code, or to a third party that takes over the relevant business activities of Calendarlink, without any further consent or cooperation of the Customer being required. The Customer may transfer its rights and obligations under the Agreement only with the consent of Calendarlink given In Writing.
The version of communications, measurements and other data received or stored by Calendarlink is deemed to be correct, subject to proof to the contrary by the Customer.
Notices to the Customer are given via the Platform or to the e-mail address provided with the Account. The Customer ensures that its contact details are up to date.
Provisions that by their nature are intended to survive the end of the Agreement, including Articles 20, 21, 23, 24 and 29, remain in full force after its end. For the obligations under Article 21, only the periods set out in Article 21(6) apply, without prejudice to the applicability of Annex 1 to the processing of Personal Data.
The Agreement contains the entire agreement between the Parties with respect to its subject matter and supersedes all prior oral and written statements, offers and arrangements in that regard.
Failure to exercise or delay in exercising a right under the Agreement does not constitute a waiver of that right and does not preclude its later exercise.
If any provision of the Agreement is null and void or voidable or otherwise wholly or partly invalid, the remaining provisions remain in full force. Calendarlink replaces the invalid provision with a valid provision whose purport corresponds as closely as possible to that of the invalid provision.

Article 30 – Applicable law and competent court

The Agreement and all legal relationships arising from or related to it are governed by Dutch law. The applicability of the United Nations Convention on Contracts for the International Sale of Goods is excluded.
All disputes arising from or related to the Agreement are submitted exclusively to the competent court in the district where Calendarlink is established, with due observance of the applicable rules on subject-matter and territorial jurisdiction and the internal allocation of cases, unless mandatory law provides otherwise.

Annex 1 – Data Processing Agreement

Version October 20, 2026

Parties:

TrendLink B.V., trading under the name Calendarlink, established at Kromweistraat 8, 5066 BK Moergestel, hereinafter referred to as Processor;

and

the Customer, being the natural person or legal entity that has registered on the Platform and has thereby accepted the General Terms and Conditions of which this Data Processing Agreement forms part as Annex 1, acting in the course of a profession or business and represented by an authorised person, hereinafter referred to as Controller;

Processor and Controller hereinafter also jointly referred to as: Parties.

Whereas:

A. Processor makes available to Controller an online platform by which Controller creates, shares, automates and analyses calendar links, invitations, Event Pages, RSVP forms and subscribable calendars, all as further described in the General Terms and Conditions;

B. Controller determines which Personal Data is processed by means of the Platform, including the data left by Participants and Subscribers and the data it requests through fields it has set up itself, and thereby determines the purpose and means of that processing;

C. Processor is willing to carry out the processing and to comply with the obligations regarding security and other aspects of the General Data Protection Regulation, insofar as this is within its power;

D. Processor does not process the Personal Data for its own purposes, except for the processing operations designated in this Data Processing Agreement for which Processor is an independent controller;

E. Controller can be regarded as a controller within the meaning of Article 4(7) of the General Data Protection Regulation and Processor as a processor within the meaning of Article 4(8) of that Regulation;

F. where this Data Processing Agreement refers to Personal Data, this means personal data within the meaning of Article 4(1) of the General Data Protection Regulation;

G. the Parties, having regard also to the requirement of Article 28(3) of the General Data Protection Regulation, wish to record their rights and obligations in writing by means of this Data Processing Agreement, which Controller accepts by agreeing to the General Terms and Conditions upon registration on the Platform.

The Parties agree as follows:

Article 1 – Purpose of the processing

Processor processes Personal Data solely on behalf of and on the documented instructions of Controller, in the context of the performance of the Agreement and of this Data Processing Agreement.
The purpose of the processing is to make the Platform available and operational, including creating, sharing and modifying Events, displaying Event Pages, offering Events to calendars of Participants and Subscribers, sending related messages, collecting and making available RSVPs, managing Calendar Subscriptions and showing Controller analyses of their use.
The categories of data subjects are Team Members of Controller, Participants, Subscribers and other persons whose Personal Data Controller processes by means of the Platform.
The categories of Personal Data are name and contact details, account details, the data requested by Controller by means of RSVP, data on participation in and interaction with an Event or Event Page, technical data such as timestamps, device and browser data, as well as the other data that Controller enters or has entered in the Platform.
The processing takes place by automated means and, insofar as necessary for support or recovery, manually.
Processor is prohibited from processing the Personal Data for any purpose other than that determined by Controller, except for the independent processing operations described in Article 7 of this Data Processing Agreement.
The Personal Data processed on behalf of Controller remains vested in Controller or in the relevant data subjects.

Article 2 – Term of the agreement

This Data Processing Agreement commences at the moment Controller accepts the General Terms and Conditions upon registration and continues for as long as the Agreement continues.
This Data Processing Agreement cannot be terminated separately and ends by operation of law at the moment the Agreement ends.
Processor is entitled to amend this Data Processing Agreement if laws or regulations, case law or an instruction from a supervisory authority give cause to do so, with due observance of Article 27 of the General Terms and Conditions.
Obligations that by their nature are intended to survive, including the obligations regarding confidentiality, liability and deletion of Personal Data, remain in force after the end of this Data Processing Agreement.
Article 18 of this Data Processing Agreement applies to the settlement after the end of this Data Processing Agreement.

Article 3 – Obligations of Processor

Processor processes the Personal Data solely on the basis of the instructions of Controller. Such instructions comprise this Data Processing Agreement, the Agreement and the choices and settings that Controller makes within the Platform.
In processing, Processor complies with the requirements imposed under applicable laws and regulations, in particular the General Data Protection Regulation and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming).
Processor keeps a record of all categories of processing activities it carries out on behalf of Controller, in accordance with Article 30(2) of the General Data Protection Regulation.
Processor informs Controller upon its first request of the measures it has taken in implementation of this Data Processing Agreement.
Processor is not permitted to enrich its own files or databases with Personal Data of Controller, except for temporary files necessary for proper processing. Those temporary files are deleted as soon as they are no longer needed for the processing.
The obligations arising for Processor from this Data Processing Agreement also apply to the persons who process Personal Data under its authority, including employees and third parties engaged by it.
If Processor considers that an instruction of Controller infringes applicable data protection laws and regulations, it informs Controller thereof without delay and may suspend execution of that instruction.

Article 4 – Obligations of Controller

Controller warrants that the processing of Personal Data by means of the Platform is lawful, that there is a legal basis for it and that the data subjects have been informed in accordance with Articles 13 and 14 of the General Data Protection Regulation.
Controller determines which Personal Data is processed by means of the Platform and which settings and retention periods it chooses, insofar as the Platform provides for this.
The instructions of Controller remain within the functionality offered by the Platform. Processor executes an instruction outside that scope only if the Parties have agreed on it In Writing and against the fee agreed for that purpose.
Controller ensures appropriate security on its side, including the management of Accounts, login details and authorisations of Team Members.
Controller itself assesses whether a data protection impact assessment as referred to in Article 35 of the General Data Protection Regulation is required for the processing operations it intends.
If Controller acts in breach of this article, this is at its own expense and risk. Article 20 of this Data Processing Agreement applies.

Article 5 – Fields set up by Controller and special categories of personal data

Controller itself determines which fields it includes in Events, Event Pages and RSVP forms and which data it requests through them. Processor has no influence on this and does not assess the content of those fields.
Controller does not request through the Platform any personal data as referred to in Article 9 of the General Data Protection Regulation or any personal data relating to criminal convictions and offences as referred to in Article 10 of that Regulation, unless the Parties have agreed otherwise In Writing and additional safeguards have been put in place for that purpose.
Controller includes in free text fields only data that is necessary for the purpose of the relevant Event.
Controller does not request personal data of children below the age at which the consent of a parent or guardian is required under applicable law, unless it has that consent and can demonstrate this upon request.
The Platform and the security measures described in Article 10 of this Data Processing Agreement are not designed for the processing of the data referred to in paragraph 2. Controller assesses whether those measures are appropriate for the data it processes by means of the Platform.
If Controller nevertheless processes the data referred to in paragraph 2 or paragraph 4 contrary to this article, this is at its own expense and risk and it indemnifies Processor in accordance with Article 20 of this Data Processing Agreement. In that case, Processor is entitled to restrict the relevant functionality after becoming aware thereof.

Article 6 – Transfer of personal data

Processor processes the Personal Data within the European Economic Area, subject to the provisions of this article.
Processor is entitled to process or have processed Personal Data in a country outside the European Economic Area, insofar as necessary for providing a functionality of the Platform and provided that Chapter V of the General Data Protection Regulation is complied with, including by means of an adequacy decision or standard contractual clauses adopted by the European Commission, supplemented where necessary by appropriate supplementary measures.
The sub-processors that process Personal Data outside the European Economic Area and the safeguards applicable to them are stated in the list referred to in Article 8 of this Data Processing Agreement.
In the case of a transfer based on standard contractual clauses, Processor assesses whether the level of protection in the third country concerned precludes compliance with those clauses and takes supplementary measures where necessary. Processor provides Controller upon request with information about that assessment.
If Controller instructs Processor to make a transfer that goes beyond what is provided in this article, that transfer takes place at the expense and risk of Controller.

Article 7 – Responsibility of Processor and independent processing

Processor is responsible for the processing of the Personal Data under this Data Processing Agreement, in accordance with the instructions of Controller. Processor is not responsible for other processing of Personal Data, including the collection of Personal Data by Controller, processing for purposes not notified to Processor and processing by third parties.
Processor is an independent controller for the processing of account and contact details, for invoicing and accounts receivable management, for providing support, for security and combating misuse, for troubleshooting and recovery, for statistics and improvement of the Platform and for compliance with the statutory obligations incumbent on it. The privacy statement of Processor applies to those processing operations.
Processor is entitled to use data on the use of the Platform in aggregated form that cannot be traced to individuals, in accordance with Article 11(6) of the General Terms and Conditions. Processor ensures that such data cannot be traced to an individual data subject.
Controller independently determines the purpose and means of the processing carried out with the measurement tools it deploys on Event Pages. Processor provides only the technical facility for this and in that context processes Personal Data solely on behalf of and in accordance with the instructions of Controller given In Writing. This allocation of roles applies insofar as it corresponds to the actual set-up and performance of the processing.
Processor does not process the Personal Data for its own commercial purposes and does not approach Participants and Subscribers for its own services.

Article 8 – Third parties and sub-processors

Controller grants Processor general written authorisation as referred to in Article 28(2) of the General Data Protection Regulation to engage sub-processors in the performance of the Agreement.
Processor imposes on each sub-processor by contract obligations that are at least equivalent to the obligations under this Data Processing Agreement and remains liable to Controller for their performance by the sub-processor.
Processor maintains a current list of sub-processors stating the name, role, processing region and the categories of Personal Data to which the sub-processor has access. That list is available via the Platform.
Processor is entitled to engage ancillary services that have no access to Personal Data. Such services do not count as sub-processors and are not included in the list.
Upon request of Controller, Processor provides the provisions relevant to the assessment from the agreement concluded with a sub-processor, whereby it may redact commercially confidential information.

Article 9 – Changes of sub-processors

If Processor engages a new sub-processor that processes Personal Data, it notifies Controller thereof at least thirty (30) days before that processing starts, by updating the list referred to in Article 8 and by sending a message to the e-mail address provided with the Account.
In the case of replacement of an existing sub-processor by a sub-processor with the same role in the same processing region, without a new data flow arising as a result, that period is at least seven (7) days.
Controller may object within the period referred to in paragraph 1 or paragraph 2 on grounds relating to the protection of personal data. In that case, the Parties consult with each other in order to reach a solution.
If the Parties do not reach a solution, Controller may terminate the services affected by the change without any costs being charged for this. By way of derogation from Article 19(7) of the General Terms and Conditions, the fee paid in advance for the remaining period is in that case refunded pro rata.
If a change of sub-processor is necessary for reasons of security or continuity and the period referred to in paragraph 1 or paragraph 2 therefore cannot be awaited, Processor is entitled to implement the change immediately and to inform Controller thereof afterwards as soon as possible.
For self-service use, the following arrangement applies by way of derogation from paragraphs 1 to 4 of this article. Processor announces an intended addition or replacement of a sub-processor by updating the list referred to in Article 8 and by e-mail, at least thirty (30) days before its deployment. Controller may lodge a reasoned objection within that period on grounds relating to the protection of Personal Data. In the event of an objection, the Parties consult with each other on a solution. An objection does not suspend the deployment of the sub-processor. If the Parties do not reach a solution, Controller may cancel the relevant Plan via the Account or terminate the Agreement In Writing with effect no later than the date on which the sub-processor is deployed. An objection or a termination under this paragraph does not give rise to any right to a refund of fees paid in advance. Article 19(7) of the General Terms and Conditions continues to apply.

Article 10 – Security measures for Personal Data

Processor takes appropriate technical and organisational measures as referred to in Article 32 of the General Data Protection Regulation, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of data subjects.
Those measures include in any event encryption of data in transit and at rest, need-to-know access with personal authentication, logging of actions, separate development, test and production environments, periodic backups with a recovery procedure and periodic review and updating of the measures taken.
Processor uses data centres within the European Economic Area for the storage and processing of Personal Data, without prejudice to Article 6 of this Data Processing Agreement.
Processor obliges the persons who have access to Personal Data under its authority to observe confidentiality and ensures their awareness of the protection of personal data.
Processor is entitled to change the measures taken, provided that the level of security is not reduced as a result. It makes a current description of the measures available to Controller upon request.
Controller is responsible for the security measures on its side, in accordance with Article 4(4) of this Data Processing Agreement.

Article 11 – Personal data breaches

Processor notifies Controller without delay, and in any event within seventy-two (72) hours after becoming aware of it, of a personal data breach as referred to in Article 4(12) of the General Data Protection Regulation affecting the Personal Data processed under this Data Processing Agreement.
The notification contains, insofar as that information is available at that time, the nature of the breach, the categories and number of data subjects and records concerned, the likely consequences, the measures taken and proposed and the contact details of the person from whom further information can be obtained.
If that information is not fully available, Processor provides the missing information in phases without undue delay.
Controller assesses whether the breach must be notified to the supervisory authority and whether data subjects must be informed. Processor does not make that notification or communication on behalf of Controller, unless the Parties have agreed on this In Writing.
Processor takes without delay the measures that can reasonably be required of it to contain the breach, limit its consequences and prevent recurrence. It records breaches and the measures taken.
The costs of the cooperation provided by Processor are borne by it insofar as the breach is attributable to it. Otherwise, those costs are borne by Controller against the fee agreed for that purpose.

Article 12 – Audit and inspection

Upon request, Processor makes available to Controller the information necessary to demonstrate compliance with the obligations under Article 28 of the General Data Protection Regulation, including reports, certifications and statements of independent experts.
If Controller considers that information insufficient, it may have an audit carried out once every twelve (12) months by an independent expert who is bound by confidentiality and who does not carry out activities competing with Processor. Processor may refuse a proposed expert if that expert is a competitor of Processor or if concrete, objective circumstances mean that the engagement of that expert poses a real risk to the competitive position of Processor. Controller may then appoint another independent expert. The expert reports only established shortcomings in compliance with the Data Processing Agreement and with the data protection obligations applicable to Processor, with the necessary substantiation. These limitations are without prejudice to the obligation of Processor to make available the information necessary to demonstrate compliance with Article 28 of the General Data Protection Regulation.
Controller announces an audit at least thirty (30) days in advance. The audit takes place during Office Hours, does not unnecessarily disrupt the business operations of Processor and is limited to the processing operations under this Data Processing Agreement, taking into account the interests of other customers of Processor and its security interests.
The costs of an audit are borne by Controller, unless the audit reveals a material failure of Processor to comply with this Data Processing Agreement.
If an audit reveals a shortcoming, Processor takes within a reasonable period the measures necessary to comply with its obligations.
If a supervisory authority conducts an investigation relating to the processing operations under this Data Processing Agreement, the Parties cooperate with it. The limitation referred to in paragraph 2 does not apply in that case.

Article 13 – Confidentiality

Processor treats the Personal Data as confidential and does not disclose it to third parties, except to sub-processors in accordance with Article 8 of this Data Processing Agreement or if required by a statutory obligation or a court order.
The persons who have access to the Personal Data under the authority of Processor are bound by confidentiality on the basis of an employment contract, a contract for services, a separate declaration or a statutory obligation.
If Processor is required by a statutory obligation or a court order to disclose Personal Data, it informs Controller thereof in advance, unless prohibited from doing so, and limits the disclosure to what is necessary.
The obligation of confidentiality remains in full force after the end of this Data Processing Agreement.
Controller treats the information it receives under Article 10 and Article 12 of this Data Processing Agreement as confidential.

Article 14 – Rights of data subjects

Controller is responsible for handling requests from data subjects to exercise their rights as referred to in Articles 15 to 22 of the General Data Protection Regulation.
Processor provides reasonable assistance in this respect, taking into account the nature of the processing, by means of appropriate technical and organisational measures, including the functionality of the Platform by which Controller can itself access, correct, export and delete Personal Data.
If Processor receives a request directly from a data subject relating to Personal Data it processes for Controller, it refers the data subject to Controller and informs Controller thereof as soon as possible, without dealing with the substance of the request itself.
Processor corrects, deletes or restricts the processing of Personal Data on the instruction of Controller, insofar as the Platform provides for this.
Processor provides assistance beyond the functionality referred to in paragraph 2 against the fee agreed for that purpose.

Article 15 – Assistance with impact assessments and prior consultation

Processor provides Controller, taking into account the nature of the processing and the information available to it, with reasonable assistance in complying with the obligations under Articles 32 to 36 of the General Data Protection Regulation, including with a data protection impact assessment as referred to in Article 35 of the General Data Protection Regulation and with a prior consultation as referred to in Article 36 of that Regulation.
That assistance consists of providing information on the processing operations Processor carries out, the security measures taken, the sub-processors engaged and the processing regions.
Controller remains responsible for carrying out the assessment, for the considerations made in it and for its outcome.
Processor provides reasonable cooperation with a request for information or an investigation by a supervisory authority relating to the processing operations under this Data Processing Agreement.
Processor provides assistance beyond the provision of the standard available information against the fee agreed for that purpose.

Article 16 – AI features, predictions and data enrichment

If Controller uses functionality as referred to in Article 12 of the General Terms and Conditions in which Personal Data is processed, Processor processes that data solely on the instruction of Controller and within the purposes of Article 1 of this Data Processing Agreement.
Controller establishes the legal basis for that processing, assesses whether the processing is compatible with the purpose for which the data was collected and informs the data subjects about the enrichment of data and the use of predictions.
Processor engages sub-processors for this functionality. Those sub-processors are included, with their processing region, in the list referred to in Article 8 of this Data Processing Agreement.
Processor stipulates with the sub-processors referred to in the previous paragraph that the data provided to them is not used for training or improving general-purpose models, and does not itself use the Personal Data for that purpose either.
Controller does not use this functionality for decision-making based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects the data subject, unless Controller itself puts in place the safeguards required under Article 22 of the General Data Protection Regulation.
The outcomes of this functionality may be inaccurate or incomplete. Processor does not guarantee the accuracy of enriched or predicted data. Controller assesses those outcomes and ensures compliance with the principle of accuracy as referred to in Article 5(1)(d) of the General Data Protection Regulation.

Article 17 – Analytics and tracking technology on event pages

Processor enables Controller to deploy campaign parameters and third-party measurement tools on Event Pages, including conversion measurement by advertising platforms.
Controller determines whether and which measurement tools are deployed. It is responsible for obtaining the required consent for storing and reading information on the terminal equipment of visitors and for providing information to those visitors.
The provider of a measurement tool deployed by Controller also processes the data collected with it for its own purposes. That processing falls outside this Data Processing Agreement and is governed by the arrangements between Controller and that provider.
Insofar as the Platform provides for this, Processor provides the technical facility by which measurement tools are loaded only after consent has been obtained. Controller verifies whether that facility has been set up in accordance with its obligations.
Processor also processes data on Event Pages for the purposes of security, availability and combating automated misuse. It is an independent controller for that processing in accordance with Article 7(2) of this Data Processing Agreement.
Article 7(4) of this Data Processing Agreement applies to processing in which the Parties jointly determine the purpose and means.

Article 18 – Return and deletion of personal data

After the end of this Data Processing Agreement, Processor returns or deletes the Personal Data, at the choice of Controller.
Controller may export the Personal Data for thirty (30) days after the end of the Agreement in accordance with Article 28(8) of the General Terms and Conditions. If Controller does not make use of that option within that period, the choice for deletion is deemed to have been made.
Processor deletes the Personal Data within ninety (90) days after the end of the Agreement, including the copies held by sub-processors. Sub-processors may apply different technical deletion periods for deleting copies. Controller accepts those periods in advance, insofar as they are compatible with the applicable statutory obligations. Processor provides Controller upon request with an overview of those periods. During those periods, the copies remain segregated and inaccessible and are not used for any other purpose. Processor remains responsible for deletion by the sub-processors. Data contained in backups is deleted at the moment those backups are overwritten in accordance with the regular cycle. Until that moment, the obligations under this Data Processing Agreement continue to apply to that data.
If Processor is subject to a statutory obligation to retain certain data, that data is retained for the applicable period and Processor limits its processing to retention.
Processor is entitled to retain aggregated data that cannot be traced to individuals in accordance with Article 7(3) of this Data Processing Agreement.
Processor confirms the deletion In Writing to Controller upon request.

Article 19 – Liability

Article 23 of the General Terms and Conditions applies to the liability of the Parties under this Data Processing Agreement, except insofar as mandatory law precludes this.
An administrative fine or other sanction imposed on a Party by a supervisory authority is borne by that Party. An administrative fine imposed on Controller cannot be recovered from Processor, regardless of the legal basis for such recovery. Processor is not obliged to compensate Controller for that fine or to indemnify Controller against it. This provision binds only the Parties and leaves the powers of supervisory authorities unaffected.
This Data Processing Agreement does not limit the liability of the Parties towards data subjects under Article 82 of the General Data Protection Regulation. Recourse between the Parties is governed by that article, with due observance of paragraph 1 of this article.
Article 11(6) of this Data Processing Agreement applies to the costs of measures taken in response to a personal data breach.

Article 20 – Indemnification

Controller indemnifies Processor against claims of data subjects, other third parties and supervisory authorities arising from non-compliance by Controller with this Data Processing Agreement or with applicable data protection laws and regulations, including claims relating to the absence of a legal basis, failure to inform data subjects, the fields set up by Controller as referred to in Article 5, the use of functionality as referred to in Article 16 and the measurement tools deployed by Controller as referred to in Article 17.
Processor does not grant Controller any contractual indemnity against claims of data subjects, other third parties or supervisory authorities. This is without prejudice to liability arising directly from mandatory law.
The Party invoking an indemnity notifies the other Party of the claim without delay and provides it with all reasonable cooperation in conducting the defence. The indemnifying Party is entitled to conduct that defence itself.
Neither Party admits liability or settles a claim for which it invokes an indemnity without the prior consent In Writing of the indemnifying Party.

Article 21 – Final provisions

This Data Processing Agreement forms an integral part of the General Terms and Conditions as Annex 1 and has been accepted by Controller upon registration on the Platform. Capitalised terms in this Data Processing Agreement have the meaning given to them in Article 1 of the General Terms and Conditions, unless expressly provided otherwise herein.
Insofar as it concerns the processing of Personal Data, this Data Processing Agreement prevails over the other parts of the Agreement, in accordance with Article 2(5) of the General Terms and Conditions.
Deviations from this Data Processing Agreement apply only if the Parties have agreed on them In Writing.
If a provision of this Data Processing Agreement is null and void or voidable or otherwise wholly or partly invalid, the remaining provisions remain in full force and the Parties replace the invalid provision with a valid provision whose purport corresponds as closely as possible to that of the invalid provision.
Article 29(1) of the General Terms and Conditions applies to the transfer of rights and obligations under this Data Processing Agreement. Notices under this Data Processing Agreement are given via the Platform or to the e-mail address provided with the Account. Processor can be contacted with questions about the processing of Personal Data via security@calendarlink.com.
If this Data Processing Agreement is made available in several languages, the Dutch text prevails in the event of any discrepancy between the language versions.

Article 22 – Dispute resolution and applicable law

This Data Processing Agreement is governed by Dutch law, without prejudice to the direct effect of the General Data Protection Regulation.
All disputes arising from or related to this Data Processing Agreement are submitted exclusively to the competent court in the district where Processor is established, with due observance of the applicable rules on subject-matter and territorial jurisdiction and the internal allocation of cases, unless mandatory law provides otherwise.