CRAlert

Data processing agreement

This agreement is part of the terms of service. You are the controller of the personal data you put into CRAlert; Beltar B.V. is the processor. Last updated 2026-08-31.

Subject, duration and nature

We process personal data on your instruction to deliver the service: monitoring the SBOMs you upload, alerting the people you name, tracking deadlines, preparing dossiers and keeping the audit trail. The processing lasts as long as your subscription, plus the deletion period in the terms.

Categories of data subjects: your users and the people named in an incident. Categories of data: name, business email address, role, and the actions those people take inside the tool.

Our obligations

  • We process only on your documented instruction, which the terms and this agreement contain.
  • Everyone with access is bound to confidentiality.
  • We take the security measures listed in the privacy policy and keep them current.
  • We help you answer data subject requests and, given the nature of the processing, with your obligations under Articles 32 to 36 GDPR.
  • We tell you without undue delay about a personal data breach, with what we know at that moment.
  • We assess every subprocessor before it starts and review it once a year.
  • At the end of the contract we return or delete the data, at your choice, except what we must keep.

Subprocessors

You give a general authorisation for the subprocessors below. We tell you at least 30 days before a new subprocessor starts, and you may object and terminate if the objection cannot be resolved.

  • Contabo GmbH: Hosting of the application, the database and the backups. France (EU). PRD section 8: all application data, files and backups stay on EU infrastructure.
  • Stripe Payments Europe Ltd: Subscription billing and invoices. Ireland and United States. Card data and invoices are processed by Stripe, partly in the United States under Stripe's own transfer mechanism.
  • Microsoft Ireland Operations Ltd: Transactional email: alerts, reminders and account mail. Exchange Online, EU Data Boundary. to verify until the mail channel is switched on.

Transfers outside the EU

The service runs on EU infrastructure: the server is hosted by Contabo GmbH in France (EU). Stripe Payments Europe Ltd is established in Ireland and processes card data and invoices partly in the United States, under the transfer mechanism named in its own agreement, which is "to verify" before launch.

Audits

We give you the documentation you need to show compliance with this agreement. An audit beyond that is possible once a year, announced in advance, at your cost, and without touching the data of other customers.

Liability

Liability under this agreement follows the limitation in the terms of service.

Beltar B.V., Beatrixstraat 21, 8322 GC Urk, the Netherlands. albert@beltar.nl.