Free first conversation
The estate, the data in it and what worries you.
East Flanders · IT consultancy since 2008
Who decides
Who decides
what the datais for?
That single question fixes who is controller and who is processor, and it is not settled by what a contract calls you. A processor that starts deciding purposes becomes a controller, with everything that follows. So we put it in writing before we touch anything.
- 2008since
- 72 hto notify
- 24 hearly warning
- NIS2in scope
What we do
Four services, one question first
Who determines the purposes of the processing gets settled in writing before any access is granted.
IT consultancy
Advising on systems, infrastructure and how the two should fit the business.
See the programManaged systems
Running and maintaining computer facilities on your behalf.
See the programRoles and agreements
Getting the controller and processor roles, and the paperwork, right.
See the programNIS2 readiness
Preparing for the network and information security obligations in force since October 2024.
See the program
How it works
How we work
Establish who determines the purposes of the processing, record the roles in a written agreement before any access is granted, declare every sub-processor, and report a breach to the client immediately because their deadline starts when we tell them.
Roles settled in writing
Controller and processor, as things actually are.
Agreement before access
Signed first, then credentials.
Run, tested and reported
Restores proven, incidents reported at once.
Working together
Ways to work with us
Quoted per engagement or per month in euro after a first conversation. A processing agreement is in place before any access.
A review
Your estate, looked at properly and written up.
- Inventory of what exists
- Risks ordered, not listed
- Options with costs
- Decisions left with you
- Written findings
Managed systems
We run it, you remain the controller.
- Processing agreement before access
- Sub-processors declared and approved
- Backups with tested restores
- Breach reported to you at once
- Monthly, no long tie-in
What we will not do
Said up front, because roles decide liability.
- No deciding purposes for you
- No undeclared sub-processors
- No notifying a regulator unmandated
- No claim of total security
- No legal advice
Every engagement is quoted after a free consultation. No subscription.
How we work
Your systems, your data, your decisions
NOWHOW SRL was created on 8 April 2008 and is registered with the Crossroads Bank for Enterprises under number 0897.434.892, with its registered office at 9 Goudvinkenlaan in Nazareth-De Pinte, East Flanders. The work is computer consultancy, the management of computer facilities, head office activities and other information services.
Running somebody else's systems means handling the personal data inside them, and the first thing to be precise about is who is responsible for what. The client remains the controller because the client determines what the data is for. We act as processor. Neither of us picks that: a processor which starts determining purposes and means is treated as a controller for that processing, with every obligation that brings, so the written agreement exists to keep the roles where both parties believe they are. The same precision applies when something goes wrong. A controller has seventy-two hours to notify the supervisory authority, while a processor must inform the controller without undue delay, which is why we tell you the moment we know rather than when we have finished investigating. Since October 2024 the Belgian network and information security rules have also covered providers of managed services, with an early warning due within twenty-four hours and accountability resting on the management body, which is one thing a client genuinely cannot delegate to a supplier.
Frequently asked
The questions we get most
Are you the controller or the processor of our data?
The processor, in almost every case, because you determine what the data is for and we act on your instructions. The important part is that neither of us simply chooses this. If a processor starts deciding the purposes and means of a processing operation, it is treated as a controller for that processing and carries a controller's obligations. That is why we write down what is actually happening rather than relying on a label in a contract.
Why does a processing agreement have to come before access?
Because processing on behalf of a client has to be governed by a written agreement covering the subject matter, the duration, the nature and purpose, the types of data and the categories of people concerned. Granting access first and papering it later means a period during which the arrangement does not meet the requirement. It also tends to be the period nobody documents properly afterwards.
If we have a breach, who tells the authority?
You do, as controller, and the deadline is seventy-two hours from becoming aware. Our obligation is to notify you without undue delay, so we tell you immediately rather than waiting until we understand the full picture, because your clock starts when we tell you. We will not notify a supervisory authority on your behalf unless you have expressly mandated us to, since that is your statement to make, not ours.
Does NIS2 apply to us, or only to you?
Possibly both, and they are separate questions. The Belgian rules in force since October 2024 expressly cover providers of managed services, which is why they bear on us. Whether your own organisation is in scope depends on your sector and size. What cannot be outsourced either way is the governance: the management body has to approve and supervise the risk-management measures and can be liable for failing to, so that part sits with your board.
Can you guarantee our systems will not be breached?
No, and that is the honest answer rather than a disclaimer. No system is secure against all attack and anyone promising otherwise is selling something. What we can do is put proportionate measures in place, document them, declare every sub-processor in the chain, and make sure a restore has actually been tested rather than assumed. A backup nobody has restored from is a hope, not a backup.
What happens to our data when we leave?
It is returned or deleted at your choice, not ours, and that is set out in the agreement before we start rather than negotiated at the end. We would rather settle the exit while everyone is still on good terms. The same goes for an inventory of what we hold and where, which is kept current so that leaving is an administrative task rather than an archaeology project.
Want your systems looked at properly?
A free first conversation, with no obligation.