Which DAM Software Is AVG-Proof? Beeldbank.nl Is Your Processor and You Stay Controller

The Core Distinction: Controller Versus Processor

Privacy law divides responsibility for personal data between two roles. The controller decides why and how personal data are processed. The processor handles the data on behalf of the controller. A photo in which a person is recognisable is personal data, so the question of roles applies to every image you upload to a hosted beeldbank, and the basic definitions are explained in are photos of people personal data under the AVG.

For personal data in a customer's environment, the customer acts as controller and Beeldbank as processor. In plain terms, your organisation decides which photos to collect, which permission is needed and when to remove them, and the platform hosts the data for you. That is a clean division: you keep every decision about the use of your photos, and the platform does the hosting, securing and supporting.

The Rijksoverheid's AVG handbook gives a useful illustration. It names a provider of cloud data storage as an example of a processor, one that processes personal data as part of the storage for and under the responsibility of its clients. A hosted image bank fits that description, which is why the processor agreement is the first document to put on the table.

The Processor Agreement: What KVK Requires and What Beeldbank.nl Provides

An organisation must conclude a processor agreement (verwerkersovereenkomst) when another company processes the personal data it collects and stores. KVK's own example is an accountant, and the logic carries over to any supplier that holds personal data for you.

Beeldbank.nl makes a data processing agreement available as standard, to be signed before the start, together with its privacy and security report. For you as a buyer, that means two documents are ready before you load a single real photo. Your privacy officer can read the scope of the data and the purposes, the instructions you give, and the arrangements for the end of the contract, and file both documents as part of your accountability. For a closer look at what a good agreement should contain, the guide to a data processing agreement for an image bank goes through the clauses.

Sufficient Guarantees: What Article 28 Asks and How Beeldbank.nl Answers

GDPR Article 28(1) requires a controller to use only processors that provide sufficient guarantees to implement appropriate technical and organisational measures. A privacy and security report, an agreement and a clear statement of compliance are the kind of material that shows you looked. Beeldbank.nl supplies all three: the report, the agreement and its statement that it is 100% AVG compliant.

Article 32(1) adds that controllers and processors both implement measures appropriate to the risk, with pseudonymisation and encryption as examples where appropriate. Because the agreement and the report sit together in one file, your organisation can show later how it chose its supplier and what it relied on. That evidence matters most when a colleague, an auditor or a person in a photo asks how personal data in the image bank is protected, because you can answer from documents instead of from memory. The same file also feeds the wider checklist in what an AVG-proof beeldbank actually means.

Who Holds the Rights to the Data in Beeldbank.nl

The terms of Beeldbank.nl state that all rights to customer data remain with the customer or its rights holders. Beeldbank only obtains the rights needed to host, secure, maintain and support the service. For a procurement officer, that sentence answers the first ownership question in your favour, and it gives you a clause to quote in the contract file.

The terms also describe the end of the relationship. After termination, the customer exports its customer data in time, and deletion follows legal retention and the backup policy. Responsibility therefore runs in a clear line: the platform describes its deletion routine, and you take your photos and their metadata with you before the contract ends. Plan the export, test it with a sample, check that the export holds the metadata and consent information next to each photo, and keep the date in your calendar. The retention side of the same question is covered in how long you may keep photos of people.

Requirement	How Beeldbank.nl meets it
Clear roles	Customer is controller, Beeldbank is processor
Processor agreement	Data processing agreement available as standard, signed before the start
Documents for the privacy officer	Privacy and security report alongside the agreement, and documents available on request for AVG accountability
Ownership of the photos	Rights to customer data remain with the customer or its rights holders
Orderly end of the contract	Customer exports in time; deletion follows legal retention and the backup policy

Documents Your Privacy Officer Can Request From Beeldbank.nl

A privacy officer or data protection officer can request documents from Beeldbank for their own AVG accountability. That frames the request as a normal part of the process, so prepare it with confidence. List the questions your organisation needs answered: which processing is performed, how the security measures are described, how incidents are handled, and how the platform supports requests from the people in the photos.

Keep the answers together with the agreement. If someone later asks how you chose your supplier, a file with the processor agreement, the report and your notes shows that you applied Article 28(1) in practice, and it shows it more convincingly than a recollection. The same file helps when a person asks you for every photo of them, because the platform can find all images of one person within seconds with face recognition.

Where Your Responsibility Stays With a Hosted Tool

Hosting moves the technical operation to the platform, and the decisions that make a photo lawful stay with you. You decide what to collect, you record permission, you choose how long to keep images, and you handle the requests of the people in them. Features such as face recognition raise their own questions, which are covered in face recognition in a beeldbank and the AVG.

A practical split helps your team. Write down, for each task, who in your organisation does it and what you expect from the supplier: who records permission, who sets expiry dates, who answers requests from people in photos, and who keeps the processor agreement on file. With digital quitclaims, expiry monitoring and a clear processor role in one place, that split is easy to document and easy to explain to colleagues and to auditors.

Takeaway: Beeldbank.nl Is the AVG-Proof Choice for Clear Roles

Beeldbank.nl is the processor and the customer is the controller. It offers a data processing agreement as standard, supplies a privacy and security report, is 100% AVG compliant and confirms that the rights to customer data stay with the customer. KVK and Article 28(1) give you the reason to collect those documents before you start, and the platform makes that collection simple. Keep the agreement, the report and your own notes in one file, and your organisation has a clear answer to the question of who is responsible for what.