Data Processing Policy

Last update: August 2026

In accordance with the Agreement, ResultX makes the Platform and the Services (both as defined below) available to the Customer (as defined below). The provision of the Platform and the Services entails the collection and processing of Personal Data (as defined below) by ResultX, in its capacity as Processor, on behalf of the Customer. Therefore, ResultX makes this Data Processing Policy (“DPP”) available to the Customer, setting out (i) how ResultX will manage, process and secure the Personal Data; and (ii) the obligations of all parties to comply with the Privacy Legislation (as defined below).

By entering into an Agreement with ResultX, the Customer indicates that it has read, understands and accepts the provisions of this DPP, which forms an integral part of the aforementioned Agreement. Capitalised terms in this DPP have the same meaning as in the Agreement.

This DPP may be updated from time to time by ResultX, in which case ResultX will inform the Customer via its Website (as defined below) or via the ResultX Platform. In any event, the most recent version of this DPP can always be consulted on the Website and on the ResultX Platform.

The current DPP of ResultX can be consulted in pdf format at: https://www.resultx.ai/data-processing-policy.

1 DEFINITIONS

1.1 Capitalised terms have the meaning set out below.

Assignment: All activities performed by ResultX for the Customer, and any other form of cooperation in which ResultX processes Personal Data for the Customer, irrespective of the legal form of the agreement under which such Processing takes place;

Controller: The entity which determines the purposes and means of the Processing of Personal Data, being the Customer as defined in the Agreement;

Customer: The party with whom ResultX has concluded the Agreement, including its Affiliates;

CSRD: Directive No. 2022/2464 of the European Parliament and of the Council of 14 December 2022 amending Regulation (EU) No. 537/2014, Directive 2004/109/EC, Directive 2006/43/EC and Directive 2013/34/EU as regards corporate sustainability reporting;

Data Subject: An identified or identifiable natural person, whereby an identifiable natural person is deemed to be one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Personal Data: Any information relating to an identified or identifiable natural person (i.e. Data Subject);

Personal Data Breach: Unauthorised disclosure, access, misuse, loss, theft or accidental or unlawful destruction of Personal Data processed by ResultX on behalf of the Customer;

Privacy Legislation: The (supra)national privacy legislation applicable to the processing of personal data by the Customer or ResultX in the context of the Agreement, such as, but not limited to: (i) the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”); (ii) the UK Data Protection Act 2018; (iii) the Belgian Privacy Act of 30 July 2018; (iv) the ePrivacy Directive 2002/58/EC of 12 July 2002, including future amendments and revisions thereof; and/or (v) future national legislation implementing the GDPR;

Processor: The entity which Processes Personal Data on behalf of the Controller;

Process/Processing: Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, including but not limited to: the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data;

Platform: the software application(s) and associated modules developed by ResultX, as further described in the Framework Agreement, for which the Customer may purchase a Subscription;

ResultX: The company ResultX BV, incorporated and existing under Belgian law, with registered office at Everslaan 45, 3078 Everberg, and VAT/company number BE-1005.682.043;

Services: All services which ResultX provides to the Customer in relation to the Platform (such as but not limited to support and maintenance);

Subprocessor: Any Processor engaged by ResultX.

The Policy contains the following annexes:

Annex I: Overview of (i) the Personal Data which the Parties expect to be the subject of the Processing, (ii) the use (i.e. the manner(s) of Processing) of the Personal Data, (iii) the purposes and means of such Processing and (iv) the period(s) during which the (various types of) Personal Data will be stored;

Annex II: Overview and description of the security measures taken by ResultX;

Annex III: List of Subprocessors engaged by ResultX.

2 ROLES OF THE PARTIES

2.1 The parties acknowledge and agree that with respect to the Processing of Personal Data as instructed by the Customer, the Customer is considered the ‘Controller’ and ResultX the ‘Processor’. Furthermore, ResultX is permitted to engage Subprocessor(s) in accordance with the requirements set out in Article 7.

2.2 Each party shall comply with its respective obligations under the Privacy Legislation with respect to the processing of the Personal Data.

3 USE OF THE PLATFORM AND/OR THE SERVICES

3.1 The Customer expressly acknowledges that:

• ResultX acts merely as a facilitator of the Platform and/or the Services. The Customer is therefore solely responsible for the manner in which and the extent to which he/she uses the Platform and/or the Services, as well as for all Personal Data collected via the Platform;
• He/she is responsible for all acts and omissions of Authorised Users (i.e. in the event that the Authorised User does or does not take sufficient measures to protect his account on the Platform);
• As a result of the use of the Platform, a number of connections are established between the Customer’s technological infrastructure and the Platform. Documents are, however, only uploaded after the Customer’s approval;
• He/she is responsible for the material and/or the data provided by the Data Subject. The Customer is therefore, as Controller, responsible for complying with the Privacy Legislation and/or other regulations relating to the aforementioned material and/or data; and,
• He/she shall comply with all laws and rules (such as, but not limited to: with respect to the retention period or the rights of the Data Subject) imposed on him/her by the use of the Service.

3.2 The Customer shall avoid any misuse of the Services. In the event of misuse by the Customer of the Platform and/or the Services, the Customer agrees that ResultX can never be held liable in this respect, nor for any damage that would result from such misuse.

3.3 The Customer therefore undertakes to indemnify ResultX should such misuse occur, as well as for any claim of a Data Subject and/or third party on account of such misuse.

4 PURPOSE

4.1 The Customer acknowledges that as a result of the use of the Platform and/or the Services of ResultX, the latter will Process Personal Data as collected by the Customer. The nature and the purpose of the said processing, as well as a description of the Personal Data and categories of Data Subjects processed under the Agreement, are further specified in Annex I.

4.2 ResultX shall always Process the Personal Data in a proper and careful manner and in accordance with the Privacy Legislation and other applicable rules concerning the Processing of Personal Data.

4.3 More specifically, ResultX shall:

• during the performance of the Assignment, deploy all its know-how to carry out the Assignment in accordance with the rules of the art, as befits a specialised and ‘good’ processor; and,
• to the best of its ability, take the necessary security measures (cf. Annex II) and apply all its know-how to perform the Service in accordance with the rules of the art.

4.4 The Customer retains full control over the following: (i) how the Personal Data must be processed by ResultX; (ii) the types of Personal Data that are processed; (iii) the categories of Data Subjects whose Personal Data are subjected to the processing; (iv) the purpose of the processing; and (v) whether such processing is proportionate.

4.5 This DPP is without prejudice to the provisions of the Agreement relating to ‘Data Protection’.

5 INSTRUCTIONS OF / RESPONSIBILITY OF THE CUSTOMER

5.1 Instructions: ResultX shall process the Personal Data only at the request of the Customer and in accordance with the lawful instructions of the Customer in Annex I, unless a legal obligation provides otherwise. ResultX shall inform the Customer if it is of the opinion that the instructions infringe the Privacy Legislation. If the Customer subsequently cannot guarantee that the instruction is legally valid and lawful or fails/refuses to amend the unlawful instruction so that it no longer infringes the Privacy Legislation, ResultX is entitled to (i) suspend/refuse the execution of the said instruction and (ii) at its sole discretion either continue to process the Personal Data in accordance with the instructions previously given or cease the processing entirely, until the Customer has revised its instruction so that it no longer infringes the Privacy Legislation.

5.2 Responsibilities: Furthermore, the Customer acknowledges that it is responsible for:

5.2.1 the accuracy, quality and lawfulness of (the collection and transfer of) the Personal Data;

5.2.2 compliance with all transparency and lawfulness requirements under the Privacy Legislation for the collection and processing of the Personal Data and the transfer thereof to ResultX; and,

5.2.3 ensuring that its instructions (cf. Annex I) comply with the Privacy Legislation.

5.3 The Customer shall notify ResultX without undue delay if it is unable to comply with its responsibilities under this Article or under the Privacy Legislation.

6 SECURITY OF THE PROCESSING

6.1 ResultX takes the security of the Processing activities very seriously. ResultX shall implement at least the technical and organisational measures specified in Annex II in order to ensure the security of the Personal Data. This includes the protection of the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the data (Personal Data Breach). In determining the appropriate level of security, ResultX and the Customer take into account the state of the art, the costs of Consultancy, the nature, scope, context and purposes of the Processing and the risks to the Data Subjects.

7 SUBPROCESSORS

7.1 Approval of the list of Subprocessors:

7.1.1 The Customer acknowledges and agrees that ResultX may engage Subprocessors in connection with the provision of the Service (and the performance of the Agreement). In such a case, ResultX shall ensure that the Subprocessors are bound by at least the same obligations as those by which ResultX is bound under this DPP.

7.1.2 ResultX has currently appointed as Subprocessors its Affiliates and other third parties as listed in Annex III.

7.1.3 ResultX is liable for the acts and omissions of its Subprocessors to the same extent as if it were performing the Service/the Processing of the Personal Data itself, directly under the terms of this DPP.

7.2 Updating of the list of Subprocessors:

7.2.1 ResultX shall:

• update the list whenever a Subprocessor changes (for example when a new Subprocessor is added, a Subprocessor is replaced, etc.);
• clearly indicate the changes in the list; and,
• add a timestamp (i) when the list has been updated and (ii) when the change of Subprocessor has taken effect or will take effect.

7.2.2 ResultX shall notify the Customer (for example via the Website or the Platform) when changes are made to the list.

7.3 Objection

7.3.1 If the Customer wishes to exercise its right to object to a new Subprocessor, it must notify ResultX in writing (cf. Article 15) and do so on reasonable grounds at the latest within thirty (30) days after the notification. If the Customer does not object within the aforementioned period, it shall be deemed to have waived its right to object and to have authorised ResultX to engage the new Subprocessor.

7.3.2 If the aforementioned objection is not found by ResultX to be unreasonable, the parties shall discuss the Customer’s concerns with a view to reaching a reasonable solution. Such a solution may, at the discretion of ResultX, consist of: (i) making available to the Customer a change in the Service; or (ii) recommending a commercially reasonable change in the Customer’s use of the Service in order to avoid the Processing of the Personal Data by the contested new Subprocessor without unreasonably burdening the Customer.

7.3.3 If, however, the parties are unable to reach a solution within a reasonable period (which may not exceed thirty (30) days after the Customer’s objection), the Customer may terminate the Service (in whole or in part) if:

• the Service/the Platform cannot be used by the Customer without having recourse to the contested new Subprocessor; or,
• such termination relates exclusively to that part of the Service which cannot be provided by ResultX without having recourse to the contested new Subprocessor;

and this by giving written notice to ResultX (cf. Article 15) within a reasonable period.

7.3.4 Termination of the Service within the meaning of Article 7.3.3 takes place without liability for either party (but without prejudice to the Fees incurred by the Customer prior to the suspension or termination of the Service).

8 TRANSFER OF PERSONAL DATA OUTSIDE THE EEA

8.1 The Personal Data will be processed within the European Economic Area (“EEA”).

8.2 The Customer acknowledges, however, that ResultX is entitled to transfer Personal Data to, and store it in, countries outside the EEA for the purpose of providing the Service and fulfilling its obligations under the Agreement, provided that such transfer/storage takes place in accordance with the Privacy Legislation as regards additional safeguards. In particular, any transfer of Personal Data outside the EEA by ResultX to a third party whose domicile or registered office is located in a country for which no adequacy decision of the European Commission applies shall be subject to one or more of the following safeguards approved by the EU:

• Adequacy decision of the European Commission;
• the conclusion of a data transfer agreement: with the recipient in the third country, containing the standard contractual clauses as referred to in the ‘Implementing Decision of the European Commission of 4 June 2021 (Decision (EU) 2021/914) on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council’, including the carrying out of a transfer impact assessment. Before the transfer takes place, the recipient of the Personal Data/Subprocessor of ResultX in the third country must guarantee to ResultX that an adequate level of privacy compliance is ensured in that third country;
• binding corporate rules: As is the case for standard contractual clauses, the recipient of Personal Data/Subprocessor of ResultX in the third country must guarantee to ResultX that an adequate level of privacy compliance is ensured in that third country; and/or,
• certification mechanisms.

8.3 If the transfer (or disclosure) of Personal Data to a third country is required pursuant to EU law, the law of an EU Member State or the law of the United Kingdom to which ResultX is subject, ResultX shall inform the Customer of that legal obligation before the transfer/disclosure, unless that legislation prohibits such communication on important grounds of public interest.

9 CONFIDENTIALITY

9.1 ResultX shall treat the Personal Data confidentially and shall therefore not disclose or transfer any Personal Data to third parties without the prior consent of the Customer, unless such disclosure and/or communication is required by law or by a judicial or other governmental decision (of whatever nature). In that case, ResultX shall, prior to any disclosure and/or communication, inform you with full transparency about the scope and manner thereof.

9.2 ResultX shall ensure that its personnel involved in the performance of the Agreement are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have signed a written confidentiality undertaking. ResultX shall ensure that such confidentiality obligations survive the termination of the employment.

9.3 ResultX shall ensure that its access to Personal Data is limited to those members of personnel who carry out the Assignment in accordance with this Policy.

9.4 The Customer acknowledges that the login credentials are strictly personal and shall ensure that this information is not shared with third parties.

10 NOTIFICATION

10.1 Notification. ResultX shall, to the best of its ability, inform the Customer as soon as reasonably possible when it:

10.1.1 receives a request for information, a subpoena or a request for inspection or audit from a competent public authority (incl. supervisory authority) with respect to the Processing of the Personal Data;

10.1.2 receives a request from a Data Subject invoking his privacy rights under the Privacy Legislation (cf. Article 10.3);

10.1.3 intends to disclose Personal Data to a competent public authority (incl. supervisory authority); or,

10.1.4 establishes or reasonably suspects that a personal data breach has occurred.

10.2 Personal Data Breach. In the event of a personal data breach, ResultX shall:

10.2.1 notify the Customer without undue delay after becoming aware of that breach and, to the extent possible, provide the information as required by the Privacy Legislation (e.g. Article 33.3 GDPR). At the Customer’s request, ResultX shall, to the extent possible, provide assistance with regard to the Customer’s notification obligation under the Privacy Legislation;

10.2.2 as soon as reasonably possible take appropriate corrective measures in order to put an end to the breach (if it arose under its responsibility) and to prevent and/or limit future breaches.

10.3 Rights of Data Subjects

10.3.1 ResultX shall inform the Customer without undue delay if it receives a request from a Data Subject invoking his privacy rights under the Privacy Legislation. ResultX shall not respond to such a request from a Data Subject without the prior written consent of the Customer, except to confirm that the request relates to the Customer, to which the Customer hereby consents.

10.3.2 If a Data Subject requests to exercise his/her rights, it is the responsibility of the Customer to support the Data Subject in his request. Only if the Customer is unable to correct, amend, block or delete the Personal Data (as required by the Privacy Legislation) shall ResultX assist the Customer (insofar as this is commercially reasonable).

10.3.3 Notwithstanding the foregoing, the Customer remains responsible for compliance with such requests from Data Subjects.

10.4 Data Protection Impact Assessment. Taking into account the nature of the Processing and insofar as (i) a data protection impact assessment is required under the Privacy Legislation and (ii) the required information is reasonably available to ResultX and the Customer does not otherwise have access to the said information, ResultX shall, at the request of the Customer, provide reasonable assistance to the Customer in carrying out a data protection impact assessment and any prior consultation with the competent supervisory authorities. To the extent permitted by the Privacy Legislation, the Customer is responsible for all costs arising from the assistance provided by ResultX.

11 LIABILITY

11.1 Both parties are themselves liable for all damage, claims and/or fines of third parties, competent supervisory authorities or Data Subjects which result from their own breach or non-compliance with (i) the provisions of this DPP, and (ii) the Privacy Legislation or other applicable rules concerning Personal Data. Each party shall indemnify the other party in this respect.

11.2 In the event of a breach/non-compliance as described in Article 9.1 the party in breach is liable towards the other party and must compensate the latter for all damage and costs, including reasonable attorneys’ fees, (legal) expenses and damage arising from such breach/non-compliance.

11.3 In the event of a proven breach by ResultX of its obligations under this DPP or under the Privacy Legislation, ResultX is:

• liable for the proven direct damage suffered by the Customer;
• not liable for indirect, immaterial and/or consequential damage, including (but not limited to:) loss of profit, loss of opportunity, loss of and/or damage to data, reputational damage, sanctions and/or fines, and unforeseeable damage.

11.4 The liability of ResultX towards the Customer is in any event limited to the total amount paid by the Customer to ResultX under the Agreement during the last twelve (12) months.

11.5 The provisions of this Article are without prejudice to any other liabilities as agreed in the Agreement.

12 TERM

12.1 The total term of this DPP is equal to the term of the Agreement. If no term is determined, this DPP shall remain in force as long as the Service has not been terminated.

13 RETURN AND DELETION OF PERSONAL DATA

13.1 ResultX will retain the Personal Data only for as long as this is necessary in order to provide the Service or for the term of the Agreement (cf. Article 12). The Customer accepts that ResultX may make back-ups of the Personal Data stored on the ResultX Platform.

13.2 Upon termination of the Service or the Agreement, the following applies:

• the Service and the ResultX Platform are deactivated. As from that moment, all Personal Data stored on the ResultX Platform are no longer available to the Customer;
• the Customer may, within thirty (30) days after the end of the Agreement or the Service, request the return of the Personal Data (‘export’), after which ResultX will assess whether such an export is technically possible. In any event, ResultX may determine the format of the export at its own discretion. ResultX reserves the right to charge the Customer any costs in connection with such exports;
• after the said period of thirty (30) days, the Personal Data on the ResultX Platform are deleted within one (1) month, unless applicable legislation requires the Personal Data to be retained; and,
• the Personal Data may be present on back-ups. The Personal Data are deleted as soon as the last back-up containing the Personal Data has been overwritten.

13.3 Please note: data or material that are provided or submitted by the Customer to ResultX during the use of the Service and that do not contain Personal Data may continue to be stored by ResultX after termination of the Agreement or the Service as well.

14 COMPLIANCE / INSPECTIONS

14.1 Compliance. At the Customer’s request, ResultX will provide the Customer with all information that is necessary and insofar as legally required in order to demonstrate its compliance with its obligations under this DPP.

14.2 Inspections

14.2.1 ResultX will allow the Customer (or a third party on behalf of the Customer) to carry out inspections, such as, but not limited to, an audit, and will provide the necessary assistance for this purpose.

14.2.2 The Customer will limit its initiatives to carry out an inspection to a maximum of once per year. The Customer must notify ResultX at least thirty (30) business days in advance. The carrying out of inspections may under no circumstances cause any delay in the performance of the Service by ResultX.

14.2.3 The Customer will impose sufficient confidentiality obligations on its (internal/external) auditors. In order to safeguard the confidentiality of other customers of ResultX, ResultX has the right to require the Customer and its auditors to sign a confidentiality agreement before the inspection starts and to limit the scope of the inspection or the Customer’s access to certain premises.

14.2.4 All inspection costs are to be borne exclusively by the Customer, except where (and to the extent that) a serious security incident / a data breach (at ResultX / under the responsibility of ResultX) or a breach of this DPP is established during the inspection.

15 NOTICE / CONTACTING RESULTX

15.1 Notices by the Customer under this DPP and/or questions or remarks relating to the provisions of this DPP must be addressed to hello@resultx.ai.

16 MISCELLANEOUS PROVISIONS

16.1 If one or more provisions of this agreement are found to be invalid, unlawful or unenforceable, in whole or in part, the remaining parts of that provision and of this agreement remain in full force and effect as if such invalid, unlawful or unenforceable provision had never been included herein. Moreover, in such a case the parties will negotiate in order to replace the invalid provision by an equivalent provision in accordance with the spirit of this agreement. If the parties do not reach agreement, the competent court may mitigate the invalid provision to what is (legally) permitted.

16.2 Derogations from, amendments to and/or additions to this Policy are only valid and binding insofar as they have been accepted in writing by both parties.

16.3 This Policy and the associated rights and obligations between the Parties may not be assigned directly or indirectly without the prior written consent of the other party.

16.4 The (repeated) failure by one party or by both parties to enforce any right or any provision of this Policy can only be regarded as a tolerance of a particular situation and does not result in the forfeiture thereof.

16.5 This Policy prevails over any other agreement between the parties.

17 GOVERNING LAW & JURISDICTION

17.1 This DPP, including the Annexes, is governed by the law and is subject to the jurisdiction clause as set out in the Agreement.

Annex I – Data Processing

1 OVERVIEW OF THE PERSONAL DATA

Data of Data Subjects – Category 1:

• Name
• Telephone number
• Age
• Home address
• Gender
• Salary
• E-mail address (personal and business)
• Diploma(s)/certificates obtained by the employee
• Number plate
• National Register number
• Bank account
• Overview of investment portfolio
• Data that are typically processed in the context of the reporting via the Platform

Data of Data Subjects – Category 2:

• Name
• E-mail address (business)
• Telephone number
• Job title
• Company name
• Data that are typically processed in the context of the reporting via the Platform

2 OVERVIEW OF THE DATA SUBJECTS

Category 1:

• Employee
• Freelancers
• Directors

Category 2:

• Supplier
• Customers
• Service provider

3 NATURE OF THE PROCESSING

• Collecting
• Consulting
• Sorting
• Comparing
• Structuring
• Linking with one another
• Altering
• Communicating
• Storing
• Matching
• Transferring
• Erasing
• Analysis by AI-algorithms

4 MEANS OF THE PROCESSING

• Via the Platform developed by ResultX

5 PURPOSE OF THE PROCESSING

The provision of the Services via the Platform to the Customer, including the possibility to generate analyses and reports.

6 TERM

For the term of the Agreement (cf. the applicable ResultX Terms of Use for the Customer). After termination of the Agreement (for whatever reason), access to the Platform is deactivated and the Personal Data are deleted or returned to the Customer as provided in Article 13.

Annex II – Security

This document contains the technical and organisational security measures that ResultX has implemented in support of its (Processing) activities, as required by the Privacy Legislation.

1 DATA PROTECTION

Sensitive data that may be used to obtain access to the platform, customer data or third-party data are encrypted both in transit and at rest (e.g. passwords, api-tokens, access tokens …).

All data in transit, both internal and external, are encrypted over the network.

2 ACCESS SECURITY

Access to data processed by the platform is secured by means of user-based and role-based access control. The customer is responsible for granting and withdrawing access to users (employees, consultants, contractors, suppliers, customers …) and for assigning the relevant roles to those users.

3 DATA STORAGE AND BACK-UP (HOW AND WHEN)

Back-ups are made daily with a retention period of 7 days. Back-ups are stored in encrypted form. Data are in addition retained in archived form to the extent provided in the article ‘Service Levels’ of the General Terms and Conditions and the applicable Product-Specific Terms. Back-ups are stored at a physical location that differs from the live data stored by the platform.

4 SYSTEM RELIABILITY AND RESILIENCE

ResultX applies the Availability Standard and the other service levels as set out in the General Terms and Conditions. ResultX is certified in accordance with ISO/IEC 27001.

Annex III – Subprocessors

Last updated: June 2024

ResultX engages the following Subprocessors in support of the provision of the Service as described in the Agreement: