Legal & trust
Last updated: 21 August 2026
This model agreement applies to engagements in which Ramirez BV processes personal data on behalf of a client: the client is then the controller and Ramirez is the processor. That is the case for Downforce engagements on client data, for Hillmond files that contain personal data, and where Esmond is taken up by an educational institution or an organisation.
This agreement does not apply to students who use Esmond directly as private individuals. There, Ramirez is itself the controller and the privacy policy published on the Esmond platform applies.
Processor: Ramirez BV, Goudensterstraat 20, 9000 Ghent, Belgium, company number BE 1039.976.194.
Controller: the client that signs the engagement confirmation or the main agreement with Ramirez BV, hereinafter "the client".
This agreement forms an integral part of the main agreement. In the event of a conflict concerning the processing of personal data, this agreement prevails.
The terms personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given to them by Regulation (EU) 2016/679 (GDPR).
Ramirez processes personal data solely in order to deliver the agreed service. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. The processing lasts for as long as the main agreement is in force, extended by the period needed for return or erasure as provided in Article 12.
Ramirez processes the personal data only on documented instructions from the client, including with regard to transfers to a third country, unless a provision of Union or Belgian law requires Ramirez to process. In that case Ramirez informs the client beforehand, unless that law prohibits doing so on important grounds of public interest.
The engagement confirmation, this agreement and Annex 1 together constitute the complete instructions at the outset. Ramirez informs the client where, in its opinion, an instruction infringes the GDPR or other data protection provisions.
Ramirez does not use the client's personal data for its own purposes, for product development, or for training or tuning AI models.
Ramirez undertakes to keep the personal data confidential. Persons who have access to the data under the authority of Ramirez, including subcontractors and freelancers, are bound by contract to confidentiality. Access is granted on a least-privilege basis and only in so far as necessary for the performance of the engagement.
Ramirez takes appropriate technical and organisational measures in accordance with Article 32 GDPR. Those measures are described in Annex 2. Ramirez may change measures provided that the level of protection is not thereby lowered. Ramirez reviews these measures at least annually and after every security incident.
The client gives Ramirez general authorisation to engage sub-processors. The sub-processors engaged at the outset are listed in Annex 3.
Ramirez informs the client at least thirty calendar days in advance of the addition or replacement of a sub-processor. The client may object within that period on reasonable grounds related to data protection. If the parties do not reach agreement, the client may terminate the part of the main agreement concerned without compensation, while services already delivered remain payable.
Ramirez concludes with every sub-processor an agreement imposing the same obligations as those in this agreement, or accepts that party's processing terms in so far as they meet the requirements of Article 28(4) GDPR. Ramirez remains fully liable to the client for their performance.
Taking into account the nature of the processing and by appropriate technical and organisational measures, Ramirez assists the client in responding to requests from data subjects under Chapter III GDPR. Where a data subject approaches Ramirez directly, Ramirez does not answer that request itself but forwards it to the client without undue delay.
Ramirez provides the client with reasonable assistance in ensuring security, notifying breaches, carrying out a data protection impact assessment and, where applicable, the prior consultation of the supervisory authority, in each case taking into account the nature of the processing and the information available to Ramirez.
Ramirez notifies the client without undue delay of any personal data breach of which it becomes aware, aiming to notify within forty-eight hours. The notification describes, in so far as known, the nature of the breach, the categories and numbers concerned, the likely consequences and the measures taken or proposed. Ramirez documents every breach and its follow-up. Notification to the supervisory authority and to data subjects is made by the client.
A number of the sub-processors in Annex 3 are established in the United States or process data there. Those transfers take place on the basis of the European Commission's standard contractual clauses in accordance with Article 46(2)(c) GDPR, supplemented by the measures published by the service provider concerned and, where that party is listed under it, by the EU-US Data Privacy Framework. Ramirez does not transfer personal data to a third country beyond the cases listed in Annex 3 without prior instructions from the client.
On completion of the services Ramirez erases the personal data or returns them, at the client's choice. Existing copies are erased, unless Union or Belgian law requires storage. Encrypted backups are not searched individually: they expire in line with the backup schedule and at the latest six months after the end of the agreement, and the data they contain are no longer actively processed during that period. Ramirez confirms the erasure in writing on request.
Ramirez makes available to the client all information necessary to demonstrate compliance with Article 28 GDPR, and allows for audits, including inspections by the client or an auditor mandated by the client. Ramirez first answers a written questionnaire and provides the available documentation; an on-site inspection follows where that documentation does not answer the question. An audit is announced at least thirty calendar days in advance, takes place during office hours, does not disrupt operations unnecessarily and takes place at most once per calendar year, except following a breach or at the request of a supervisory authority. The auditor is bound by confidentiality. The costs of audits beyond the first in any year are borne by the client, unless the audit demonstrates a failure on the part of Ramirez.
The liability regime of the main agreement applies, on the understanding that Article 82 GDPR applies in full and cannot be excluded by contract as against data subjects.
This agreement runs for as long as Ramirez processes personal data for the client. Changes to the GDPR or to the guidance of the supervisory authorities that require adaptation are implemented by the parties in good faith.
This agreement is governed by Belgian law. Disputes fall within the exclusive jurisdiction of the Business Court of Ghent, Ghent division, without prejudice to the rights data subjects derive from the GDPR.
This annex is completed for each engagement in the engagement confirmation. The description below applies as the standard per service.
Special categories of personal data within the meaning of Article 9 GDPR are neither requested nor expected. The client does not supply them, unless the parties expressly agree otherwise in writing together with the additional measures that go with it.
Additional measures may be agreed per engagement and recorded in the engagement confirmation.
The following sub-processors are engaged, depending on the service taken up.
The current list is available on request via info@ramirezevaluation.com. Changes are notified in accordance with Article 7.
This agreement is entered into by signing the engagement confirmation that refers to it, or by separate signature by both parties. A client that uses its own model data processing agreement may submit it; Ramirez assesses it case by case.