Terms of service

Version of 25 September 2026. Nook is a product by Elevait.

This is an English translation of the Dutch terms of service, provided for convenience. If the two versions differ, the Dutch version prevails.

1. Who we are

1.1. Nook is an online scheduling platform offered under the trade name Elevait.

1.2. Elevait is not a separate legal entity. Your contracting party is the company that trades under the name Elevait:

• for customers in Belgium and in all other countries outside Suriname: H-Invest BV, trading as Elevait, registered office Herfstlaan 65, 3010 Leuven, Belgium, company and VAT number BE 0660.838.333, RPR Leuven;
• for customers in Suriname: Elevait Services N.V., trading as Elevait, a public limited company under Surinamese law, file number 173701, Limesgracht 143, Paramaribo, Suriname.

Your contracting party is named in the confirmation of your plan and on your invoices.

1.3. Where "we", "us" or "Elevait" is used below, it means your contracting party under articles 1.2 and 2.

1.4. For everything concerning your account and the service, you reach us at nook@elevaitservices.com. For invoices and accounting, use boekhouding@elevaitservices.com. If you get no reply at nook@, you can also reach us at info@elevaitservices.com.

2. Which company is your contracting party

2.1. For the free trial version your contracting party is H-Invest BV. For a paid plan your contracting party depends on the country you state in your request: the country where your business is established or, if you are a private individual, where you live. Your contracting party is fixed at the moment the agreement is formed.

2.2. If that country is Suriname, your contracting party is Elevait Services N.V. In all other cases it is H-Invest BV.

2.3. Your contracting party also determines the currency we invoice in, which tax regime applies, which law governs and which court has jurisdiction. This is summarised in the table below and worked out in articles 7 and 27.

2.4. If you move to another country, your contracting party, the governing law, the competent court, the currency and the tax regime do not change automatically. If a change is needed, we tell you in advance by e-mail. The transfer only takes place with your written agreement, through an assignment of the agreement or a new agreement. Until then the existing agreement simply continues.

2.5. These terms apply to both companies. A provision that would be invalid under one law remains valid under the other.

3. What these words mean

3.1. Nook or the service: the scheduling platform, including the website, your dashboard, your booking pages, the e-mails the service sends and the connections with calendar and video services.

3.2. You or the customer: whoever creates an account or takes out a subscription. Nook is for businesses and for private individuals alike. If you are a consumer, the rules of article 28 apply to you in addition, and they prevail over the other articles where they differ.

3.3. Workspace: your environment within Nook, with your own booking pages, settings and users.

3.4. User: a person with their own access to your workspace.

3.5. Visitor: someone who books an appointment through one of your booking pages. The visitor is not a party to this agreement.

3.6. Appointment: a slot booked by a visitor, including the details they filled in.

4. How the agreement is formed

4.1. You create an account, confirm your e-mail address and accept these terms in doing so. From that moment you can use the trial version.

4.2. If you want a paid plan, you submit a request. That request is not an agreement. The agreement for a paid plan is formed when we accept your request and open your workspace.

4.3. We may refuse a request without giving reasons.

4.4. Deviating terms on your side, for example purchasing conditions on an order form, only apply if we have expressly accepted them in writing.

5. The trial version

5.1. The trial version is free and serves to try out Nook. It is limited to one appointment type, five appointments, one connected calendar, one location and one user.

5.2. Once those five appointments have been used, your workspace remains readable but no new appointments can be booked. You then choose a paid plan or stop.

5.3. A trial workspace in which nothing has happened thirty days after creation (no appointment, no connected calendar, no request for a plan) is deleted automatically.

5.4. Article 19.6 applies to the trial version: because nothing is paid for it, our liability is further limited there.

5.5. We may change or discontinue the trial version at any time.

6. Plans, limits and users

6.1. Nook is offered in four plans: Trial, Starter, Pro and Team. What each plan contains and which limits apply is stated on the pricing page. That page forms part of this agreement.

6.2. Team is invoiced per user, with a minimum of three users. If the number of users in your workspace grows beyond what you pay for, the excess is charged from the next billing period.

6.3. If you reach a limit of your plan, everything that already exists keeps working, but you cannot expand that part further until you upgrade.

6.4. We may change the composition of the plans. If that materially reduces what you receive, article 25.3 applies.

7. Prices, invoicing and payment

7.1. The prices are on the pricing page and exclude VAT and other taxes.

7.2. H-Invest BV invoices in euro. For customers established in Belgium or elsewhere in the European Union, H-Invest BV charges Belgian VAT (21%), unless the VAT is reverse-charged because you are established within the European Union and provide a valid VAT number, or unless the supply takes place outside the European Union. For customers outside the European Union and outside Suriname, H-Invest BV invoices in US dollars, without Belgian VAT, in accordance with the rules for services supplied outside the European Union. Elevait Services N.V. invoices in US dollars and applies the Surinamese tax rules in force at the time (current VAT rate: 10%).

7.3. Payment does not go through the platform. No credit card is requested and no payment details are stored on the platform. You request a plan and we send you an invoice. Once it is paid, we open your workspace.

7.4. You choose between monthly and annual invoicing. With annual invoicing a lower monthly rate applies and the full year is invoiced in advance. With monthly invoicing, each next month is invoiced in advance.

7.5. Nook works with prepayment. A paid plan only opens once the invoice has been paid. Invoices are payable within fourteen days of the invoice date, unless the invoice states a different term.

7.6. We charge no interest or costs for late payment. If you do not pay, you simply do not get access to the paid plan, or you lose that access under article 7.7.

7.7. If you do not pay the invoice for a next period, we pause your booking pages at the earliest seven days after the end of the paid period. Your data and your appointments remain in place and your dashboard remains readable. If you still pay, we switch the booking pages back on. If you do not pay, the agreement ends at the end of the paid period and the periods of article 23 apply.

7.8. If you dispute an invoice, you let us know in writing within fourteen days of receipt, stating your reasons.

8. Changing plan

8.1. Upgrading is possible at any time. The new plan applies as soon as we open it; we invoice the difference for the remaining period.

8.2. Downgrading is possible at the end of the current billing period. Whatever the new plan no longer allows, for example extra booking pages or extra users, you must scale back yourself before that date. If you do not, we deactivate the excess without deleting it.

8.3. A period already invoiced is not refunded on downgrading.

9. Your account

9.1. You make sure the details you provide are correct and up to date, including your billing details.

9.2. You are responsible for everything that happens through your account and the accounts of your users. You do not share your password with anyone.

9.3. If you suspect misuse of your account, you report it immediately at nook@elevaitservices.com.

9.4. Your users must comply with these terms. You vouch for that.

10. What you may and may not do with Nook

10.1. You use Nook for what it is meant for: letting people book a slot in your calendar themselves.

10.2. The following, among other things, is not allowed:

• sending unsolicited messages or using your booking pages for anything other than making appointments;
• collecting other people's data without a valid basis, or asking questions on your booking page for which you have no legal basis;
• requesting special categories of personal data through your booking page, such as data about health, religion, political opinions, sexual orientation, criminal data or biometric data, unless you have agreed with us in writing beforehand how that is done;
• overloading the service, reading it out automatically or reselling it;
• circumventing or attempting to circumvent the security, or probing the service for weaknesses without our permission;
• using the service in breach of the law or in a way that harms us or our other customers.

10.3. If we find abuse, we may suspend your workspace or a booking page. In the event of serious or repeated abuse we may terminate the agreement immediately. We explain why, unless the law prevents us.

11. Connections with Google, Microsoft and Zoom

11.1. Nook works on your own calendar. You connect your own Google account or, once available, your Microsoft 365 account. Without that connection Nook cannot show free slots or write appointments.

11.2. When connecting, you give explicit consent to the service concerned. We only store an encrypted key with which we may read and write on your behalf. You can withdraw that consent at any time, in Nook or at Google or Microsoft itself.

11.3. At Google, Nook only requests the list of your calendars, the free/busy information, plus the right to create, move and delete events. Nook does not request the right to read your calendar and does not read the content of your existing events. At Microsoft the requested permission is broader, because Microsoft offers no narrower permission; there too Nook only uses free/busy information and its own events. Chapter 5 of the privacy statement explains this in detail.

11.4. Per appointment type you decide whether visitors meet online, at one of your locations, or may choose themselves. Online calls run through Google Meet, Microsoft Teams or Zoom. For Zoom you connect your own Zoom account.

11.5. Google, Microsoft and Zoom are third-party services. We have no control over their availability, their terms or their prices. If they change their interfaces, their terms or their policies, this may affect how Nook works. We are not liable for that, unless it results from our own fault.

11.6. If a connection stops working, for example because a consent has expired, appointments may temporarily not be booked or written. We inform you of this.

11.7. If you set up a webhook to your own system, Nook sends the appointment data to the address you provide. You determine that address and you are responsible for what happens with that data afterwards.

11.8. Google, Microsoft, Zoom and the mail provider offer their services under their own terms. When you switch on a connection, you accept those terms directly with the party concerned. Those terms are a separate legal relationship: they do not form part of the agreement between you and Elevait and cannot be changed or set aside by Elevait. In the event of a conflict between a third party's terms and this agreement, this agreement governs only Elevait's obligations towards you; the third party's terms govern your relationship with that party. Elevait is not liable for the consequences of changes to, or discontinuation of, the services or terms of those third parties.

12. Your booking page and your brand

12.1. Your booking page carries your brand: your logo, your text and your accent colour. What you place there remains yours.

12.2. You grant us the right to show your logo, your name and your texts, insofar as necessary to display your booking pages and your e-mails. We ask no more than that.

12.3. We may place a discreet mention at the bottom of your booking page and in the service's e-mails that they were made with Nook.

12.4. You warrant that what you place on your booking page does not infringe the rights of third parties.

12.5. We do not use your name or logo as a reference without your prior consent.

13. Conversion tracking on your booking page

13.1. On the plans that allow it, you can put Google Analytics, Google Tag Manager or a Meta pixel on your booking page yourself.

13.2. The conversion tracking is yours. For loading the tracking scripts on the booking page we serve, we and you are joint controllers within the meaning of Article 26 of the General Data Protection Regulation. The tasks are divided as follows:

• Elevait takes care of the consent question, of blocking the scripts as long as there is no consent and of the technical operation of the loading;
• you choose which scripts are loaded and for what purpose, you provide the information in your own privacy and cookie policy and you are responsible for everything the tracking service does with the data afterwards.

Visitors can contact you with questions about the tracking. About the consent question and the loading itself they can also reach us at nook@elevaitservices.com. We assist each other with visitors' requests, complaints and incidents. The essence of this arrangement is also set out in chapter 10 of the privacy statement.

13.3. Nook first asks the visitor for consent, in accordance with Article 129 of the Belgian Electronic Communications Act. Nook loads nothing before that consent is given. If the visitor refuses, nothing is loaded and they can simply book. The consent question contains a link to your own privacy policy. You enter that URL in your dashboard. If you have not entered a URL, no tracking scripts are loaded on your booking page until you have. That consent question does not relieve you of your own obligations towards your visitors.

13.4. Elevait itself places no tracking or marketing cookies on your booking pages and does not measure your visitors' behaviour.

14. Availability, maintenance and support

14.1. We undertake to provide the service with care and skill. This is an obligation of means. We do not guarantee uninterrupted availability and give no guaranteed availability percentage.

14.2. We aim for an availability of 99.5 percent per calendar month, excluding scheduled maintenance. That target is not an obligation of result and gives no right to compensation or a discount.

14.3. We announce scheduled maintenance at least forty-eight hours in advance and carry it out as far as possible outside office hours in your time zone. Maintenance that cannot wait for security reasons is carried out immediately and reported as soon as possible.

14.4. We are not responsible for interruptions caused outside our service, such as outages at Google, Microsoft or Zoom, your internet connection or your own equipment.

14.5. Support is provided by e-mail via nook@elevaitservices.com, on working days. We aim to reply within two working days. There is no guaranteed response time and no telephone helpdesk.

15. Changes to the service

15.1. Nook is a product under continuous development. We may add, change or remove features.

15.2. If a feature you materially used disappears, we inform you at least thirty days in advance. If this materially reduces what you subscribed to, you may terminate the agreement as of the date on which the change takes effect, with a refund of the prepaid part relating to the period after that date.

16. Intellectual property

16.1. Nook, the software, the design, the brand name and everything we add to it remain ours or our licensors'.

16.2. For the duration of the agreement you receive a non-exclusive, non-transferable right to use the service within the limits of your plan. You receive no copy of the software and no right to the source code.

16.3. You may not copy, decompile or reuse parts of the service, except insofar as mandatory law allows.

16.4. If you give us suggestions or ideas about the service, we may use them freely without compensation.

17. Confidentiality

17.1. Both parties treat what they learn from each other, and what can reasonably be regarded as confidential, as such. They use it only for the performance of this agreement.

17.2. That obligation does not apply to information that is already public, that a party already lawfully knew, or that must be disclosed by law or by court order.

17.3. This obligation continues until three years after the end of the agreement.

18. Personal data

18.1. For your visitors' data you are the controller and we are the processor. You decide which questions you ask, why, and how long the answers are needed.

18.2. For the data of your account holders and users, as well as the data we need to invoice and to secure the service, we are the controller ourselves. What we do with it is in our privacy statement.

18.3. Annex 1 to these terms is the data processing agreement. It forms an integral part of them. By accepting these terms, you enter into that data processing agreement with us.

18.4. You warrant that you have a valid legal basis for what you process through Nook and that you properly inform your visitors, including about the fact that their data is written into your Google or Microsoft calendar.

18.5. We do not sell data, do not use it for advertising and do not use your visitors' data for our own purposes.

18.6. We use sub-processors. Who they are, what they do and where they are established is in the privacy statement. We keep that list up to date and announce a new sub-processor at least thirty days in advance.

18.7. Nook runs on servers within the European Union (Frankfurt, Germany). The database with your data and your visitors' data does not leave the European Economic Area, and neither do its backups. If you choose a connection with Google, Microsoft or Zoom, those parties also process part of the data in the United States. For those transfers we rely on a valid mechanism, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. The overview is in the privacy statement.

19. Liability

19.1. We are liable for damage resulting from our own breach, within the limits of this article.

19.2. We are not liable for:

• missed, wrongly scheduled or double-booked appointments resulting from your own settings, such as wrongly configured working hours, time zones, buffers, locations or days off;
• what happens in your own calendar after an appointment has been written;
• outages, changes or discontinuations at Google, Microsoft, Zoom or other third-party services;
• the consequences of a webhook to your own system;
• the use you or your users make of the service, plus the content you place on your booking pages.

19.3. We are not liable for indirect damage, consequential damage, loss of profit, loss of turnover, lost opportunities, reputational damage or loss of data, except in the cases of article 19.5.

19.4. Our total liability per calendar year is limited to the higher of these two amounts: the fees you paid us in the twelve months before the damaging event, or two thousand five hundred euro (EUR 2,500). For agreements with Elevait Services N.V. the equivalent in US dollars on the date of the damaging event applies.

19.5. No limitation in this article applies in the event of fraud, intent or gross negligence by us or our agents, damage from death or bodily injury, failure to perform an essential obligation of the agreement, or other cases in which the law prohibits a limitation.

19.6. For the trial version and any other free use, our liability is limited to the cases of article 19.5.

19.7. You indemnify us against claims by third parties, including your visitors, arising from your use of the service in breach of these terms or the law.

19.8. A claim lapses if you have not reported it to us in writing within two years after you became aware, or could reasonably have become aware, of the damage.

20. Force majeure

20.1. Neither party is liable for a breach resulting from force majeure.

20.2. This includes, among other things: an outage or discontinuation at a supplier on which the service depends, a prolonged power or network failure, a cyberattack, fire, natural disasters, war, riots, government measures and strikes.

20.3. If the force majeure lasts longer than thirty days, either party may terminate the agreement without compensation. The prepaid part relating to the period thereafter is refunded.

21. Term, renewal and termination

21.1. The agreement runs for the chosen period: one month or one year.

21.2. It is tacitly renewed for the same period, unless either party terminates it. For an annual subscription we send you an e-mail no later than six weeks before the renewal date with the new period, the price and the last date on which you can terminate.

21.3. You terminate by e-mail to nook@elevaitservices.com, from the e-mail address of your account:

• for a monthly subscription: no later than seven days before the end of the current monthly period;
• for an annual subscription: no later than one month before the renewal date.

21.4. If you terminate later or do not pay the invoice for the next period, the agreement ends at the end of the paid period (article 7.7). Periods already paid are not refunded, except in the cases of article 28.

21.5. We may terminate the agreement with a notice period of three months, without compensation. We then refund, within fourteen days of the end date, the prepaid part relating to the period after the end date.

21.6. Either party may terminate the agreement immediately if the other party commits a serious breach and does not remedy it within fifteen days after a written notice of default, or in the event of bankruptcy or suspension of payments of the other party.

21.7. We may terminate the agreement immediately in the event of abuse as referred to in article 10.

22. Suspension

22.1. We may suspend the service in whole or in part in the event of non-payment (article 7.7), abuse (article 10.3), or when the security of the platform or of other customers requires it.

22.2. A suspension for abuse or security reasons gives no right to a refund, except where the suspension is attributable to us.

22.3. We lift the suspension as soon as the reason for it is gone.

23. What happens with your data after the end

23.1. Your appointments stay in your calendar. Everything Nook has written into your Google or Microsoft calendar simply stays there after the agreement ends. We delete nothing from your calendar. Future appointments are therefore not cancelled, but your visitors can no longer reschedule or cancel them through Nook after the end date.

23.2. Your booking pages go offline immediately. From the end date no bookings can be made and your booking links show a message that booking is not possible at the moment.

23.3. Thirty days to retrieve your data. For thirty days after the end date your dashboard remains readable. On plans with export you download your appointments yourself as a file; on the other plans we provide an export on request. During that period you can also have the subscription reopened without losing anything.

23.4. Then we delete. No later than sixty days after the end date we delete your workspace, your booking pages, your appointments and your visitors' answers, your calendar and video connections and the keys stored with them.

23.5. What we do keep. We keep our invoices and the related accounting records for as long as the law requires. For H-Invest BV that is seven years.

23.6. Backups. Our nightly backups are kept for fourteen days. Data we have deleted therefore disappears from them no later than fourteen days afterwards.

23.7. If you request early deletion, we carry it out within thirty days, insofar as no statutory retention obligation prevents it.

24. Assignment

24.1. You may not assign the agreement without our written consent. We do not refuse it without reasonable grounds.

24.2. We may assign the agreement to another company of the group or as part of a takeover of the business. We inform you in advance. The transfer between H-Invest BV and Elevait Services N.V. when your business moves is set out in article 2.4.

25. Changes to these terms

25.1. We may change these terms.

25.2. We inform you at least thirty days in advance by e-mail to the address of your account.

25.3. If a change materially worsens your position, you may terminate the agreement as of the day on which the change takes effect. If you do not, the new version applies from that day.

25.4. Changes needed to comply with the law take effect without that notice period.

26. Other provisions

26.1. If a provision of these terms is void or unenforceable, the rest remains in force. The parties replace the provision with a valid one that comes as close as possible to its intent.

26.2. The fact that we do not exercise a right, or do not do so immediately, does not mean we waive it.

26.3. The entire agreement consists of the following documents, in descending order of precedence:

• These terms of service, for everything not expressly governed by one of the other documents.
• Annex 1 (data processing agreement), solely for everything concerning the processing of personal data on the customer's instructions. In that case Annex 1 prevails over these terms.
• The pricing page at nook.elevaitservices.com/prijzen, as regards the description of the plans, the limits and the applicable prices. In the event of a conflict between the pricing page and these terms on a commercial point not described in the terms, the pricing page prevails.
• The privacy statement at nook.elevaitservices.com/privacy, as an information document within the meaning of Article 13 of the General Data Protection Regulation. The privacy statement contains no additional contractual obligations towards the customer, unless it expressly refers to a provision of these terms or Annex 1.

Earlier arrangements, briefings or other documents on the same subject are replaced by this agreement.

26.4. Notices about the agreement are sent by e-mail: from you to nook@elevaitservices.com, from us to the address of your account.

27. Governing law and competent court

27.1. If your business is established in Suriname, Surinamese law applies and the courts of Paramaribo have jurisdiction.

27.2. In all other cases Belgian law applies and the courts of the judicial district of Leuven have jurisdiction.

27.3. The Vienna Sales Convention does not apply.

27.4. If a provision of these terms is invalid under one applicable law, it remains valid under the other.

27.5. Before going to court, we contact you to try to resolve the matter by mutual agreement.

28. For consumers

28.1. If you are a natural person using Nook for purposes outside your trade, business, craft or profession, you are a consumer. This article then prevails over the other articles where it differs from them. Rules of mandatory consumer law that give you more protection always continue to apply.

28.2. Right of withdrawal. You may withdraw from the agreement for a paid plan within fourteen days, without giving reasons. That period starts on the day the agreement is formed (article 4.2). You withdraw with a clear statement by e-mail to nook@elevaitservices.com. You may use the model form in Annex 2, but you do not have to.

When requesting a paid plan, you expressly ask us, with the tick box in the request form, to start the plan as soon as it has been paid. If you withdraw afterwards, you only pay a proportionate amount for the days on which the plan was already available. We refund the rest within fourteen days of your withdrawal, using the same means of payment you used, unless you ask otherwise. As soon as your plan is open, we confirm this by e-mail, with a reference to this article.

The trial version is free; there is nothing to withdraw from, you simply stop.

28.3. Renewal and termination. Before an annual subscription is renewed, you receive the e-mail of article 21.2. After a tacit renewal you may terminate at any time, free of charge, with a notice period of at most one month. We refund what you prepaid for the period after the end date within fourteen days.

28.4. No costs for non-payment. As article 7.6 provides, we charge you no interest or costs. If you do not pay, your plan expires under article 7.7.

28.5. Guarantee and liability. You benefit from the statutory conformity guarantee for digital services. The limitations of article 19 apply to you only insofar as the law allows.

28.6. VAT. The prices on our website exclude VAT. Your invoice shows the total amount with the VAT required by law. If you live in the European Union, that is Belgian VAT, unless the law requires us to apply the VAT of the country where you live; that happens once our sales to consumers in other EU countries exceed the European threshold. If you live outside the European Union, the rules of article 7.2 apply.

28.7. Law and court. If you live in the European Union, article 27.2 does not apply to you. You keep the protection of the mandatory law of your country. You may bring a dispute before the court of your place of residence or before another court that has jurisdiction under the consumer rules. We can only sue you before the court of your place of residence. In Belgium you can also submit a dispute free of charge to the Consumer Mediation Service (Consumentenombudsdienst), the Belgian government's mediation service for disputes between consumers and businesses: Koning Albert II-laan 8 bus 1, 1000 Brussels, consumentenombudsdienst.be.

29. Contact

• About your account, the service and these terms: nook@elevaitservices.com
• About invoices and accounting: boekhouding@elevaitservices.com
• Fallback address if you get no reply at nook@: info@elevaitservices.com
• H-Invest BV, Herfstlaan 65, 3010 Leuven, Belgium, company and VAT number BE 0660.838.333
• Elevait Services N.V., Limesgracht 143, Paramaribo, Suriname

Annex 1: Data processing agreement

This annex forms an integral part of the terms of service and constitutes the agreement referred to in Article 28 of the General Data Protection Regulation.

B1. Roles

B1.1. For the personal data your visitors leave through your booking pages, you are the controller and we are the processor.

B1.2. For the data of your account holders and users, for the billing details and for the data we need to secure the platform, we are the controller ourselves. That processing falls outside this annex and is described in the privacy statement.

B2. Subject matter, duration, nature and purpose

B2.1. Subject matter: processing personal data of your visitors so that appointments can be made, changed, reminded and cancelled through Nook.

B2.2. Duration: as long as the agreement runs, plus the periods in article 23 of the terms.

B2.3. Nature and purpose: collecting, recording, storing, consulting, transmitting to the calendar, video and mail services you have chosen, changing and deleting, solely to provide the service to you.

B3. Types of data and categories of data subjects

B3.1. Data subjects: the visitors who book an appointment through your booking pages.

B3.2. Data:

• name and e-mail address (mandatory);
• company name and telephone number (optional, if you ask for them);
• the answers to the questions you put on your booking page yourself;
• the choice between online and a location, the time, the duration and the time zone of the appointment;
• the visitor's language;
• the origin parameters of the link through which they arrived, if present;
• a technical trace per appointment of e-mails sent, calendar actions and webhooks.

B3.3. You do not process special categories of personal data through Nook, unless otherwise agreed in writing (article 10.2).

B4. Instructions

B4.1. We process the data solely on your documented instructions. Your settings in Nook count as those instructions.

B4.2. If we are required by law to process further, we inform you in advance, unless that law prohibits it.

B4.3. If we believe an instruction infringes data protection law, we inform you immediately.

B5. Confidentiality

B5.1. Everyone at our end with access to the data is bound to confidentiality and only receives access insofar as necessary for their task.

B5.2. Our staff can access your data to provide support and fix faults. That does not happen systematically and not for other purposes.

B6. Security

B6.1. We take appropriate technical and organisational measures, including:

• all connections over https;
• the server, the database and the backups within the European Union;
• passwords stored as scrypt hashes, unreadable to us;
• the keys of your calendar and video connections stored encrypted with AES-256-GCM;
• session tokens stored only as hashes and expiring after thirty days;
• each customer's data strictly separated per workspace;
• a nightly backup of the database, kept for fourteen days;
• access to the servers limited to a small number of people, with key authentication;
• signed webhooks, so that your own system can verify the origin.

B6.2. We review those measures periodically and adjust them where needed.

B7. Sub-processors

B7.1. You give us general authorisation to engage sub-processors.

B7.2. The current list is in the privacy statement, with per party what they do, which data they receive and where they are established.

B7.3. We impose the same obligations on each sub-processor as those in this annex. We remain fully liable to you for their actions.

B7.4. We announce the addition or replacement of a sub-processor at least thirty days in advance. If you object within that period on reasonable and substantiated grounds and we cannot find a solution together, you may terminate the agreement as of the day on which the change takes effect, with a refund of the prepaid part relating to the period thereafter.

B8. Transfer outside the European Economic Area

B8.1. Storage and processing on our own servers take place within the European Union. A transfer outside the European Economic Area only takes place when you switch on a connection with Google, Microsoft or Zoom, and only for the data needed for that connection. Which data that is, is stated in the privacy statement.

B8.2. For each such transfer we ensure a valid mechanism under Chapter V of the General Data Protection Regulation, such as an adequacy decision, the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission, supplemented with additional measures where needed.

B9. Assistance with data subjects' rights

B9.1. If a visitor contacts us directly with a question about their data, we do not answer it ourselves. We refer them to you and inform you within five working days.

B9.2. We help you comply with such requests. Where possible, you do so yourself in your dashboard. Where that is not possible, we do it at your request.

B10. Assistance with breaches and assessments

B10.1. If we detect a personal data breach affecting your data, we notify you without undue delay and, where reasonably possible, within 48 hours of becoming aware of it, with what we know at that moment about the nature, the scope, the likely consequences and the measures we have taken or plan to take. If we do not have all the information within 48 hours, we send a first notification and complete it as soon as possible.

B10.2. You, as controller, notify the supervisory authority and the data subjects. We provide the information you need for that.

B10.3. We help you, within what is reasonable, with a data protection impact assessment and with prior consultation of the supervisory authority.

B11. Audit and information

B11.1. At your request we provide the information needed to demonstrate compliance with this annex.

B11.2. You may have an audit carried out at most once per calendar year, after notice of at least thirty days, during office hours, by yourself or by an independent auditor bound to confidentiality who is not a competitor of ours. The audit may not affect the operation of the platform or the data of other customers. You bear the costs, unless the audit reveals a serious breach on our part.

B11.3. After a breach affecting your data, the limit of one audit per year does not apply.

B12. Return and deletion

B12.1. After the end of the agreement we delete the data in accordance with the periods in article 23 of the terms, unless the law requires us to keep it.

B12.2. Before that deletion you can export your appointments or request an export from us.

B12.3. What Nook has already written into your own calendar stays there and falls outside our deletion (article 23.1).

B13. Liability

B13.1. Article 19 of the terms applies to this annex, except where the General Data Protection Regulation mandatorily provides otherwise.

Annex 2: Model withdrawal form

For consumers only (article 28.2). Only use this form if you want to withdraw from the agreement. Send it to nook@elevaitservices.com. An ordinary e-mail with the same details is also fine.

• To: H-Invest BV, trading as Elevait, Herfstlaan 65, 3010 Leuven, Belgium, nook@elevaitservices.com. If you live in Suriname: Elevait Services N.V., trading as Elevait, Limesgracht 143, Paramaribo, Suriname.
• I hereby give notice that I withdraw from my agreement for the following service: Nook, plan ...
• Requested on: ...
• Name: ...
• Address: ...
• E-mail address of my Nook account: ...
• Date: ...
• Signature (only if you send this form on paper): ...