WealthPlannr B.V. — Data Processing Agreement

Verwerkersovereenkomst · Article 28 GDPR/AVG · Netherlands · KvK 42050571

1. Parties (Partijen)

Data Controller (Verwerkingsverantwoordelijke). For end-user / data-owner accounts, WealthPlannr B.V. is controller for account and platform administration, product delivery, security, billing, compliance, support and permitted internal operational purposes. For portfolio-holder, manager or professional-user accounts that submit or manage client data, that user is the controller for those clients' personal data (the "Controller").

Data Processor (Verwerker). For client personal data processed on behalf of a portfolio-holder, manager or professional user, WealthPlannr B.V., registered in Amsterdam (KvK 42050571), acts as processor (the "Processor") and processes such data only on the Controller's documented instructions, including instructions configured through the platform.

2. Scope & Purpose (Onderwerp en Duur)

Purpose. For processor-scope client personal data, WealthPlannr processes data solely to provide financial-calculation software, portfolio and related calculations, report-generation workflows, review interfaces, exports and support on behalf of the Controller and its clients — including Box 3 simulations, portfolio analysis and OWR (Tegenbewijs) evidence reports. WealthPlannr does not decide what advice, filing position or financial action the Controller or a data subject should take.

Duration. Processor-scope processing continues for the term of the relevant account, workspace or subscription, any supported-version transition period, and any wind-down, dormancy, export and deletion period described in Section 9. On termination or on deprecation of a supported processing version, the return, wind-down, dormancy and deletion process in Section 9 applies, subject to retention required or permitted by law. Controller-scope administrative records are retained only as long as necessary for the relevant purpose and applicable limitation periods (see the Companion Section).

3. Types of Data & Data Subjects

Data subjects. End-users / data owners, account administrators, portfolio-holders / managers / professional users, their clients and taxpayers (belastingplichtigen), household members or related persons whose financial figures are entered for a calculation, and persons referenced in support, enforcement or appeal records.

Identification. Client name, account name, account email and related account identifiers. WealthPlannr does not require, capture or store BSN, national identification numbers, passport numbers or any other government-identifiable number; such identifiers are scrubbed client-side and upstream of all exits, including calculation paths, server calls, logging, error reporting, edge logs and crash captures. Users must not submit them.

Financial values. Asset values (Jan 1 / Dec 31), dividends, interest, realized gains and related inputs required for the selected calculation. Where applicable, financial figures compute client-side. Raw financial figures are not logged or used for research, metrics or product-improvement purposes.

Document metadata. Broker identification and a neutral document-format hint only. Uploaded-document filenames are not retained. Operational metadata may include file type, workflow step and validation status, and avoids raw client financial figures or direct identifiers unless strictly necessary for the requested processing or support.

Tax / calculation. Financial-calculation inputs, form-field values, portfolio-composition buckets and calculation outputs needed for the selected workflow. Platform metrics may include utilization, pipeline composition and platform financials only in coarse buckets, aggregated form or client-side-rounded values intended to be non-personal.

3.1 Administrative, Security & Enforcement Data

WealthPlannr processes administrative and operational PII for account/platform administration, product delivery, platform metrics, compliance, debugging, incident management, enforcement, audit and legal-claims purposes, recorded in WealthPlannr's record of processing activities (ROP) and treated as controller processing unless it forms part of processor-scope client data.

Internal enforcement and incident records may include IP address, user-agent, device profile / client hints, country/region, session ID, account ID, account email captured at the time of a ban or account-state change, related event timestamps and appeal text. Raw IP, user-agent and device logs are purged after 14 days unless tied to a reviewed incident, security event, account-state decision, ban, appeal, audit trail or legal-claims hold. IP-ban, account-state and appeal records may be retained longer only while purpose-bound for enforcement, abuse prevention, security, audit or legal-claims evidence, and are not retained permanently by default. Access is restricted to WealthPlannr owners and authorised auditors/advisers with a need to know, subject to confidentiality, logging and least-privilege controls.

4. AI Processing, Metrics & Transparency (EU AI Act 2026)

4.1 Instruction-based processing. For processor-scope client data, WealthPlannr uses AI or automated extraction only on the Controller's documented instructions (e.g. "scan this PDF", "generate OWR report") and only to support the requested calculation or workflow. No autonomous decision-making with legal effect occurs, and WealthPlannr does not provide financial advice.

4.2 No-training guarantee. Personal data submitted for analysis — and in particular portfolio-holder / manager client data — is not used to train or improve the underlying general-purpose AI models (Anthropic Claude) or to improve WealthPlannr product features in identifiable form. Anthropic's commercial API terms contractually prohibit training on customer input. Content submitted to the inference API is retained by the sub-processor only for a limited period (up to 30 days) for backend operation and misuse prevention, after which it is deleted; a longer period applies only where required to enforce the sub-processor's usage policy or by law. Research, benchmarking, security analysis, quality measurement and platform improvement use only data anonymized, aggregated and/or bucketed at source or otherwise rendered non-personal before use, with mosaic-effect and fingerprinting safeguards (coarse bucketing, small-cell suppression, dimension minimization, separation from direct identifiers, access controls and review). Raw financial figures are not used for research or product improvement.

4.3 Human-in-the-loop. The system is designed to require human-in-the-loop verification. The Controller (or end-user / data owner or their client) must review and confirm extracted or calculated data before a final evidence PDF or export is generated. All extracted values are editable in the review interface.

4.4 Transient processing and inference transfers. Documents uploaded for extraction are processed transiently and are not persisted to any WealthPlannr database or filesystem unless the user expressly selects a supported storage/export feature. To perform a requested calculation or analysis, the exact financial values necessary for an accurate result are transmitted to the AI inference sub-processor (Section 5); such figures cannot be coarsened or bucketed without producing incorrect results, and are transmitted minimised of direct identifiers where feasible. Data so transmitted is subject to the sub-processor's retention terms described in Section 4.2 and Section 5, and is not used for research or model training. Extracted structured data otherwise exists only in the user's browser session or workspace for the selected workflow.

5. Sub-processors (Onderaannemers)

WealthPlannr notifies the Controller of intended sub-processor changes with at least 30 days' notice where reasonably practicable, and allows objection on reasonable data-protection grounds. Sub-processors are bound by written terms no less protective than this DPA.

International transfers. Where a provider is headquartered outside the EEA — Anthropic (United States, AI inference), Resend (United States, transactional email), Upstash QStash (United States, scheduled jobs), and Stripe (United States parent; EU payments via its Irish entity) — the transfer is safeguarded under GDPR Article 46: Standard Contractual Clauses, the EU–US Data Privacy Framework where applicable, and supplementary measures reasonably required for the processing risk, as set out in that sub-processor's own Data Processing Agreement. All other sub-processors process within the EEA unless otherwise notified.

6. Technical & Organizational Measures (TOMs)

Access control. API keys stored server-side only; Supabase authentication. Access to administrative PII, enforcement and incident records is limited to WealthPlannr owners and authorised auditors/advisers with a need to know, under least-privilege and confidentiality controls.

Isolation & encryption. Multi-tenant architecture with Row-Level Security (RLS) for strict per-user separation; encryption at rest (AES-256) and in transit (TLS 1.3); secure server-side secrets management.

Minimization. Only data necessary for the requested computation, product delivery, support, security, compliance, debugging, incident, enforcement, audit or legal-claims purpose is processed. BSN / government-ID is not captured and is scrubbed client-side upstream of all exits.

Audit trails & log minimization. Logged events for document uploads, report generation, data exports, security events and account-state changes. Raw IP, user-agent and device logs are purged after 14 days unless tied to a reviewed incident, appeal, audit trail or legal-claims hold. Research and platform-improvement metrics use anonymized, aggregated and/or bucketed non-personal data with mosaic-effect safeguards.

Ongoing measures. Vulnerability and dependency management, logging and monitoring, backup/availability measures, staff/adviser confidentiality commitments, sub-processor due diligence and periodic review of controls.

7. Data Breach Notification

For processor-scope client personal data, WealthPlannr notifies the Controller without undue delay (and in any case within 48 hours) after becoming aware of a personal data breach affecting that data, enabling the Controller to meet any 72-hour reporting obligation to the Autoriteit Persoonsgegevens. Until the Controller confirms a dedicated breach contact, WealthPlannr may use the account owner / administrator / primary account email as the default; each professional user must confirm or replace that default before or at first processing of client data. For WealthPlannr controller-scope incidents, WealthPlannr assesses and makes any required notifications itself.

Notification includes: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed to mitigate, and a contact point for follow-up.

8. Audit Rights

The Controller may request evidence of compliance with this DPA for processor-scope client data. WealthPlannr provides relevant documentation, TOM summaries, sub-processor information, retention summaries, ROP extracts where appropriate, certifications if available, or (on reasonable notice and subject to confidentiality and security limits) facilitates audits, including via the operator compliance surface. Contact: audit@wealthplannr.nl

9. Data Return & Deletion

(processor-scope client personal data)

9.1 Scope. This Section governs processor-scope client personal data — data a portfolio-holder, manager or professional user (the "Controller") enters, imports or manages on behalf of that user's clients or other third parties. Personal data WealthPlannr processes as an independent controller (account, billing, security, incident, enforcement, audit and legal-claims records) is not processor-scope client personal data and is governed by Sections 2 and 3.1 and the Companion Section, not by this Section.

9.2 Return or deletion at the Controller's choice. At the end of the provision of processing services, the Controller may elect either (a) return of the processor-scope client personal data followed by deletion of existing copies, or (b) deletion of that data — save to the extent retention is required by Union or Dutch law. Absent an express election, WealthPlannr applies return-then-deletion: the data is made available for self-serve export/return during the wind-down or dormancy period and is then deleted under 9.6.

9.3 End-of-processing triggers. (a) Active termination — the Controller terminates the subscription, workspace or processing service, gives notice, or a supported processing version is deprecated. (b) Passive lapse — the subscription lapses without an express termination (e.g. non-renewal or failed payment) and no erasure has been requested; handled under the dormancy process in 9.7.

9.4 Wind-down period. On active termination or version deprecation, WealthPlannr provides a 30-day wind-down period during which the Controller may export, return or transition processor-scope client personal data, where reasonably practicable.

9.5 Return mechanism (self-serve). Before termination and during the wind-down period, the Controller may export processor-scope client personal data by self-serve pull; export access is identity-scoped and is not gated on subscription status, so a lapsed or cancelled plan does not sever it. Supported reports are available as PDF, CSV and plain-text (.txt) — including the Tegenbewijs / OWR (Werkelijk Rendement) evidence report, a bulk multi-client OWR export, a ledger export, and a composite advisor package. A machine-readable full-account export (JSON) is additionally available for data portability. Return is by self-serve export; WealthPlannr does not separately deliver a package unless separately agreed. This self-serve return also serves the Controller's own hand-back to, and obligations toward, its clients.

9.6 Deletion. Following the wind-down period (active termination) or the dormancy period (passive lapse, 9.7), WealthPlannr deletes processor-scope client personal data without undue delay, except to the extent retention is required or permitted by law (including a legal-claims hold) or the data forms part of WealthPlannr's separate controller-scope records under 9.1. Deletion is executed synchronously on request — there is no deferral queue or grace timer — so the live/production purge completes on execution; thereafter only time-limited sub-processor backup copies remain and age out under 9.9. WealthPlannr does not assert a right to retain processor-scope client personal data indefinitely.

9.7 Dormancy for passive lapse. Where a subscription lapses without an express termination and no erasure has been requested, WealthPlannr retains the data for a limited dormancy period aligned with the subscription's billing retry and cancellation cycle, to allow the Controller to resume without data loss. If the Controller neither resumes nor objects within that period, the data enters the deletion process in 9.6.

9.8 Law-required retention. Deletion under this Section does not extend to records WealthPlannr must retain under Union or Dutch law, retained only for the statutory period and purpose. Retention of WealthPlannr's own controller-scope records (including fiscal/accounting and proof-of-acceptance/consent records) is addressed in the Companion Section.

9.9 Backups. WealthPlannr maintains no application-level backup copies of processor-scope client personal data in its own database. Copies may persist transiently in sub-processor backups and operational logs (see Section 5); the primary such window is the Supabase daily-backup retention (currently seven days; point-in-time recovery is not enabled), after which they expire in the ordinary course. Backups are used only for restoration and availability.

9.10 Confirmation. After deletion, WealthPlannr provides written confirmation upon request.

Companion — Controller-Scope Account Deletion & Retention

(For WealthPlannr's controller terms / privacy notice — not part of the processor DPA body.)

C.1 Scope. Applies to personal data WealthPlannr processes as an independent controller: (a) direct end-user / data-owner data (own account, financial figures, portfolio); and (b) WealthPlannr's administrative, billing, security, incident, enforcement, audit and legal-claims records for all users.

C.2 Account deletion (direct users) — Article 17. On a verified account-deletion request or account closure, WealthPlannr deletes the user's controller-scope personal data from live/production systems without undue delay. Erasure is executed synchronously on request (payment cancellation, then an all-or-nothing cascade delete of the account) — there is no grace timer — so the live purge completes on execution; residual copies then age out per C.3. Deletion is subject to the survivors in C.4.

C.3 Backups (direct users). Live/production deletion completes on execution (C.2). Residual copies in sub-processor backups and logs age out under the Section 5 schedules — the ceiling is the Supabase daily-backup window (currently seven days; point-in-time recovery not enabled) — and are not restored except for availability.

C.4 Records retained despite deletion (survivors). (a) WealthPlannr's own fiscal and accounting records that WealthPlannr must retain under Dutch tax law (the seven-year bewaarplicht over its own administration). This obligation applies only to WealthPlannr's own company records; it does not extend to the financial data of users or their clients, which WealthPlannr does not retain on a fiscal basis and deletes on erasure. WealthPlannr's sales/revenue record-of-book is held at the payment processor, so its local fiscal-retention footprint is minimal. (b) The proof-of-acceptance / consent-and-instruction ledger (accountability, Article 5(2)): append-only and minimised on erasure (direct identifiers pseudonymised), retained indefinitely for accountability. (c) Security, incident, enforcement, ban/account-state and appeal records under Section 3.1 — raw IP, user-agent and device data purged after 14 days unless tied to a reviewed matter or legal-claims hold. (d) The Article 17 proof-of-erasure record. Except for the ledger under (b), survivors are minimised to the retention purpose and not retained permanently by default.

C.5 Passive dormancy (direct users). Not applicable. Direct / free-tier users have no subscription lapse lifecycle, so direct-user deletion is request-only under C.2. The dormancy in Section 9.7 applies only to accounts that held a paid subscription.

10. Governing Law & Liability

Liability. Subject to the mandatory rights of data subjects and supervisory authorities, each party's aggregate inter-party liability arising out of or relating to this DPA is capped at the greater of (a) the fees paid or payable for the affected services in the 12 months preceding the event giving rise to liability, or (b) EUR 25,000. This cap is mutual and does not limit liability for fraud, wilful misconduct, intentional breach, payment obligations, infringement or misuse of intellectual property, breach of confidentiality, unlawful use or disclosure of personal data outside the scope of this DPA, or indemnity obligations [scope to be specified] to the extent they cannot lawfully be capped. The cap does not limit either party's exposure to data subjects under GDPR Article 82 or any non-waivable liability to a supervisory authority; contribution and allocation between the parties remain subject to applicable law and each party's fault, role and instructions.

Governing law. This DPA is governed by the laws of the Netherlands and the GDPR/AVG, without regard to conflict-of-law rules. The parties submit disputes to the exclusive jurisdiction of the competent court in Amsterdam, without prejudice to mandatory data-subject rights, supervisory-authority powers, or any mandatory forum required by law.

11. Assistance to the Controller (Article 28(3)(e), (f), (h))

11.1 Data-subject rights (Art. 28(3)(e)). Taking into account the nature of the processing, WealthPlannr assists the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to data-subject requests under GDPR Chapter III (access, rectification, erasure, restriction, portability, objection). Where self-serve tooling exists, the Controller acts through it; where only WealthPlannr can give effect to a request, WealthPlannr acts on the Controller's documented instruction without undue delay. Standard, self-serve requests are handled within the subscription; reasonable costs may apply for extraordinary manual effort.

11.2 DPIA & prior consultation (Art. 28(3)(f); Art. 35–36). Taking into account the nature of processing and the information available to it, WealthPlannr assists the Controller with data-protection impact assessments and any prior consultation with the Autoriteit Persoonsgegevens by providing information reasonably available to it (including the processing description in Section 3, the measures in Section 6, the sub-processor information in Section 5, and extracts via the operator compliance surface). WealthPlannr provides information to support the Controller's assessment; it does not conduct the Controller's DPIA or determine its outcome.

11.3 Security-incident assistance (Art. 28(3)(f); Art. 33–34). WealthPlannr assists the Controller in meeting its breach-notification and communication obligations as set out in Section 7.

11.4 Unlawful instructions (Art. 28(3)(h)). WealthPlannr immediately informs the Controller if, in its opinion, an instruction infringes the GDPR/AVG or other applicable Union or Member State data-protection law, and may suspend the affected processing pending the Controller's confirmation or withdrawal of the instruction.

11.5 Processing on instructions; compelled transfers (Art. 28(3)(a)). WealthPlannr processes processor-scope client personal data only on the Controller's documented instructions, including as to international transfers, unless required to do otherwise by Union or Dutch law; in that case WealthPlannr informs the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

Acceptance

Professional users, portfolio-holders and managers can accept this DPA electronically in Settings → Subscription or an equivalent account flow. By accepting "I manage client or third-party data through WealthPlannr and agree to the WealthPlannr Data Processing Agreement (DPA)", you acknowledge that you are controller for those clients' personal data and instruct WealthPlannr to process that data as processor under this Verwerkersovereenkomst. Unless the account is configured and used only for the user's own personal data, a professional-user, portfolio-holder or manager workspace is presumed to involve client or third-party data for which that user is Controller and WealthPlannr is Processor. End-users / data owners managing only their own data are subject to WealthPlannr's controller processing terms.

© 2026 WealthPlannr B.V. · KvK 42050571. WealthPlannr provides financial-calculation and simulation software and is not a licensed financial adviser under the Wft (Wet op het financieel toezicht). Outputs are calculation aids and workflow materials, not financial, investment, tax or legal advice, and should be reviewed against source records and applicable law.