Data Processing Agreement

1. Parties

Data Controller (Verwerkingsverantwoordelijke): The Professional User who submits client data to WealthPlannr for processing (the “Controller”).

Data Processor (Verwerker): WealthPlannr B.V., registered in Amsterdam, the Netherlands (the “Processor”).

2. Scope & Purpose (Onderwerp en Duur)

WealthPlannr processes data solely to facilitate Box 3 tax simulations, portfolio analysis, and the generation of OWR (Tegenbewijs) evidence reports on behalf of the Controller's clients.

Duration: The processing continues for the length of the Professional User's subscription. Upon termination, all client data is deleted within 30 days unless a legal retention period (e.g., fiscal audit logs under Dutch tax law) applies.

3. Types of Data & Data Subjects

Data Subjects: The clients of the Professional User (taxpayers / belastingplichtigen).

4. AI Processing & Transparency (EU AI Act 2026)

4.1 Instruction-Based Processing

The Processor only uses AI models to process data based on the Controller's explicit instructions (e.g., “Scan this PDF”, “Generate OWR report”). No autonomous decision-making with legal effect occurs.

4.2 No Training Guarantee

WealthPlannr guarantees that personal data submitted for analysis is not used to train or improve the underlying General Purpose AI Models (Anthropic Claude). Anthropic's commercial API terms contractually prohibit training on customer input data.

4.3 Human-in-the-Loop

The system is designed to require human-in-the-loop verification. The Controller (or their client) must review and confirm AI-extracted data before the final evidence PDF is generated. All extracted values are editable in the review interface.

4.4 Transient Processing

Documents uploaded for AI extraction are processed in memory only. No uploaded documents (PDF, CSV, TXT) are persisted to any database or filesystem. Extracted structured data exists only in the user's browser session.

5. Sub-processors (Onderaannemers)

The Processor uses the following sub-processors:

The Processor will notify the Controller of any changes to sub-processors with at least 30 days' notice.

6. Technical & Organizational Measures (TOMs)

• Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.3).
• Isolation: Multi-tenant architecture with Row-Level Security (RLS), ensuring strict data separation between users.
• Access Control: API keys stored server-side only. Supabase authentication with bcrypt hashing.
• Audit Trails: Logged events for document uploads, report generation, and data exports.
• Minimization: Only data necessary for the requested computation is processed.

7. Data Breach Notification

WealthPlannr will notify the Controller without undue delay (and in any case within 48 hours) after becoming aware of a personal data breach, enabling the Controller to meet their 72-hour reporting obligation to the Autoriteit Persoonsgegevens.

Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to mitigate.

8. Audit Rights

The Controller may request evidence of compliance with this DPA. The Processor will provide relevant documentation, certifications, or (upon reasonable notice) facilitate audits. Contact: audit@wealthplannr.nl

9. Data Return & Deletion

Upon termination of the subscription, the Processor will delete all personal data within 30 days. The Controller may request a data export (CSV) before termination. After deletion, the Processor will provide written confirmation upon request.

10. Governing Law

This DPA is governed by the laws of the Netherlands and the GDPR/AVG. Disputes shall be submitted to the competent court in Amsterdam.