Jeva Server data processing agreement
Draft — awaiting legal review (DECISION-029). Short data processing agreement belonging to the Jeva Server agreement. The Dutch text is binding. Version 2026-10-18.
1. Roles
You are the controller for what happens in your home: your devices, cameras and the people you add. JEVA Techniek (KvK 99865351) is the processor for the small part that runs through JEVA's server (article 2).
2. What JEVA processes, and why
| Data | Why | How long |
|---|---|---|
| IP address and time of the connection, amount of traffic | To run the encrypted passage (relay) and protect it against abuse | Only while the connection exists. No connection log is kept; short error messages are overwritten automatically |
| Encrypted content (interface, live camera images) | Passing it between your device and your server | Not stored. JEVA cannot read the content: the encryption ends on your server |
| Address of a notification (push endpoint) and the encrypted notification | Delivering the notification to Google, Apple or Microsoft (your browser's service) | The address only as a hash, as long as the notification is active. The content is not stored and cannot be read by JEVA |
JEVA processes this data only for the service and only on your instructions as set out in this agreement.
3. What JEVA does not process
No names, email addresses, passwords, device data, camera images or recordings. Those stay on your server.
4. Arrangements
- Confidentiality: anyone at JEVA working with the relay is bound to confidentiality.
- Security of processing: encrypted connections, no storage of content, access to the relay only for JEVA, remote maintenance only with your button (at most 24 hours).
- Sub-processor: JEVA's server is hosted by the hosting partner in Germany (EU) listed in the privacy policy. JEVA announces any new sub-processor in advance.
- Data breach: JEVA reports a data breach affecting the relay to you without undue delay.
- Your rights and those of data subjects: JEVA helps where reasonable. Because JEVA keeps almost nothing, most data is on your own server.
- End: when the service ends, the licence is stopped and the hashes of notification addresses are deleted. The proof of your acceptance (without name or email) is kept as long as legally required.