AmmoSuite
Request a demo
AmmoSuite
Request a demo

Data Processing Addendum (DPA) — AmmoSuite Register

Last updated: 30 October 2026

This Data Processing Addendum ("DPA") describes how AmmoSuite Register processes personal data on behalf of the customer, in the context of providing the AmmoSuite Register service (the "Service"). This DPA is Annex 1 (Data processing agreement) to the Terms and conditions. See also the Privacy notice.

1. Parties and roles

  • Customer: the organisation using the Service and determining which personal data is processed (data controller).
  • AmmoSuite, trading name of Davy Bammens (sole proprietorship), Zonhovenstraat 39, 3500 Hasselt, Belgium, company number 0699.928.640: provides the AmmoSuite Register Service (hereinafter in this DPA also "AmmoSuite Register") and processes personal data solely on the customer's instructions (processor).

2. Subject matter, nature and purpose of processing

AmmoSuite Register processes personal data to provide, maintain and secure the Service, including: account management, authentication, logging/audit, backups, incident recovery and support. AmmoSuite Register does not process data for its own independent purposes (e.g. advertising profiling).

3. Categories of personal data

Depending on use, the following data (among others) may be processed:

  • User data: name, email, role/permissions, (optionally) phone.
  • Technical and security data: IP address, session identifiers, log data, device/browser info.
  • Customer content: data entered into the register by the customer and its users (content and metadata).

4. Categories of data subjects

  • Users of the Service (staff, administrators, auditors with read-only access).
  • Individuals whose data is entered into the Service by the customer ("Customer content").

5. Duration of processing

Processing continues for the term of the subscription and/or for as long as the test environment is active. After the agreement ends, the customer can export its data for 30 days. AmmoSuite then deletes the data; it disappears from backups within 30 days, unless a legal retention obligation applies. On request, AmmoSuite confirms the deletion in writing. A customer that is legally required to keep its registers for longer is itself responsible for keeping that export.

6. Instructions and confidentiality

AmmoSuite processes personal data solely on the customer's written instructions. This agreement and the settings the customer chooses in the Service count as such instructions. If AmmoSuite considers an instruction unlawful, AmmoSuite will notify the customer. AmmoSuite does not process the data for its own purposes, except for anonymised, aggregated usage statistics in which no customer or person is identifiable.

Everyone working for AmmoSuite who has access to the personal data is bound by confidentiality. That access is only used when needed for support, maintenance or security.

7. Security measures

AmmoSuite Register takes appropriate technical and organisational measures to secure personal data, including:

  • Encrypted connections (TLS) between users and the platform.
  • Passwords are stored hashed; an account is temporarily locked after repeated failed login attempts.
  • Optional two-factor authentication via an authenticator app, with recovery codes; recommended for administrators.
  • A separate database per customer.
  • Role-based access rights, managed by the customer.
  • An activity log.
  • Private documents can only be downloaded after logging in.
  • Daily backups, kept for 30 days.
  • Hosting in a secured data centre in the EU, with database encryption and physical access control at the hosting partner.
  • The database is not publicly reachable: the application connects to it over an isolated private network. Server administration only via SSH with keys.

AmmoSuite may change these measures, provided the level of protection does not decrease.

8. Sub-processors

The customer gives AmmoSuite general authorisation to engage the following sub-processors:

  • DigitalOcean, LLC (United States): hosting of servers, databases, files and backups. The data is stored in the Amsterdam data centre (Netherlands). Transfer basis: the EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback (DigitalOcean DPA).
  • SMTP2GO (Sand Dune Mail Ltd, New Zealand): sending email from the Service, hosted in the EU. Any access from New Zealand is covered by the European Commission's adequacy decision.

Sub-processors only receive access to personal data to the extent necessary and under appropriate contractual safeguards. We announce a new or replacement sub-processor at least 30 days in advance; the customer may object with reasons within that period.

9. Assistance with data subject rights

The Service has built-in features that let the customer view, correct, export and delete data. If AmmoSuite itself receives a request from a data subject, AmmoSuite forwards it to the customer within 5 working days and does not answer it itself. AmmoSuite provides reasonable assistance with a data protection impact assessment (DPIA) or a question from the data protection authority. Assistance beyond the standard platform may be charged at the usual hourly rate.

10. Data breach / security incident

In the event of a personal data breach, AmmoSuite informs the customer without undue delay and at the latest 48 hours after AmmoSuite discovers the breach. AmmoSuite states, as far as known:

  • what happened;
  • which data and how many data subjects are affected;
  • the likely consequences;
  • the measures taken or proposed.

Missing information follows as soon as possible. The customer decides whether to notify the data protection authority and the data subjects; AmmoSuite does not do so on the customer's behalf.

11. Audit and information

On request, and at most once a year, AmmoSuite provides the customer with the information needed to demonstrate compliance with this DPA, including available audit reports of the hosting partner insofar as that partner allows. If that information is insufficient, the customer may have an audit carried out by an independent expert bound by confidentiality, with at least 30 days' notice and at the customer's cost.

12. Liability

Liability under this DPA is governed by article 13 of the Terms and conditions, without prejudice to article 82 GDPR.

13. Contact

Questions about this DPA? Contact contact@ammosuite.com.
Company number: 0699.928.640.

This English translation is provided for convenience. In case of any discrepancy, the Dutch version prevails.