Data processing agreement

1. Parties and roles

You, the person or company sending the file, are the controller. We, Stefan Wobben Advies, Chamber of Commerce 70889945, are the processor. We process personal data only on your instruction, and sending us a file is that instruction.

2. What we process, and why

Purpose: to read your figures and produce your report. Nothing else.

Categories of data: whatever is in the file you send. In a profit and loss account that is usually no personal data at all. It can include names, salaries or customer details where a payroll line or a customer list is present. Plus the email address you give us, so we can reply.

Data subjects: your employees, your customers or your suppliers, depending on what your file contains.

Duration: for as long as it takes to produce and deliver your report, and no longer than thirty days after that.

3. Our obligations

• We process only on your documented instruction, including for any transfer outside the EEA, unless the law requires otherwise, in which case we tell you first unless that law forbids it.
• Everyone with access is bound to confidentiality. In practice that is one person.
• We do not use your data for our own purposes, we do not sell it, and we do not use it to train models.
• We help you, as far as we reasonably can, to answer requests from data subjects and to meet your own obligations under Articles 32 to 36 of the GDPR.

4. Security

Uploads are encrypted in transit over HTTPS. We operate no database and no file store: your file is held in memory only long enough to be attached to one email to our own mailbox, which is protected by a strong unique password and two-factor authentication, and it is deleted from there within the period above. Access is limited to the person who writes your report.

The design is the control. A store nobody built is a store nobody can leave open.

5. Sub-processors

You give general authorisation for the following, each bound by terms no less protective than these:

• Vercel — hosting, and the function that receives your upload.
• Resend — delivery of the single email carrying your file to us.
• Our email provider — the mailbox that holds it.
• Mollie — payment, if you buy the report. Your file never reaches them.

We tell you before adding or replacing a sub-processor, and you may object; if you do and we cannot resolve it, you may stop using the service and we delete what we hold.

6. Breaches

If personal data we hold for you is breached, we tell you without undue delay and in any case within 24 hours of becoming aware, with what we know and what we are doing about it, so that you can meet your own 72-hour deadline.

7. Deletion and return

Ask and we delete, at any time, without waiting for the thirty days. There is one place to delete it from, so this takes minutes rather than a project. On request we confirm in writing that it is done. Invoice records are kept for seven years because Dutch tax law requires it; they contain your email address and what you paid, not your file.

8. Audit

You may ask us to demonstrate compliance with this agreement, and we answer in writing. If that is not enough for your own regulator, an audit can be arranged once a year at your cost, at a reasonable time and without disrupting the service.

9. Transfers

Our suppliers are established in or operate under the EU framework, and where a transfer outside the EEA occurs it is covered by the European Commission's Standard Contractual Clauses through our agreements with them.

10. Law

Dutch law applies, and disputes go to the competent court in the Netherlands. Where this agreement and the terms disagree about personal data, this agreement wins.