Data processing agreement

1. Parties and what this agreement covers

1. This data processing agreement is between you, the AccountCloud customer (the controller), and Informer Online Nederland B.V., trading as AccountCloud, based in Rijswijk, the Netherlands, Dutch Chamber of Commerce number 63388928 (the processor, “we”).
2. It is part of the terms of service, and applies from the moment you create an account. You don’t need to sign it separately. If you’d like a signed copy anyway, email [email protected].
3. Terms such as personal data, processing, data subject, sub-processor and personal data breach have the meaning they have in the General Data Protection Regulation (GDPR).
4. Where this agreement and the terms of service conflict on personal data, this agreement prevails.

2. What we process

1. We process personal data on your behalf, insofar as needed to provide AccountCloud: the documents you send, the data you include in calls, and what we return. Annex 1 describes which data, about whom and for what.
2. You determine the purpose and the means. You are responsible for being allowed to have the data processed, and for informing the data subjects about it.
3. The service is not intended for special categories of personal data, such as health data, or for criminal records data. If your documents do contain such data, you are responsible for being allowed to have it processed.

3. Only on your instructions

1. We process the data only on your instructions. Your calls, your settings in the portal and this agreement are those instructions.
2. If EU or Dutch law requires us to do otherwise, we tell you in advance, unless the law forbids it.
3. If we believe an instruction infringes the GDPR, we tell you straight away.

4. No use for our own purposes

1. We don’t use the data for our own purposes, with two exceptions:
   • A report with allow_training: true. If you report an OCR error and share the document with allow_training: true, we may use that one document to test and improve our recognition. For that use we are the controller, and we keep it for up to 12 months. You make sure you’re allowed to share that document. In the portal you can switch sharing off for your whole account; we then share nothing, not even with allow_training: true.
   • Usage data. Per call we keep metadata for billing, security and measuring the service (see Annex 1). It contains no content of documents or calls.
2. We don’t sell data. We don’t use the data from your documents and calls to build a file or register of our own, and we don’t give it to other customers.

5. Confidentiality and access

1. Everyone who works with the data at our end is bound by confidentiality.
2. Only staff who need it for their work can access the data. What they do in the back office is logged.
3. If you choose a check by a member of our staff (processing: verified), someone from our processing team looks at the document to check the result.

6. Security

We take appropriate technical and organisational measures to secure the data, taking into account the state of the art, the costs and the risks. Annex 3 describes them. We may change them, as long as security does not decrease.

7. Sub-processors

1. You give us general authorisation to engage the sub-processors in Annex 2.
2. We announce a new sub-processor, or a change, at least 30 days in advance, by email and on this page. If you have a reasonable objection, let us know within that period. If we can’t find a solution together, you can terminate the agreement before the change takes effect, and we refund your unused credit.
3. We impose at least the obligations in this agreement on every sub-processor. Towards you, we remain responsible for what they do.

8. Data outside the EEA

1. We process and store documents and their results in the EU, in the AWS Frankfurt region (eu-central-1). For AI-based recognition we use Amazon Bedrock only through European inference profiles, so that processing stays within the EU too.
2. If data does go to a country outside the European Economic Area, for example through Cloudflare’s network, it does so only with appropriate safeguards: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or the standard contractual clauses.

9. Helping you meet your obligations

1. If a data subject makes a request to us, for example for access or erasure, we forward it to you and help you answer it. We don’t respond ourselves unless you ask us to.
2. Insofar as reasonable, we help you with a data protection impact assessment (DPIA), a prior consultation with the supervisory authority, and your other obligations under Articles 32 to 36 GDPR.
3. If that help takes more than a reasonable effort, we may charge for it, after consulting you.

10. Personal data breaches

1. If we discover a personal data breach involving data we process for you, we report it without undue delay, and at the latest within 48 hours of discovering it, to the email address of your account’s owner.
2. We give you the information you need to report the breach yourself to the supervisory authority and, where necessary, to the data subjects: what happened, which data and roughly how many data subjects are involved, the likely consequences, and what we’ve done or will do to limit them. What we don’t know yet, we send later.
3. You decide whether to report the breach to the supervisory authority and to the data subjects.

11. Retention and deletion

1. We keep the data no longer than necessary:
   • documents, with their results and the raw recognition output: 7 days after processing, or the period you set in the portal (0 to 30 days). An automatic job then deletes them;
   • documents sent with test keys: 24 hours;
   • metadata per call, without content: 13 months.
2. Database backups still contain deleted data for up to 14 days.
3. When the agreement ends, we delete the data according to the same periods, unless the law requires us to keep it. If you want to keep the results, fetch them through the API while they’re still there.

12. Audits

1. On request, we give you the information you need to show that we comply with this agreement.
2. You may have an audit carried out once a year by an independent expert bound by confidentiality. Announce it at least 30 days in advance. The costs are yours.
3. We may first show you reports and certifications, for example those of Amazon Web Services (such as ISO 27001 and SOC 2), if they suffice.

13. Liability

Section 15 of the terms of service governs liability, subject to Article 82 GDPR.

14. Term

1. This agreement runs as long as we process personal data for you.
2. Whatever by its nature should survive, such as confidentiality and deletion, survives.

15. Law and disputes

This agreement is governed by Dutch law. The competent court of The Hague District Court (rechtbank Den Haag) decides disputes. Where the Dutch and the English text differ, the Dutch text prevails.

Annex 1: the processing

Annex 2: sub-processors

Email (Twilio SendGrid) and payments (Mollie) receive no data from your documents or calls. They are covered in the privacy policy.

Sources. When you check a VAT number, we send that number to VIES of the European Commission, which queries the tax authority of that country. When you request a live Dutch company profile, we send the KvK number to the KvK. We do this on your instructions; these sources are not sub-processors. Belgian company data and address forms come from our own copy; nothing leaves our systems for those.

Annex 3: security measures

• Hosting: in AWS Frankfurt. The database sits in a private network, and cannot be reached from the internet.
• Encryption: all traffic over TLS, including between Cloudflare and our server. The database and document storage are encrypted.
• Backups: the database has point-in-time restore for 14 days.
• API keys: 32 random bytes, of which we store only a hash. Each key can be restricted to operations, IP addresses, an end date and a monthly maximum, and rotated with an overlap.
• Test and live kept apart: test keys touch no source, and test documents are only visible to test keys.
• Access: two-factor authentication in the portal. In the back office it is mandatory, with roles per area and an audit log.
• Logs: metadata only, no content of requests or responses. IP addresses appear only as hashes in the request log and the audit log.
• Secrets: in AWS Secrets Manager. The server uses an IAM role, without static access keys.
• Deletion: an automatic job deletes documents after the retention period.
• Misuse: limits per key and per account, protection against attacks through Cloudflare, and a bot check at sign-up.
• Maintenance: a fixed process for security updates.