Data Processing Agreement MyCompanyDesk

Article 1. Parties and order of precedence

Processor: MyCompanyDesk, trade name of the sole proprietorship of Sil van Rijnberk, Naxosdreef 161, 3562 JG Utrecht, the Netherlands, KvK (Dutch Chamber of Commerce) number 42058784. Contact: [email protected]. Hereafter: "we".

Controller: the business named in the MyCompanyDesk account, with its name, KvK number and address. Hereafter: "you". You decide why and how the personal data you put in MyCompanyDesk is processed.

This data processing agreement is part of the terms and conditions. You agree to both when you sign up ("Ik ga akkoord met de algemene voorwaarden en de verwerkersovereenkomst", meaning "I agree to the terms and conditions and the data processing agreement"). If they contradict each other on personal data, this data processing agreement prevails.

Terms such as "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the General Data Protection Regulation (GDPR).

Article 2. Subject matter, purpose, data and duration

What we do for you

We process personal data only to provide the service described in the terms and conditions:

• invoices, quotes, work orders, credit notes and payment reminders;
• customers, projects, hours, expenses, contracts and documents;
• the inbox: sending and receiving email on your own domain;
• your website, with forms, appointments and visitor statistics;
• newsletters;
• the bank connection and payment links;
• AI features, such as the assistant, reading receipts and draft texts;
• signing digitally and accepting quotes online;
• reports, VAT overviews and exports.

Whose data (data subjects)

• your customers, suppliers and other business contacts, and their contact persons;
• your team members and people you give access, such as your accountant;
• visitors to your website and people who make a request or book an appointment;
• people who sign a document or accept a quote;
• subscribers to your newsletter;
• people you email with through the inbox.

Which data

Contact details (name, email address, phone number, address), business details (KvK and VAT number), financial data (IBAN, amounts, payment status, bank transactions), the content of invoices, quotes, contracts, documents and email, signatures with time and IP address, website visit data and technical data such as IP addresses and browsers.

Special categories of personal data

MyCompanyDesk is not designed for special categories of personal data (article 9 GDPR), such as health data. Still, it can happen that you process them, for example as a healthcare provider, coach or therapist, in a note, appointment or invoice. The same measures apply as for all data (article 5). You assess whether those measures are suitable for your processing, and you do not put more of this data in MyCompanyDesk than necessary. A medical file belongs in a system built for that purpose.

Duration

The processing lasts as long as you have an account. After that, article 11 applies.

Article 3. Obligations of the processor

• Only on your instruction. We process the data only according to your instructions, as set out in this agreement, the terms and conditions and what you set in the app. This also applies to transfers outside the EEA.
• If the law requires otherwise. If the law requires us to process or disclose data, for example to a public authority, we tell you in advance, unless the law forbids this.
• Warning. If we think an instruction breaches the GDPR or another law, we tell you immediately.
• Confidentiality. Everyone who can access the data on our behalf is bound by confidentiality, also after the cooperation ends.
• Staff. An employee of MyCompanyDesk only looks into your workspace with a stated reason, for example to help you or to investigate abuse. This is logged and kept for 400 days.

Where we are responsible ourselves

For a few things we use data for our own purpose. For those, we are responsible ourselves (article 28(10) GDPR):

• We may process the content of outgoing messages to secure the platform and to prevent abuse, such as phishing, spam and fraud. In case of high risk, we do not send the message and a person reviews it.
• Statistics about the use of the app (see the privacy statement): without consent only anonymous, with consent linked to the user's account, never with the content of your administration. We do not send page titles or search terms.
• Reports of illegal content on websites that we host.

Apart from that, we do not use your data for our own purposes. We do not sell it, we do not build profiles from it and we do not train AI models with it.

Article 4. Sub-processors

You give us general authorisation to engage the sub-processors listed below.

• If a sub-processor is added or replaced, we email every workspace owner at least 14 days in advance.
• If you disagree, you can object within that period by email to [email protected]. If we cannot resolve it, you can cancel your subscription free of charge.
• With every sub-processor we have agreements that offer at least the same protection as this data processing agreement (article 28(4) GDPR).
• A few parties in the list process data for our own part of the service, such as Stripe for your subscription, or are themselves responsible for their register, such as the KVK and SIDN. We list them for completeness.
• We remain responsible to you for what our sub-processors do.

Always active

Only if you use the feature or connect something

Article 5. Security

We take appropriate technical and organisational measures (article 32 GDPR). Among other things:

• all connections encrypted with TLS;
• passwords stored only as an unreadable hash (bcrypt); access keys of integrations and secrets for two-step verification stored encrypted;
• logging in with two-step verification or a passkey is possible;
• each workspace only sees its own data;
• administrator access restricted and logged;
• a full database backup every night, encrypted with AES-256-GCM, in protected storage (Cloudflare R2); we keep 30 daily backups and 6 monthly ones;
• personal data automatically removed from error reports;
• regular security checks.

Article 6. Data breaches

If we notice a personal data breach concerning personal data that you process in MyCompanyDesk, we tell you without undue delay, at the latest within 48 hours, at the email address in your account. We tell you what happened, which data subjects and data are affected, what the likely consequences are and which measures we take or propose. If we do not yet know everything, we send the rest as soon as we know it.

We help you with a notification to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) and to data subjects. That duty to notify lies with you as the controller.

Article 7. Help with requests from data subjects

If someone asks you for access, correction, deletion or a copy of their data, you can usually do this yourself in the app:

• change or delete data in a customer, invoice or other section;
• download everything via Instellingen > Gegevens downloaden > Alles downloaden (Settings > Download data > Download everything) (ZIP with PDFs, CSV files and an XAF audit file).

If you cannot do it yourself, we help you. If a request reaches us, we forward it to you and do not answer it ourselves, unless you ask us to.

Article 8. Help with security, DPIA and consultation

We help you comply with your obligations under articles 32 to 36 GDPR, to the extent that is reasonable given what we do and what we know. This means:

• giving information about our security (article 32);
• helping with a data breach (articles 33 and 34, see article 6);
• giving information you need for a data protection impact assessment (DPIA, article 35);
• helping if you have to consult the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) beforehand (article 36).

Article 9. Information and audits

We give you all information needed to show that we comply with this agreement and article 28 GDPR. Ask for it via [email protected].

If that information is not enough, you may have an audit carried out once per calendar year, after a written request with 30 days of preparation time, and more often if there is a concrete reason, such as a data breach or a question from the supervisory authority. The auditor is bound by confidentiality and the audit must not disrupt our work unnecessarily. You pay for the audit, unless it turns out that we did not comply with this agreement on an important point.

Article 10. Transfers outside the EEA

Data only goes to a country outside the European Economic Area if there is a safeguard under chapter V of the GDPR for it: the EU-US Data Privacy Framework if the party falls under it, and otherwise the standard contractual clauses (SCC) of the European Commission. The safeguard per sub-processor is in article 4. You can check whether a US party falls under the DPF at dataprivacyframework.gov/list.

We use Google's AI (Vertex AI) only in EU regions. Cloudflare works with a worldwide network; with Cloudflare Workers AI, text can be processed outside the EEA.

Article 11. End: return and deletion

Return

You can download all your data at any time via Instellingen > Gegevens downloaden > Alles downloaden (Settings > Download data > Download everything), also after cancelling and during the cooling-off period after a request for deletion. The file is available for 7 days and is then deleted automatically. You can make one export per workspace per 24 hours.

Deletion

• If you ask to delete your account, you have a 30-day cooling-off period. You get a reminder 7 days before the end. After that we delete all data: database, files, the inbox storage and the archives of signed documents. You get a confirmation by email.
• If we end the agreement, we delete the workspace at the earliest 90 days after the end of the agreement. You get a reminder 7 days beforehand.
• We never delete an account on the free plan automatically.

Retention obligation

The statutory tax retention obligation of 7 years (article 52 of the Dutch General Tax Act, AWR) for your administration lies with you, not with us. So download your administration before you delete your account. After deletion, we only keep what we must or may keep for ourselves: our own invoices and credit notes to you and the register of refunds (amounts and numbers at Stripe, 7 years), the list against abuse of the free domain (5 years after deletion) and reports of illegal content (2 years after handling). See the privacy statement.

Backups

Deleted data can remain in an encrypted backup for up to about 7 months (30 daily and 6 monthly backups). We do not restore them, except when recovering after a disaster. In that case we delete them again immediately.

Article 12. Retention periods

Within an active account, we keep data as long as stated in the table. We keep your own administration for as long as you want.

Article 13. Liability

For liability under this data processing agreement, the same arrangement applies as in article 18 of the terms and conditions. Fines from a supervisory authority are borne by the party to whom the infringement is attributable.

Article 14. Duration, changes and disputes

• This agreement lasts as long as we process data for you.
• We tell you about a change by email at least 30 days in advance. The new version is on this page with its date. If you disagree, you can cancel free of charge.
• Dutch law applies to this agreement. Disputes go to the competent court in the district of Midden-Nederland.