Peppol-check

Draft: this text has not been legally checked yet.

Privacy notice

This notice explains which personal data Peppol-check (https://peppol.molenista.nl) processes, why, and what your rights are.

Controller

Angelista Enterprise B.V., Zeeltsloot 17, 2427 EA Zoetermeer, Nederland, KVK 88867013. Contact: angelista.enterprise@mailbox.org. We have not appointed a data protection officer; we are not required to.

Purposes

Accounting firms check whether their clients are correctly registered on Peppol and find possible duplicate purchase invoices.

Which data

  • The e-mail address you log in with
  • Your client list: name and enterprise number per client
  • The result of the lookup in the public Peppol register per client, with a log of changes
  • From purchase exports, only the result: supplier, invoice number, date and amount of possible duplicates. We do not keep the files.
  • One session cookie to keep you logged in

Legal basis

  • Performance of the contract with your organisation: account, login, the service itself and support (GDPR art. 6(1)(b)).
  • Legal obligation: invoices and bookkeeping (GDPR art. 6(1)(c), 7-year Dutch tax retention).
  • Legitimate interest: security, debugging and business contact with organisations (GDPR art. 6(1)(f)). You can object at any time.

Files you upload

If your files contain personal data of others (for example your clients), we process that data only on your behalf, under our data processing agreement.

Retention

Data is kept for as long as your account exists; a client you delete is erased right away with its log and results, login links expire after 30 minutes and sessions after 30 days.

We keep invoice data for 7 years because the law requires it.

Recipients

We do not sell data. Only these processors work for us, under a data processing agreement:

  • OVHcloud SAS, Roubaix, France (hosting of server and database)
  • Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)

All data stays in the European Economic Area.

Your rights

You may access, correct or erase your data, restrict processing, object, and take your data with you (GDPR art. 15 to 21). Write to angelista.enterprise@mailbox.org. We answer within one month. We make no decisions based solely on automated processing.

Contact form

Through the contact form we receive your name, e-mail address and message. We use them only to answer you (GDPR art. 6(1)(f), or (b) if it is about your account). The app does not store the message: it arrives as an e-mail in our mailbox at mailbox.org. We delete it when your question is handled, at the latest after 12 months.

Complaints

You can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority in your own EU country.