JakoMeet Data Processing Agreement

Version 2026-10-27 · Last updated 27 October 2026

This Data Processing Agreement ("DPA") is made between:

• the customer that accepts it when creating a JakoMeet account ("Customer", the controller); and
• Unusual Companies BV, Vinkenburgstraat 2A, 3512 AB Utrecht, The Netherlands, Chamber of Commerce (KvK) 90982266, VAT NL865517435B01, the company that operates JakoMeet ("JakoMeet", the processor).

It forms part of the JakoMeet Terms of Service ("Terms") and is accepted together with them. No signature is needed. It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. In addition:

• Customer Personal Data: personal data that JakoMeet processes on behalf of the Customer when providing the Service, as described in Annex I.
• Sub-processor: a third party engaged by JakoMeet to process Customer Personal Data.
• Service: the JakoMeet webinar platform as described in the Terms.

2. Roles and scope

1. For Customer Personal Data the Customer is the controller and JakoMeet is the processor.
2. JakoMeet is the controller, and this DPA does not apply, for: account and billing data of the Customer and its workspace members; the JakoMeet Network used for Audience Boost; JakoMeet's own marketing; and security and technical logs of the Service. That processing is described in the Privacy Policy.
3. When a member of the JakoMeet Network registers for the Customer's event, the registration becomes Customer Personal Data for that event. JakoMeet never discloses the identity of Network members who do not register.

3. Customer's instructions and responsibilities

1. JakoMeet processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service are the Customer's complete instructions. JakoMeet will tell the Customer if it believes an instruction infringes the GDPR.
2. The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for the registration data it collects, linking its own privacy policy to every published event, and complying with the data protection and marketing laws of its own country and of the people it reaches.
3. The Customer will not use registration questions to collect special categories of personal data unless it has a clear legal basis and the data is necessary for its event.

4. JakoMeet's obligations

JakoMeet will:

1. process Customer Personal Data only to provide the Service, unless EU or Member State law requires otherwise (in which case JakoMeet informs the Customer first, unless that law forbids it);
2. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
3. implement the technical and organisational measures described in Annex II;
4. help the Customer, taking into account the nature of the processing, to answer data subject requests. The Service lets the Customer export and delete registrant data; JakoMeet forwards to the Customer any request it receives about Customer Personal Data;
5. help the Customer with data protection impact assessments and prior consultations where they concern the Service, using the information available to JakoMeet;
6. notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 48 hours of becoming aware of it, with the information the Customer needs to meet its own obligations, and keep the Customer updated as more information becomes available;
7. make available the information needed to demonstrate compliance with Article 28 GDPR and allow audits as described in section 7.

5. Sub-processors

1. The Customer gives JakoMeet general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex III.
2. JakoMeet will notify the Customer by email at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
3. JakoMeet imposes data protection obligations on each Sub-processor that are no less protective than this DPA, and remains responsible to the Customer for its Sub-processors.

6. International transfers

Some Sub-processors process data outside the European Economic Area. JakoMeet transfers Customer Personal Data only under a transfer mechanism recognised by the GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses.

7. Audits

1. JakoMeet will answer the Customer's reasonable written questions about its data protection practices, including a security questionnaire once per year.
2. If that information is not sufficient, or if a supervisory authority requires it, the Customer may have an on-site audit performed by itself or an independent auditor bound by confidentiality, at most once per year, with at least 30 days' notice, during business hours and at the Customer's cost. The audit must not disrupt the Service or expose other customers' data.

8. Deletion and return

During the subscription the Customer can export and delete its data in the Service. After the Customer's account is closed, JakoMeet deletes Customer Personal Data within 30 days, and from backups within 90 days, unless EU or Member State law requires JakoMeet to keep it.

9. Liability, term and precedence

1. Each party's liability under this DPA is subject to the limitations in the Terms, without limiting the rights of data subjects under the GDPR.
2. This DPA applies as long as JakoMeet processes Customer Personal Data.
3. On data protection matters this DPA prevails over the Terms. Where Standard Contractual Clauses apply, they prevail over this DPA.
4. This DPA is governed by the laws of the Netherlands. Disputes are submitted to the competent court in Utrecht, the Netherlands (Rechtbank Midden-Nederland).
5. Changes to this DPA are announced in the same way as changes to the Terms.

Annex I — Details of the processing

Annex II — Technical and organisational measures

1. Hosting: the application, database and backups run on servers of Leaseweb Deutschland GmbH in a data centre in Germany (EU).
2. Access control: server and database access is limited to Unusual Companies' management and software team. Administrative access requires two-factor authentication. Access within the Service is role-based.
3. Customer separation: every workspace's data is separated in the application; a customer can only reach its own data.
4. Encryption in transit: all web traffic uses HTTPS (TLS). Live video and replays are delivered through signed, time-limited or domain-restricted links.
5. Passwords: user passwords are stored only as salted hashes.
6. Audit logging: sensitive administrative actions, such as system administrator actions and restriction changes, are recorded in an audit log.
7. Data minimisation: organisers never see the identity of JakoMeet Network members who do not register; reports on the Network are aggregated.
8. Email safety: hard bounces, invalid addresses and spam complaints are suppressed for every workspace; sending pauses automatically on unusual activity; every automated email carries a one-click unsubscribe link.
9. Backups: backups are made weekly and kept for at most 12 weeks.
10. Incident response: suspected incidents are investigated without delay and personal data breaches are notified as described in section 4.6.
11. Personnel: everyone with access to personal data is bound by confidentiality.
12. Retention and deletion: replays expire automatically; data is deleted after account closure as described in section 8.

Annex III — Sub-processors