Effective date: 28.10.2026
This agreement governs personal data processed by a supplier on behalf of La Petite Foret Belgium BV for the services identified in Schedule 1. It forms part of the services contract between the parties. It is a supplier contract for completion and signature, not a public website policy.
Controller: La Petite Foret Belgium BV, trading as La Petite Forêt, Louwijn 39A, 1730 Asse, Belgium. Company number 0771.290.550. VAT BE0771290550. Privacy and breach notification contact: hello@lapetiteforet.net.
Processors:
Services contracts: The respective subscription, order form and services agreements between La Petite Foret Belgium BV and Hostfully, Inc. or Boostly Limited.
Services and processing covered: Schedule 1, identifying the activities performed by each Processor. References elsewhere in this agreement to “the Processor” mean each named Processor individually in relation to its own services and processing activities.
This agreement applies to each Processor only insofar as it processes personal data on the Controller’s behalf. Each Processor is responsible for its own obligations under this agreement, which becomes binding on that Processor upon its acceptance. Processing for either Processor’s own independently determined purposes requires a separate lawful basis and transparent allocation of responsibilities; it is not authorised by this agreement.Applicable Data Protection Law means the EU General Data Protection Regulation 2016/679, applicable Belgian implementing law and, where relevant to the processing, the UK GDPR and the Data Protection Act 2018 as amended. Controller, processor, personal data, processing, personal data breach and supervisory authority have their meanings under the applicable law.
The Controller determines the purposes and essential means of processing, provides lawful documented instructions and is responsible for appropriate privacy information and legal bases. The parties record the subject matter, duration, nature, purposes, data categories and data subjects in Schedule 1. The Processor must not begin processing until that schedule and the necessary safeguards are complete.
The Processor will process personal data only on the Controller’s documented instructions, including instructions about international transfers, unless required otherwise by applicable Union or Member State law or, where UK GDPR applies, applicable UK law. If such law requires processing, the Processor will inform the Controller of the requirement beforehand unless the law prohibits this on important public interest grounds.
Documented instructions include the services contract, this agreement and written instructions from authorised Controller contacts. The Processor will immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection law and will suspend the affected instruction pending clarification where necessary. It will not use guest data for its own marketing, sell it, train general purpose models on it, or enrich unrelated profiles without separate lawful authorisation outside this processing mandate.
The Processor will ensure that people authorised to process the data are bound by confidentiality obligations or an appropriate statutory duty. Access must be limited to trained personnel who need it for the authorised services. The Processor will maintain appropriate access records and promptly remove access that is no longer needed. These confidentiality duties continue after the services end.
Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing and risks to individuals, the Processor will implement appropriate technical and organisational measures under Article 32. The specific measures must be documented in Schedule 2 and maintained throughout processing.
Measures must address access control, privileged access, encryption where appropriate, confidentiality, integrity, availability and resilience, recovery, secure development and configuration, vulnerability management, logging, staff training, supplier management and regular testing. Measures may be improved over time but must not be materially reduced without agreement and without maintaining the legally required protection.
The Controller gives general written authorisation only for the subprocessors and activities approved in Schedule 3. An empty or incomplete schedule does not authorise an unspecified list. Before adding or replacing a subprocessor, the Processor will provide at least 30 calendar days’ written notice with its identity, activities, processing countries and safeguards, allowing the Controller a meaningful opportunity to object on reasonable data protection grounds.
If the Controller objects, the parties will work promptly on an alternative. The disputed subprocessor must not process the affected data while the objection remains unresolved. If no compliant alternative can be agreed, the Controller may terminate the affected service without a penalty for that termination, subject to settlement of undisputed services already provided.
The Processor must impose written obligations on each subprocessor offering the same level of data protection as this agreement, including sufficient security guarantees. The Processor remains fully liable to the Controller for the subprocessor’s performance of its data protection obligations. On request, it will provide sufficient information or relevant contract extracts to demonstrate compliance, subject to proportionate confidentiality protections.
Processing and remote access locations are limited to those listed and approved in Schedules 1 and 3. The Processor must not transfer or permit access to personal data in another country without documented Controller instructions and compliance with the applicable transfer rules.
For a restricted transfer, the parties must document the applicable adequacy decision or execute the relevant approved international transfer clauses and any required UK addendum or agreement before the transfer. They must assess risks and adopt supplementary safeguards where required. This agreement is an Article 28 processing agreement and does not itself supply an international transfer mechanism or replace unmodified approved transfer clauses.
If a public authority requests access, the Processor will, where lawful, notify the Controller promptly, assess the request, challenge it where there are reasonable grounds and limit any disclosure to what is legally required. If adequate protection cannot be maintained, the parties will suspend the affected processing or transfer and agree remediation or termination.
The Processor will promptly forward requests or complaints from individuals concerning the Controller’s data. It will not substantively respond except on documented instructions or where legally required. Taking account of the nature of processing, it will assist through appropriate technical and organisational measures with access, correction, erasure, restriction, portability, objection and withdrawal requests so that the Controller can meet statutory deadlines.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach and, as a contractual service standard, no later than 24 hours after awareness. Notification must not wait for a completed investigation. Information unavailable at the first notice will be provided in phases without undue delay.
The notice must describe the nature of the breach, categories and approximate numbers of affected individuals and records where known, the contact for follow up, likely consequences, and measures taken or proposed to contain, remedy and mitigate it. The Processor will preserve relevant evidence, investigate, cooperate and keep a record. It will not notify affected people on the Controller’s behalf without instructions unless legally required. The Controller remains responsible for its own statutory authority and individual notifications.
Taking account of the nature of processing and information available, the Processor will assist the Controller with security duties, breach assessments and notifications, data protection impact assessments and prior consultation with supervisory authorities under Articles 32 to 36. It will maintain legally required records and cooperate with the competent authorities.
The Processor will make available all information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections by the Controller or an auditor it appoints. The parties may use current independent assurance reports as a first step where appropriate. Such reports do not remove the right to obtain further necessary information or conduct an inspection.
Audits should protect other customers’ information and use reasonable notice and proportionate confidentiality arrangements. Urgent incidents, credible noncompliance or a regulatory request may require shorter notice. Commercial arrangements must not prevent effective exercise of statutory audit rights. The Processor will promptly remedy identified deficiencies and supply a reasonable remediation plan.
At the Controller’s choice, on termination or completion of the services the Processor will return personal data in a reasonably usable format or securely delete it, and delete existing copies unless applicable law requires retention. It will complete this within 30 calendar days unless a shorter period is instructed and reasonably achievable or another documented schedule is agreed.
If immediate deletion from isolated backups is technically impracticable, the Processor must state the backup rotation in Schedule 2, prevent further use other than disaster recovery, reapply deletion after any restoration and erase the data by the agreed maximum backup expiry. Any legally required retention must be limited to that purpose, protected and disclosed to the Controller where lawful. The Processor will confirm completion in writing and identify any lawful retention that remains.
This agreement lasts for the processing described in Schedule 1 and continues to govern any retained data until lawful deletion. If there is a conflict, this agreement prevails over the services contract for data protection matters, while any applicable approved international transfer clauses prevail to the extent required by their terms.
Each party remains responsible for its own statutory obligations. Nothing in the respective services agreements limits individuals’ rights, supervisory powers or liabilities that cannot lawfully be limited. Other commercial liability and cost arrangements are governed by the relevant provisions of the respective services agreement between La Petite Foret Belgium BV and Hostfully, Inc. or Boostly Limited, insofar as consistent with applicable law and any binding international transfer clauses.
Belgian law governs this agreement, subject to mandatory applicable law and any controlling international transfer clauses. Disputes shall be submitted to the courts having jurisdiction under applicable law, without restricting data subject rights or supervisory authority powers. Amendments and further instructions must be recorded in writing.
