1.1. El Niño: the company El Niño B.V., established in Enschede and registered with the Chamber of Commerce under file number 08140115.

1.2. Client: the natural or legal person who has entered into an agreement with El Niño or to whom El Niño has submitted an offer for this purpose.

1.3. General Terms and Conditions: the provisions of this document.

1.4. Service: the services that El Niño will perform for the Client, as described in the quotation or as agreed upon.

1.5. Materials: all software, designs, documentation, analyses, advice, reports, quotations and other products of the mind related to the Services, as well as preparatory material thereof and the data carriers on which the Materials are located.

1.6. Agreement: the agreement between El Niño and the Client under which El Niño will perform the Service.

1.7. Personal data: personal data as referred to in the privacy law, the General Data Protection Regulation (GDPR).

2.1. El Niño will prepare an offer in which it indicates what is included in the Service and what amount will be due upon acceptance. Only the description of the Service indicated in the quotation is binding. Adjustment of the description of the Service counts as an amendment to the Agreement.

2.2. An offer is without obligation and valid until 14 days after it has been sent by El Niño, unless stated otherwise in the offer.

2.3. If it appears that information provided by the Client is incorrect, El Niño has the right to adjust the prices accordingly.

2.4. These General Terms and Conditions apply to the Agreement at all times, unless expressly agreed otherwise in writing.

2.5. Provisions or conditions set by the Client that deviate from, or do not appear in, these General Terms and Conditions are only binding on El Niño if and insofar as they have been expressly accepted by El Niño in writing.

2.6. After acceptance, the Agreement may only be changed with mutual consent. For changes to these General Terms and Conditions, see Article 19.

2.7. The Agreement comes into existence at the moment that El Niño receives the notification containing the acceptance of the quotation by the Client.

3.1. If the Service extends to the periodic provision of services for a certain period of time, the Agreement is deemed to have been entered into for a minimum period of twelve months, unless otherwise agreed in writing. Unless agreed otherwise in writing, in the absence of a written cancellation in time for a notice period of two months, the Agreement will always be tacitly extended for a period of one year.

3.2. If the Service extends to the development of software or other works, the Agreement is deemed to have been entered into for the duration indicated in the offer or until the works have been developed and accepted. Unless otherwise agreed, the Agreement cannot be terminated prematurely in this situation.

3.3. Terms of delivery specified by El Niño always have an indicative scope, unless it is explicitly stated in writing that it concerns a deadline. El Niño is, even in the case of an agreed deadline, only in default after the Client has given it written notice of default, except for situations that are mandatory by law in which the default takes effect by operation of law.

3.4. If the Client does not fulfill any obligation under the Agreement, El Niño has the right to suspend the performance of all agreements concluded with the Client concerned, without notice of default or judicial intervention being required and without prejudice to El Niño’s right to compensation of damage, lost profit and interest, unless the non-performance in question is of minor importance.

4.1. After the conclusion of the Agreement, El Niño will perform the Service as soon as possible in accordance with the quotation.

4.2. Insofar as not agreed otherwise in writing, El Niño guarantees that the Service will be performed to the best of its ability with due care and skill.

4.3. If and insofar as the proper execution of the Service requires this, El Niño has the right to have certain activities performed by third parties. El Niño will inform the Client about this in a timely manner. Any additional costs associated with this are for the account of the Client, unless agreed otherwise.

4.4. The Client is obliged to do and refrain from doing anything that is reasonably necessary and desirable to enable the timely and correct performance of the Service. In particular, the Client ensures that all data, which El Niño indicates are necessary or which the Client should reasonably understand are necessary for the performance of the Service, are provided to El Niño in a timely manner.

4.5. If this is part of the Service, El Niño will provide the Client with an administrative user name and password. With this data, the Client has access to an administrative account and management software with which the Client can manage the provision of the Service at its own discretion and manage accounts for individual users and set the possibilities and restrictions for these individual users of the Service, all within the limits indicated in the quotation or other accessible and recognizable location for the Contractor.

4.6. Every action that takes place through the administrative account or an account of an individual user is deemed to be carried out under the responsibility and risk of the Client. In the event of suspected misuse of an account, the Client must report this to El Niño as soon as possible so that it can take measures.

4.7. El Niño has the right to (temporarily) put products and services out of use and/or to limit their use, or not to deliver them or only to a limited extent, if the Client fails to fulfill an obligation towards El Niño with regard to the Agreement or acts contrary to these terms and conditions.

5.1. Any change to the Service requested by the Client, or necessary because circumstances require a different implementation, is treated as additional work where it results in extra costs, and as reduced work where it results in lower costs. Additional work is invoiced at the applicable rates.

5.2. If, after the quotation was issued, El Niño encounters circumstances it did not know and could not reasonably have known when entering into the Agreement, and those circumstances mean the work is more extensive or more complex than the quotation assumed, El Niño is entitled to charge the additional costs to the Client.

5.3. El Niño will inform the Client of such circumstances and of the expected additional costs before incurring them. If the Client does not agree, it may cancel the additional work not yet performed, but remains liable for additional work already performed with its knowledge.

5.4. El Niño may decline a change request where it would exceed available capacity or impair the proper functioning of the Service.

6.1. All prices are exclusive of turnover tax (omzetbelasting) and other levies imposed by the government.

6.2. All prices on the El Niño website are subject to programming and typing errors. No liability is accepted for the consequences of such errors insofar as they are not attributable to El Niño.

6.3. If the Agreement is a continuing performance agreement, El Niño is entitled to increase the applied rates at any time. El Niño will inform the Client of rate changes at least 1 (one) month in advance. In the event of a price increase, the Client has the right to terminate the Agreement, with due observance of a notice period of 1 (one) month.

7.1. El Niño will send an invoice to the Client for the amount owed by the Client. The payment term of this invoice is 15 days after the date of the invoice, unless stated otherwise on the invoice or otherwise agreed in the Agreement.

7.2. Contrary to the previous paragraph, El Niño is not obliged to send an invoice if the Agreement is a continuing performance contract. The Client will pay El Niño the amount due for that period monthly or another agreed term in advance.

7.3. If a Service extends to the development of a specific work and the work is delivered in different phases, payment will be made per phase.

7.4. If the Client does not pay within the payment term, it is in default by operation of law without notice of default being required, and owes statutory commercial interest under Article 6:119a of the Dutch Civil Code on the outstanding amount from the day following the payment term until payment in full. If the Client is in default, El Niño may suspend the work and dissolve the Agreement.

7.5. In the event of late payment, the Client is, in addition to the amount due and the interest accrued thereon, obliged to pay full compensation for both extrajudicial and judicial collection costs, including the costs for lawyers, bailiffs and collection agencies.

7.6. The claim for payment is immediately due and payable in the event that the Client is declared bankrupt, applies for suspension of payments or if the Client’s assets are seized in full, the Client dies and furthermore, if it goes into liquidation or is dissolved.

7.7. In the above cases, El Niño furthermore has the right to terminate or suspend the performance of the Agreement or any part thereof that has not yet been performed, without notice of default or judicial intervention, and without the right to compensation for damage for the Client that may arise as a result. Any licenses granted to the Client for the use of El Niño’s intellectual property also end therewith.

8.1. All intellectual property rights to all Materials developed or made available by El Niño in the context of the Service are vested exclusively in El Niño or its licensors.

8.2. The Client will only acquire the rights of use and powers that arise directly from the purport of the Agreement or that are granted in writing, and the Client will not otherwise reproduce or publish the Materials.

8.3. The Client is not permitted to remove or change any indication regarding copyrights, brands, trade names or other intellectual property rights from the Materials, including indications regarding the confidential nature and secrecy of the Materials.

8.4. El Niño is permitted to take technical measures to protect the Materials. If El Niño has secured the Materials by means of technical protection, the Client is not permitted to remove or evade this protection.

8.5. Any use, reproduction or disclosure of the Materials that falls outside the scope of the Agreement or usage rights granted in writing constitutes an infringement of El Niño’s intellectual property rights. The Client will pay an immediately due and payable fine of 1,000 euros per infringing act to El Niño, without prejudice to El Niño’s right to obtain compensation for its damage caused by the infringement or to take other legal measures in order to end the infringement.

9.1. El Niño accepts legal obligations for compensation only insofar as this appears from this article.

9.2. If El Niño imputably fails to comply with the Agreement, El Niño is never obliged to pay more compensation than compensation for the value of the non-performance. Any liability of El Niño for any other form of damage is excluded, including additional compensation in any form whatsoever, compensation for indirect damage or consequential damage or damage due to loss of turnover or profit.

9.3. El Niño is in no way liable for damage due to delays, damage due to loss of data, damage due to exceeding of terms as a result of changed circumstances, damage resulting from the provision of inadequate cooperation, information or Materials by the Client, and damage due to information or advice provided by El Niño the content of which does not expressly form part of the Agreement.

9.4. The maximum amount that will be paid in case of liability under the previous articles is equal to the lower of the following amounts: a) the amount of the price stipulated for that Agreement (excluding VAT), or b) 5,000 euros. If the Agreement is mainly a continuing performance contract with a term of more than six months, the stipulated price will be set at the total of the fees (excluding VAT) stipulated for three months. These maximum amounts will lapse if and insofar as the damage is the result of intent or gross negligence on the part of El Niño.

9.5. The liability of El Niño due to an attributable shortcoming in the fulfillment of the Agreement only arises if the Client immediately and properly declares El Niño in default in writing, stating a reasonable term to remedy the shortcoming, and El Niño also falls short of its obligations after that term. The notice of default must contain as detailed a description as possible of the shortcoming, so that El Niño is able to respond adequately.

9.6. In the event of an unlawful act by El Niño, an employee or subordinate for which it is held legally liable, El Niño is only liable for compensation for damage due to death or physical injury, and for other damage only when caused by intent or willful recklessness. Liability for other damage under Article 6:170 of the Dutch Civil Code is expressly excluded.

9.7. The Client indemnifies El Niño against all third-party claims for liability as a result of a defect in a product or system supplied by the Client to a third party and which also consisted of goods, Materials or results supplied by El Niño, except if and insofar as the Client proves that the damage was caused by those items, Materials or results.

10.1. None of the parties can be held to fulfill any obligation if a circumstance that is beyond the parties’ sphere of risk and that was not or should not have been foreseen when the Agreement was concluded, nullifies any reasonable possibility of fulfillment.

10.2. These circumstances may include, for example: (a) disruptions of the internet or other telecommunication facilities, (b) shortcomings by parties on whom El Niño is dependent in the provision of the Service, (c) defective goods, equipment or Materials of which the Client has use to El Niño, (d) unavailability of one or more personnel (due to illness or otherwise), and (e) government action.

10.3. If a force majeure situation lasts longer than three months, each of the parties has the right to dissolve the agreement in writing. In that case, what has already been performed on the basis of the Agreement will be settled pro rata, without the parties owing each other anything else.

11.1. Parties will treat information that they provide to each other before, during or after the performance of the Agreement as confidential if this information is marked as confidential or if the receiving party knows or should reasonably suspect that the information was intended to be confidential. Parties also impose this obligation on their employees as well as on third parties engaged by them for the implementation of the Agreement.

11.2. El Niño will not take cognizance of data that the Client stores and/or distributes via El Niño’s systems, unless this is necessary for the proper execution of the Agreement or El Niño is obliged to do so pursuant to a statutory provision or court order. In that case, El Niño will endeavor to limit the knowledge of the data as much as possible, insofar as this is within its power.

11.3. This obligation also continues after termination of the Agreement for whatever reason, and for as long as the disclosing party can reasonably claim the confidential nature of the information.

12.1. If the Service is (also) intended to develop websites, corporate identities, logos, images, software, designs, documentation or other specific works, the Parties will specify in writing which works will be developed, which requirements they must meet and how this will be done. El Niño will carry out the development with care on the basis of the information to be provided by the Client. The Client guarantees the correctness, completeness and consistency of its instructions and data.

12.2. El Niño is entitled, but not obliged, to investigate the correctness, completeness or consistency of the source materials, requirements or specifications made available to it and to suspend the agreed work in the event of any imperfections until the Client has removed the relevant imperfections.

12.3. If source materials provided to El Niño by the Client are protected by any intellectual property right, the Client guarantees at all times that it has all licenses necessary for the provision to and the intended use by El Niño in the context of the Agreement.

12.4. Unless otherwise agreed, El Niño has the right to use images, software and components of third parties, including open source software, in the development of the works. After delivery, responsibility for proper compliance with the relevant third-party licenses when using the developed works lies with the Client. El Niño will inform the Client about the applicable license conditions.

12.5. The source code of developed software and the technical documentation produced during the development of the software can only be made available to the Client if and insofar as this has been expressly agreed in writing and the Client is entitled to make changes to this software.

12.6. The Client is not permitted to sell, rent, sublicense, alienate or grant limited rights to the developed works or to make them available to a third party in any way or for any purpose whatsoever, not even if the third party in question uses the software exclusively for the benefit of the Client, unless otherwise agreed in writing or in the event of and in combination with a sale of the relevant business units or activities of the Client.

13.1. If the Service (also) extends to the development of websites, branding, logos, images, software, designs, documentation or other specific works, the service will be provided in several phases, unless the Agreement stipulates otherwise.

13.2. After completion of each phase, the Client must approve or reject the result of that phase. If he fails to do so within the period set for this, this will be regarded as approval. The Client may not base an approval or rejection of the result of a later phase on matters that were approved in an earlier phase.

13.3. If the Client rejects a result in whole or in part, El Niño will endeavor to remove the reason for rejection as quickly as possible. It can do this by revising the result or stating with reasons that the reason does not apply. The Client then has the option of accepting or rejecting the adjustments and/or justifications during the same term as applied for the initial approval or rejection.

13.4. In the case of software development, the Client has 14 days after each phase of development to test the result. The Client will provide a written and detailed report to El Niño regarding bugs or parts that do not meet the specified quotation.

13.5. In case of development of a website, the Client has 14 days after the final phase of development to test the result and to report in writing and in detail to El Niño regarding bugs or non-conformities. If the Client has explicitly or implicitly agreed to the result, the website will be placed online. The Client then has another 14 days to test the website and to report.

13.6. If the Service extends to the development of a website or software system that replaces a website or software already in use at the Client, the Client is obliged to keep what it already uses ready for direct use until at least 6 (six) months after the Client has implicitly or explicitly agreed to the end result of the work.

13.7. The Client is aware that the system may contain bugs and agrees that El Niño is not liable for any form of damage, material or immaterial in nature, that may result from the presence of bugs.

13.8. If the Client continues to reject the result even after a reasonable number of revisions or motivations, El Niño is entitled to dissolve the Agreement. However, El Niño only has this right after it has indicated with a revision or motivation that it will be the last one and the Client has also rejected this revision or motivation.

13.9. If El Niño has indicated that the source materials, requirements or specifications made available to it are not in order, the deadline for delivery of (the phase of) the work will shift in proportion to the period that the Client has not removed the defects alleged by El Niño.

14.1. If the Service (also) extends to the installation, configuration and/or maintenance of software, El Niño will install and configure the software on hardware and networks to be designated by the Client. The Client is obliged to do all that is reasonably necessary and desirable to enable the timely and correct installation and operation of the software. In particular, the Client ensures that all data, which El Niño indicates are necessary or which the Client should reasonably understand are necessary for the delivery of the software, are provided to El Niño in a timely manner.

14.2. At the request of El Niño employees and auxiliary persons of El Niño, the Client will provide all necessary access to the computer systems concerned to enable installation, configuration, maintenance and adjustments of the software. Physical access to these systems will only take place if this is necessary, and only after prior consultation with the Client.

14.3. The choice, purchase and management of the hardware and networks to be used is the sole and full responsibility of the Client. El Niño will provide clues as to the desired configuration. If the designated hardware and networks do not meet El Niño’s requirements, El Niño is entitled to refuse installation or configuration.

14.4. If licenses from third parties are necessary for the use of the software, the Client will purchase these licenses and ensure that the stipulations contained therein are strictly observed. The Client indemnifies El Niño against claims from third parties regarding the installation and maintenance of the software.

14.5. Only if this is part of the Agreement will El Niño make efforts to modify the software from time to time to improve functionality and to correct errors. In the event of new functionality or changes that can substantially change the functioning of the software, El Niño will consult with the Client in advance.

14.6. Only if this is part of the Agreement will El Niño make an effort to keep the software up-to-date. However, El Niño is in many cases dependent on its supplier(s) and third parties. El Niño is entitled not to install certain updates or patches if, in its opinion, this does not benefit the correct functioning of the software or is not in the interest of the Service.

14.7. El Niño will make every effort to add changes and new functionality to the software requested by the Client, but El Niño is always entitled to refuse such a request if, in its opinion, this is not feasible or may impede the proper functioning or availability of the software. Article 13 applies mutatis mutandis to such changes and new functionality.

14.8. If the Client wishes to independently implement a change to the software, this will be done entirely at the Client’s own risk and responsibility. El Niño then no longer has to make an effort to fix bugs or provide other support. All this unless the Client has reported the desired change to El Niño in advance and El Niño has approved this in writing. El Niño may attach conditions to this approval.

15.1. If the Service is (also) provided via networks and/or other equipment of El Niño, El Niño will make every effort to realize uninterrupted availability thereof and to realize access to data stored by El Niño.

15.2. El Niño offers no guarantees about uninterrupted availability unless agreed otherwise in the quotation by means of a Service Level Agreement designated as such. Insofar as not stipulated otherwise in such a Service Level Agreement, the provisions of this article apply to availability.

15.3. El Niño is obliged to make backups of data stored by the Client on systems of El Niño. Any backups made can be destroyed at any time after termination of the Agreement. It is the Client’s responsibility to request a backup upon termination or dissolution.

15.4. El Niño will make every effort to ensure that the Client can use the networks that are directly or indirectly connected to El Niño’s network. However, El Niño cannot guarantee that these networks will be available at any given time. The use of third-party networks may be subject to legal and contractual conditions. El Niño will endeavor to inform the Client about this in a timely manner.

15.5. If, in the opinion of El Niño, a danger arises for the functioning of the computer systems or the network of El Niño or third parties and/or the services via a network, in particular due to excessive sending of e-mail or other data, poorly secured systems or activities of viruses, Trojans and similar software, El Niño is entitled to take all measures it reasonably deems necessary to avert or prevent this danger.

16.1. If the Service (also) serves to provide services regarding the storage and/or transfer of material supplied by the Client to third parties, such as in the case of web hosting or e-mail services, the provisions of this article also apply.

16.2. The Client shall refrain from storing and/or distributing (or causing to be distributed) material in violation of provisions of Dutch law, including in any case, but not limited to, material that:

1. is defamatory, abusive, racist, discriminatory or hate speech;
2. is erotic or pornographic, unless explicitly permitted in the offer;
3. infringes the rights of third parties, including but not limited to copyrights, trademark rights and portrait rights;
4. constitutes a violation of the privacy of third parties, including in any case but not limited to the distribution of personal data of third parties without permission or necessity, or the repeated harassment of third parties with unwanted communications;
5. contains hyperlinks, torrents or similar information that the Client knows or should know refers to material that infringes the rights of third parties;
6. contains unsolicited commercial, charitable or idealistic communications; or
7. contains malicious content such as viruses or spyware.

16.3. The Client shall refrain from hindering other clients or internet users or causing damage to the servers. The Client is prohibited from starting processes or programs, whether or not via the server, of which the Client knows or can reasonably suspect that this will hinder or damage El Niño, other Clients or internet users. If the Client acts contrary to this prohibition, El Niño is entitled to immediately make the website(s) of the Client temporarily inaccessible. When El Niño takes such measures, it will inform the Client of this, stating reasons.

16.4. When suddenly abundant visits to the website of the Client put a load on El Niño’s servers to such an extent that the hosting for other clients is endangered, El Niño is entitled to immediately make the website(s) of the Client temporarily inaccessible. If El Niño takes such measures, it will inform the Client of this, stating reasons. The website will be put back online as soon as possible after there is no longer any danger to the hosting for other clients.

16.5. The Client indemnifies El Niño against all legal claims with regard to the data, information, website(s) and the like stored by the Client.

16.6. Without El Niño’s permission, the Client is prohibited from transferring the user name or user names and password or passwords provided by El Niño to third parties.

16.7. In addition to the obligations under the law, damage caused by incompetence or failure to act in accordance with the above points is for the account of the Client.

16.8. El Niño can set a maximum on the amount of storage space or data traffic per month that the Client may use in the context of the Service. If this maximum is exceeded, El Niño is authorized to charge an additional amount, in accordance with the amounts for additional data traffic stated in the quotation. There is no liability for the consequences of not being able to send, receive, store or change data if an agreed limit for storage space or data traffic has been reached.

16.9. The Client hereby grants El Niño an unrestricted license to distribute, store, transmit or copy all Materials supplied by the Client to El Niño’s systems in any manner deemed appropriate by El Niño, but only to the extent reasonably necessary for the purposes of El Niño’s compliance with the Agreement.

17.1. If the Service is (partly) intended for El Niño to mediate for the Client in obtaining a domain name and/or IP address, the provisions of this article also apply.

17.2. The application, allocation and possible use of a domain name and/or IP address depend on and are subject to the applicable rules and procedures of the relevant registering authorities, including the Stichting Internet Domeinregistratie Nederland. The relevant authority decides on the allocation of a domain name and/or IP address. El Niño only plays a mediating role in the application and does not guarantee that an application will also be honored.

17.3. The Client can only learn the fact of registration from El Niño’s confirmation letter, which states that the requested domain name has been registered. An invoice for registration costs is not a confirmation of registration.

17.4. The Client indemnifies and holds El Niño harmless against all damage related to (the use of) a domain name on behalf of or by the Client.

17.5. El Niño is not liable for the loss by the Client of its right(s) to a domain name or for the fact that the domain name is requested and/or obtained by a third party in the meantime, except in the event of intent or deliberate recklessness on the part of El Niño.

17.6. If El Niño registers a domain name in its name on behalf of the Client, El Niño will cooperate with requests from the Client to move, transfer or cancel this domain name.

17.7. The Client must comply with the rules set by registering authorities for the application, allocation or use of a domain name.

17.8. El Niño has the right to make the domain name inaccessible or unusable, or to place it in its own name if the Client demonstrably fails to comply with the Agreement, but only for the duration that the Client is in default and only after a reasonable period of time for compliance has been given in a written notice of default.

17.9. In the event of dissolution of the Agreement due to non-performance by the Client, El Niño is entitled to terminate the Domain Name with due observance of a notice period of 1 (one) month.

18.1. Each Party complies with its obligations under Regulation (EU) 2016/679 (the General Data Protection Regulation) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

18.2. Where El Niño processes personal data on behalf of the Client in performing the Services, the Client acts as controller and El Niño acts as processor. Annex I (Data Processing) applies to that processing and forms part of the Agreement. Annex I constitutes the contract required by Article 28(3) GDPR, and no separate data processing agreement is required.

18.3. The Parties may instead conclude a separate data processing agreement. Where they do, that agreement prevails over Annex I to the extent of any conflict.

18.4. El Niño does not process personal data other than as necessary to perform the Agreement and in accordance with the Client’s documented instructions, as set out in Annex I.

19.1. El Niño reserves the right to change or supplement these terms and conditions.

19.2. Changes also apply to agreements already concluded, with due observance of a period of 30 days after the announcement of the change on the El Niño website or by electronic notification. Changes of minor importance can be made at any time.

19.3. If the Client does not wish to accept a change in these terms and conditions, it can terminate the agreement until the date on which the new terms and conditions come into effect, or on the date of receipt of the cancellation if this date is after the effective date of the change.

20.1. El Niño maintains an information security management system certified to ISO/IEC 27001:2022, and applies appropriate technical and organisational measures to protect data processed under the Agreement. A description of the measures is available on request and, where the Data Processing Annex applies, is set out in that Annex.

20.2. El Niño will inform the Client without undue delay of any security incident that materially affects the Client’s data or the Service. Where the incident constitutes a personal data breach, the notification provisions of Annex I apply.

20.3. The Client is responsible for the security of systems, credentials and networks under its own control, including those referred to in Articles 4.5 and 4.6.

21.1. El Niño may use AI-assisted development tools in performing the Service. El Niño remains fully responsible for the Materials delivered, and reviews AI-assisted output as it would any other work product.

21.2. El Niño does not submit the Client’s confidential information or personal data to AI tools except as permitted under the Agreement and, where applicable, Annex I (Data Processing).

21.3. Where the Service includes the development of an AI system within the meaning of Regulation (EU) 2024/1689 (the AI Act), the Parties will record in writing which Party acts as provider and which as deployer of that system, and the resulting allocation of obligations, before development begins.

21.4. The Client is responsible for its own compliance obligations as deployer of any AI system delivered under the Agreement, including transparency towards its users.

22.1. Dutch law applies to this agreement.

22.2. Insofar as not dictated otherwise by mandatory law, all disputes that may arise as a result of this agreement will be submitted to the competent Dutch court for the district in which El Niño is located.

22.3. If any provision of this agreement proves to be null and void, this will not affect the validity of the entire agreement. In that case, the parties will adopt (a) new provision(s) as a replacement, which will give shape to the intention of the original Agreement and General Terms and Conditions as far as legally possible.

22.4. Information and announcements on the El Niño website are subject to programming and typing errors. In the event of any inconsistency between the website and the Agreement, the Agreement will prevail.

22.5. In these terms and conditions, “in writing” also includes e-mail, provided that the identity and integrity of the e-mail is sufficiently established.

22.6. The version of any communication received or stored by El Niño is considered authentic, unless the Client provides evidence to the contrary.

22.7. The parties will always inform each other immediately in writing of any changes in name, postal address, e-mail address, telephone number and, if requested, bank or giro number.

22.8. Each Party is only entitled to transfer its rights and obligations under the Agreement to a third party with the prior written consent of the other Party.

1.1. In this Annex, personal data, processing, controller, processor, sub-processor, data subject, personal data breach and supervisory authority have the meanings given in the General Data Protection Regulation (GDPR).

1.2. Client Personal Data means personal data that El Niño processes on behalf of the Client under the Agreement.

1.3. In respect of Client Personal Data the Client acts as controller and El Niño acts as processor. Where the Client is itself a processor for a third party, El Niño acts as sub-processor and this Annex applies as if references to the controller were to that third party, with the Client warranting that it has the authority to appoint El Niño.

1.4. This Annex constitutes the contract required by Article 28(3) GDPR. Where the Parties conclude a separate data processing agreement, that agreement prevails over this Annex to the extent of any conflict.

2.1. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Appendix A. Where Appendix A is not completed for a particular engagement, the processing is limited to what is necessary to deliver the Services described in the Agreement.

2.2. This Annex applies for as long as El Niño processes Client Personal Data. Clauses 4, 9 and 10 survive termination.

3.1. El Niño processes Client Personal Data only on the Client’s documented instructions, including in relation to transfers to a third country, unless required to do otherwise by Union or Member State law. Where such a legal requirement applies, El Niño informs the Client before processing, unless that law prohibits it on important grounds of public interest.

3.2. The Agreement, this Annex and Appendix A constitute the Client’s initial documented instructions. Further instructions must be given in writing.

3.3. If El Niño considers an instruction to infringe the GDPR or other data protection law, it informs the Client without delay and may suspend the instruction until it is confirmed or withdrawn.

3.4. El Niño does not process Client Personal Data for its own purposes. In particular, and without limitation, El Niño does not:

1. use Client Personal Data to develop, train, fine-tune, evaluate or improve any artificial intelligence or machine learning model, whether its own or a third party’s;
2. use Client Personal Data for its own analytics, benchmarking, research or product development;
3. use Client Personal Data in the performance of services for any other client; or
4. publish or disclose Client Personal Data in case studies or marketing material, whether or not aggregated or anonymised,

unless expressly instructed in writing by the Client.

3.5. El Niño does not submit Client Personal Data to any third-party artificial intelligence service unless that service is listed as an approved sub-processor in Appendix C.

4.1. El Niño ensures that persons authorised to process Client Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

4.2. Access to Client Personal Data is limited to those personnel who need it to deliver the Services.

5.1. El Niño implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in place are described in Appendix B.

5.2. El Niño maintains certification to ISO/IEC 27001:2022 in respect of its information security management system, and will notify the Client if that certification lapses or is withdrawn.

5.3. El Niño may update the measures in Appendix B provided the level of security is not reduced.

6.1. The Client gives El Niño general written authorisation to engage sub-processors. The sub-processors engaged at the date of the Agreement are listed in Appendix C.

6.2. El Niño gives the Client at least thirty (30) days’ written notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period. If the Parties cannot resolve the objection, the Client may terminate the affected Services without penalty, with a pro-rata refund of prepaid fees.

6.3. Where the change is required urgently to maintain security or continuity, El Niño may make it immediately and notify the Client without delay, and the objection right in clause 6.2 applies retrospectively.

6.4. El Niño imposes on each sub-processor, by contract, data protection obligations no less protective than those in this Annex, and remains fully liable to the Client for the sub-processor’s performance.

6.5. El Niño maintains a current list of sub-processors and makes it available to the Client on request.

7.1. Data subject rights. Taking into account the nature of the processing, El Niño assists the Client by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise rights under Chapter III GDPR. Where a request reaches El Niño directly, El Niño does not respond to it and forwards it to the Client within two (2) working days.

7.2. Security, breaches, impact assessments. El Niño assists the Client, taking into account the nature of the processing and the information available to it, in complying with Articles 32 to 36 GDPR — security of processing, breach notification and communication, data protection impact assessments, and prior consultation with the supervisory authority.

7.3. El Niño may charge its reasonable costs for assistance that goes materially beyond what the Services ordinarily require, having given the Client advance notice of those costs.

8.1. El Niño notifies the Client of any personal data breach affecting Client Personal Data without undue delay after becoming aware of it, and in any event within twenty-four (24) hours.

8.2. The Client is responsible for notifying the supervisory authority and data subjects. El Niño does not make such notifications on its own initiative unless legally required to do so.

8.3. The notification includes, so far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. El Niño provides an initial notification within the period in clause 8.1 even where the facts are incomplete, and supplements it as more becomes known.

8.4. El Niño documents every personal data breach affecting Client Personal Data, and cooperates with the Client in investigating, mitigating and remediating it.

9.1. El Niño processes Client Personal Data within the European Economic Area unless Appendix C identifies a sub-processor located outside it.

9.2. Where a transfer outside the EEA occurs, El Niño ensures an appropriate safeguard under Chapter V GDPR — an adequacy decision, the Standard Contractual Clauses adopted by the European Commission supplemented by a transfer impact assessment, or another valid mechanism. The mechanism relied on for each sub-processor is stated in Appendix C.

10.1. On expiry or termination of the Agreement, El Niño deletes or returns all Client Personal Data at the Client’s choice, and deletes existing copies, unless Union or Member State law requires it to be retained.

10.2. The Client must indicate its choice within thirty (30) days of termination. Absent an instruction, El Niño deletes the data.

10.3. El Niño confirms deletion or return in writing, and states what remains in backups and when backup rotation will remove it. Data remaining in backups continues to be protected by this Annex until deleted.

11.1. El Niño makes available to the Client the information necessary to demonstrate compliance with Article 28 GDPR.

11.2. The Client’s audit right under Article 28(3)(h) is satisfied in the first instance by El Niño providing its ISO/IEC 27001 certificate, the applicable Statement of Applicability, and a summary of audit results, together with completed security questionnaires on reasonable request.

11.3. Where that is demonstrably insufficient, the Client may conduct or mandate an audit once per twelve (12) months, on thirty (30) days’ written notice, during business hours, without unreasonable disruption, and subject to confidentiality. The Client bears its own costs and El Niño’s reasonable costs. An additional audit may be conducted following a personal data breach affecting Client Personal Data.

11.4. Any third-party auditor must not be a competitor of El Niño and must be bound by confidentiality.

12.1. El Niño maintains a record of processing carried out on behalf of the Client, as required by Article 30(2) GDPR, and makes it available to the Client and to a supervisory authority on request.

13.1. The liability provisions of the Agreement apply to this Annex, save that nothing limits either Party’s liability where limitation is not permitted by applicable law, including liability to data subjects under Article 82 GDPR.

13.2. This Annex is governed by the law stated in the Agreement, and disputes are subject to the forum stated in the Agreement.

The description of the processing is agreed per engagement and is set out in the quotation or statement of work accepted by the Client. It covers the following:

El Niño operates an information security management system certified to ISO/IEC 27001:2022. The measures below are maintained under that system and are described in El Niño’s policy set, which is available on request.

El Niño engages the sub-processors listed below. The current list is maintained at elnino.tech/sub-processors, where the Client can also subscribe to notifications of changes. Where an engagement uses only some of these sub-processors, the applicable list is stated in the quotation.

This table reflects the position as at 1 August 2026. “DPF” means the EU–U.S. Data Privacy Framework; “SCCs” means the Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR.

Where a sub-processor is certified under the DPF for non-HR data only, transfers of personal data relating to El Niño’s own personnel are made on the basis of the SCCs.