Data Processing Agreement for the Matisse Platform

Labmatisse B.V. | Version 2.1 | Effective as of November 9th, 2026

Introduction

Labmatisse B.V. operates the Matisse platform, a Software-as-a-Service application that allows dental laboratories, dental practices and other professional users to upload photographs of teeth to a private, encrypted and secure database and to generate reference codes for the production of a crown, tooth or part thereof. Use of that platform is governed by the Terms and Conditions for the Matisse Platform.

In providing the Matisse platform, Labmatisse processes personal data on behalf of its customer. Under the General Data Protection Regulation, the customer is the controller for that processing and Labmatisse is the processor. Article 28 of that regulation requires the controller and the processor to record their respective rights and obligations in writing. This data processing agreement does so. It forms an integral part of the Terms and Conditions for the Matisse Platform and applies to all processing of personal data that Labmatisse carries out on the customer’s behalf. It is accepted together with those terms and conditions on registration.

Definitions

Terms used in this DPA that are defined in the GDPR have the meaning given to them in the GDPR. This applies in particular to “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority”. In addition, the following capitalized terms have the meanings set out below.

Agreement	the agreement between Labmatisse and the Customer as defined in the Terms.
Controller	the Customer within the meaning of the Terms, being the party that determines the purposes and means of the Processing of Personal Data carried out by Labmatisse under this DPA.
DPA	this data processing agreement, including its appendices.
GDPR	Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Labmatisse	Labmatisse B.V., a private limited liability company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce under number 74032682.
Personal Data	the personal data that Labmatisse Processes on behalf of the Controller under this DPA, as specified in Appendix 1 to this DPA.
Platform	the Matisse platform as defined in the Terms.
Sub-processor	a third party engaged by Labmatisse to Process Personal Data on behalf of the Controller.
Terms	the Terms and Conditions accessible at Terms and Conditions, of which this DPA forms an integral part.

Scope, roles and instructions

This DPA applies to all Processing of Personal Data carried out by Labmatisse on behalf of the Controller in connection with the Platform.
In respect of that Processing, the Controller acts as controller and Labmatisse acts as processor within the meaning of Article 4 GDPR. Where the Controller itself acts as processor for a dental practice or other controller, Labmatisse acts as Sub-processor and this DPA applies accordingly.
The Controller determines the purposes and means of the Processing. Labmatisse does not determine the purposes or means of the Processing and does not Process Personal Data for its own purposes.
Labmatisse Processes Personal Data solely on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless Labmatisse is required to Process by Union or Member State law to which it is subject. In that case Labmatisse shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.
The Terms, this DPA and its appendices together constitute the Controller’s complete documented instructions at the date this DPA takes effect. The Controller may give further instructions in writing.
Labmatisse shall inform the Controller without delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law. Labmatisse may suspend performance of that instruction until the Controller confirms or amends it.
This DPA is accepted electronically together with the Terms on registration. The parties acknowledge that such acceptance constitutes a valid signature for the purposes of Article 28(9) GDPR.
This DPA does not apply to personal data that Labmatisse processes as controller in connection with the Agreement, including: (a) account, login and authentication data of the Customer and its Authorized Users; (b) subscription, billing and payment data; (c) communications between Labmatisse and the Customer or its Authorized Users, including onboarding, support and service communications; and (d) logging, usage and security data processed to secure the Platform, prevent fraud and abuse, and verify compliance with the Terms. Labmatisse processes such data as controller in accordance with its Privacy Statement, available at Privacy Statement.

Subject matter, purpose and duration of Processing

The subject matter and nature of the Processing, the purposes for which Personal Data is Processed, the categories of data subjects and of Personal Data, and the duration of the Processing are specified in Appendix 1.
Personal Data is Processed solely for the purpose of providing the Platform to the Controller, consisting of the cloud-based storage of Content, the generation of reference codes for ceramic restorations of teeth, and the security, maintenance and support of the Platform insofar as these involve Personal Data.
Labmatisse shall not Process Personal Data for any purpose other than those set out in this Clause 3, unless instructed to do so in writing by the Controller.
All Personal Data Processed on behalf of the Controller remains the property of the Controller or of the data subjects concerned.
The Processing continues for as long as Labmatisse provides the Platform to the Controller under the Terms, and ends in accordance with Clause 14.

Anonymized data

The Controller instructs Labmatisse to irreversibly anonymize Personal Data Processed on its behalf, in such a manner that the data can no longer be attributed, directly or indirectly, to an identified or identifiable natural person, nor to an identifiable Controller, clinic or patient.
Once data has been irreversibly anonymized, it no longer constitutes personal data within the meaning of the GDPR, in accordance with Recital 26 GDPR, and falls outside the scope of this DPA.
Labmatisse may use anonymized data for the purposes set out in the Terms, including the development, training, validation, testing and improvement of algorithms and artificial intelligence models, product development, research, analytics and quality assurance.
Labmatisse shall not attempt to re-identify anonymized data, whether intentionally or negligently, nor permit any third party to do so.
This Clause 4 does not grant Labmatisse any right to Process Personal Data beyond the scope of this DPA, does not affect the Controller’s role as controller, and does not result in Labmatisse acting as controller or joint controller.

General obligations of Labmatisse

Labmatisse shall comply with all applicable data protection law in respect of the Processing carried out under this DPA.
Labmatisse shall maintain a record of all categories of Processing activities carried out on behalf of the Controller, in accordance with Article 30(2) GDPR, and shall grant the Controller access to that record on request.
All obligations of Labmatisse under this DPA apply equally to any person Processing Personal Data under its authority, including its employees and contractors.
On the Controller’s first request, Labmatisse shall inform the Controller of the measures it has taken to comply with its obligations under this DPA.

Confidentiality

Labmatisse shall ensure that the persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to Personal Data is limited to those persons who need it to perform the Agreement.
Labmatisse shall keep Personal Data confidential and shall not disclose it to third parties, except where instructed by the Controller, where disclosure is necessary for the performance of the Agreement, or where Labmatisse is legally required to disclose.
This Clause 6 does not apply to data that has been irreversibly anonymized in accordance with Clause 4.

Security

Labmatisse shall implement and maintain appropriate technical and organizational measures, ensuring a level of security appropriate to the risk. These measures shall include, at a minimum, access control, encryption of data in transit and at rest, and regular security testing.
Labmatisse does not warrant that the security is effective under all circumstances. If any security measure explicitly agreed in this DPA is missing, then Labmatisse shall use best efforts to ensure a level of security appropriate to the risk taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
Controller shall only provide personal data to Labmatisse for processing if it has ensured that the required security measures have been taken.
The parties acknowledge that the technical and organizational measures described in this DPA are intended to meet the requirements of Article 32 GDPR and do not constitute a guarantee of absolute security.

Personal data breaches

Labmatisse shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Personal Data Processed on the Controller’s behalf.
The notification shall, insofar as the information is available to Labmatisse:
1. describe the nature of the personal data breach, including where possible the categories and approximate number of data subjects and of Personal Data records concerned;
2. describe the likely consequences of the personal data breach;
3. describe the measures taken or proposed to be taken by Labmatisse to address the breach, including where appropriate measures to mitigate its possible adverse effects; and
4. state the name and contact details of a contact point at Labmatisse for further information.
Where it is not possible to provide all information at once, Labmatisse shall provide it in phases without undue further delay.
The Controller is responsible for notifying the supervisory authority and, where required, communicating the breach to data subjects. Labmatisse shall not make such a notification or communication unless instructed by the Controller or legally required to do so.
Labmatisse shall document all personal data breaches and shall provide the Controller with reasonable assistance in complying with its obligations under Articles 33 and 34 GDPR.

Requests from data subjects and assistance

Taking into account the nature of the Processing, Labmatisse shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.
Where a data subject submits such a request directly to Labmatisse, Labmatisse shall not respond to the request unless instructed to do so by the Controller, and shall notify the Controller of the request without undue delay.
Labmatisse may charge its reasonable costs for assistance that goes beyond the standard functionality of the Platform.
Taking into account the nature of the Processing and the information available to it, Labmatisse shall provide the Controller with reasonable assistance in carrying out data protection impact assessments under Article 35 GDPR and in any prior consultation of the supervisory authority under Article 36 GDPR. Labmatisse may charge its reasonable costs for such assistance.

Sub-processors

The Controller grants Labmatisse general authorization to engage Sub-processors for the Processing of Personal Data. The Sub-processors engaged at the date this DPA takes effect are listed in Appendix 2.
Labmatisse shall inform the Controller of any intended addition or replacement of a Sub-processor at least fourteen (14) days before the change takes effect, by email or through notice via the Platform.
The Controller may object to the change on reasonable grounds relating to data protection within seven (7) days of being informed. The parties shall consult in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the Agreement by written notice with effect from the date on which the Sub-processor is engaged.
Labmatisse shall impose on each Sub-processor, by contract, data protection obligations that are at least equivalent to those set out in this DPA.
Labmatisse remains fully liable to the Controller for the performance of each Sub-processor’s obligations, as if Labmatisse had carried out the Processing itself.

Transfer

Labmatisse Processes Personal Data within the European Economic Area, save as provided in this Clause 11 and in Appendix 2.
Labmatisse may transfer Personal Data to a country outside the European Economic Area only where the requirements of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission or of standard contractual clauses adopted by the European Commission, supplemented where necessary by additional safeguards.
On the Controller’s request, Labmatisse shall inform the Controller of the countries in which Personal Data is Processed and of the transfer mechanism applied.

Audits

Labmatisse shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.
The Controller may audit compliance with this DPA once per calendar year, through an independent third party bound by confidentiality. The audit shall take place on at least thirty (30) days’ prior written notice, on a date and time agreed between the parties, during normal business hours, and shall be conducted so as to cause as little disruption as possible to Labmatisse’s operations.
Labmatisse shall cooperate with the audit and shall make available, within a reasonable period, all information reasonably relevant to it, including supporting data such as system logs.
Labmatisse may demonstrate compliance by means of a valid certification or an audit report issued by an independent third party. Where such a certification or report covers the Processing carried out under this DPA, the Controller shall accept it as sufficient evidence of compliance in respect of the matters it covers.
The Controller may request an additional audit where required by a supervisory authority or following a personal data breach affecting Personal Data Processed on its behalf.
The findings of the audit shall be assessed by the parties in consultation. The costs of the audit are borne by the Controller, unless the audit reveals an attributable breach of this DPA by Labmatisse, in which case the reasonable costs are borne by Labmatisse.

Liability

Liability arising under or in connection with this DPA is governed by the liability provisions of the Terms.

Deletion of Personal Data

On deletion of the Controller's account, Labmatisse shall permanently delete Personal Data Processed on the Controller's behalf from its active systems without undue delay. Backup copies and system logs may persist for a limited period in accordance with standard retention cycles, after which they are automatically overwritten or securely deleted.
The Controller instructs Labmatisse to delete all Personal Data Processed on its behalf upon termination of the Agreement. Labmatisse shall carry out that deletion without undue delay, in accordance with Clause 14.1.
Clauses 14.1 and 14.2 do not apply to the extent that Union or Member State law requires Labmatisse to retain the Personal Data.

Duration, termination and amendments

This DPA enters into force on the date the Agreement is concluded and remains in force for as long as Labmatisse Processes Personal Data on behalf of the Controller.
Amendments to this DPA are governed by the provisions of the Terms on changes to the Terms.

Governing law and jurisdiction

This DPA is governed exclusively by the laws of the Netherlands.
Any disputes arising out of or in connection with this DPA shall be submitted exclusively to the competent court of the district in which Labmatisse has its principal place of business.

Appendix 1 - Personal Data, data subjects, purposes and duration

Data subjects and Personal Data

Labmatisse Processes the categories of Personal Data and data subjects set out below, on behalf and under the instructions of the Controller, for the purposes specified in Clause 3 of this DPA.

Cloud storage of data

Data Subjects and Personal Data

Authorized Users, solely insofar as their name or user identifier is recorded in project data (for example as creator or editor of a project)
Photographs of teeth uploaded to the Platform
Generated reference codes
Project identifiers
Upload metadata (such as date and time of upload)

*Content may contain data concerning health within the meaning of Article 9 GDPR. The Controller is responsible for ensuring a valid exception under Article 9(2) GDPR applies.

Nature and purposes of Processing

Personal Data is processed solely for the purpose of:

Providing, operating, securing, and maintaining the Matisse Platform;
Storing uploaded content in a secure cloud environment;
Generating reference (colour) codes for ceramic restorations of teeth;
Ensuring platform security and technical integrity.

Retention
Personal Data is retained for the duration of the Agreement and is deleted in accordance with Clause 14 of this DPA. Controller represents and warrants that the description of Personal Data and categories of data subjects in this Appendix 1 is complete and accurate and shall indemnify and hold harmless Labmatisse for all faults and claims that may arise from a violation of this representation and warranty.

Appendix 2 - Authorized Sub-processors

The following Sub-processors are authorized for the Processing of Personal Data under this DPA.

Sub-processor	Service provided	Processing location
Amazon Web Services EMEA SARL	Cloud hosting, data storage, infrastructure and backups	European Union
Intercom, Inc.	Customer support communications, solely insofar as Content is shared by the Controller in support request	European Union and United States

Labmatisse shall keep this Appendix up to date and shall notify the Controller of any changes in accordance with the DPA.