Peppol-check

Draft: this text has not been legally checked yet.

Data processing agreement

This data processing agreement belongs to the agreement about Peppol-check. The customer is the controller. Angelista Enterprise B.V. is the processor.

1. Subject and duration

The processor processes personal data only to provide Peppol-check, for as long as the agreement runs.

2. Nature, purpose and data

Accounting firms check whether their clients are correctly registered on Peppol and find possible duplicate purchase invoices.

  • The e-mail address you log in with
  • Your client list: name and enterprise number per client
  • The result of the lookup in the public Peppol register per client, with a log of changes
  • From purchase exports, only the result: supplier, invoice number, date and amount of possible duplicates. We do not keep the files.
  • One session cookie to keep you logged in

Data subjects: employees, clients or contacts of the customer, as far as they appear in the customer's files.

3. Instructions

The processor processes the data only on documented instructions from the customer. Using the service as intended counts as an instruction.

4. Confidentiality

Everyone with access to the data is bound to confidentiality.

5. Security

The processor takes appropriate measures (GDPR art. 32): encrypted connections (HTTPS), access only after login, servers in the EEA, limited admin access, and backups.

6. Sub-processors

The customer gives general authorisation for these sub-processors:

  • OVHcloud SAS, Roubaix, France (hosting of server and database)
  • Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)

The processor announces a new sub-processor 30 days in advance. The customer may object and then cancel.

7. Assistance

The processor helps the customer with requests from data subjects and with the duties of GDPR art. 32 to 36.

8. Breaches

The processor reports a personal data breach to the customer without undue delay, and at the latest 48 hours after discovery (GDPR art. 33).

9. End

After the agreement ends, the customer can export the data for 30 days. Then the processor deletes it, also from backups within 30 days, unless the law requires keeping it.

10. Audits

The processor gives the customer all information needed to show compliance and cooperates with reasonable audits.

11. Transfers

No data is transferred to countries outside the EEA.