Data processing agreement

1. Subject matter and duration

The processor processes personal data solely to provide the xaf-ok.nl service as described in the terms of service: reading and checking XAF files, converting general ledger exports into XAF 4.0, and making the results available to you.

The agreement runs for as long as you use the service, and afterwards until all personal data has been deleted under section 11.

2. Nature and purpose of the processing

Receiving, reading, structuring and checking ledger and audit file data, mapping ledger accounts to RGS codes, converting to XAF, storing temporarily, making available to you, and deleting. The sole purpose is to provide the service to you.

3. Types of data and data subjects

• Types of data: data from general ledgers and audit files, such as names, addresses, VAT and Chamber of Commerce numbers of customers and suppliers, booking descriptions, account numbers and amounts, and names of persons mentioned in descriptions.
• Data subjects: customers, suppliers and other business partners of you or your clients, and employees and other persons who appear in the accounts.

We process your own account data, such as your email address, as a controller; the privacy policy applies to that.

4. Instructions

The processor processes the data only on your documented instructions. This agreement, the terms of service and your use of the service’s functions (uploading, converting, downloading and deleting) constitute your instructions.

If the processor is required by law to process the data otherwise, it informs you beforehand unless the law prohibits this. If the processor considers that an instruction infringes the GDPR, it informs you immediately.

5. Confidentiality

Everyone at the processor who has access to the data is bound by confidentiality.

6. Security

The processor takes appropriate technical and organisational measures under Article 32 GDPR, including:

• servers in Germany and encrypted connections (TLS);
• uploaded CSV, Excel and PDF files are not stored: they are held only in memory and in the processing queue during the conversion; files opened in the XAF viewer are processed in memory only;
• conversions are accessible only to the account or browser session that created them;
• administrative access to the servers only for authorised persons with personal keys;
• automatic deletion after fixed periods (section 11) and daily database backups, which are deleted after 14 days;
• monitoring of the service’s availability.

7. Sub-processors

You give the processor general authorisation to engage sub-processors. They currently are:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of all servers and data, in Germany.
• Microsoft Ireland Operations Limited, Dublin, Ireland (Azure OpenAI): RGS suggestions for names and numbers of ledger accounts that our fixed rules cannot map reliably, and reading PDF ledgers (full pages). The Azure resource is in Sweden Central; the actual processing location depends on the Azure deployment type and can include the EU data zone or other Azure regions. Transfers outside the EEA are governed by the Microsoft product terms and the data protection addendum they include.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace): email only, so only if you send us data by email.

The processor imposes at least the obligations of this agreement on its sub-processors. It notifies you of a new or replacement sub-processor by email at least 30 days in advance. You can object within that period; if we cannot resolve the objection together, you can terminate the agreement.

8. Data subject rights

The processor assists you, as far as reasonable, in responding to data subject requests (access, rectification, erasure, restriction, portability and objection). You can delete conversions yourself at any time in your dashboard. Requests the processor receives directly are forwarded to you.

9. Assistance

Taking into account the nature of the processing and the information available to it, the processor assists you with your obligations under Articles 32 to 36 GDPR, such as security, personal data breach notification and data protection impact assessments.

10. Personal data breaches

The processor notifies you of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information you need under Article 33(3) GDPR. It takes immediate measures to limit the consequences.

11. Deletion and return

Conversions are deleted automatically: without an account after 7 days, in an account after 90 days. You can delete them earlier yourself and download the results until then. If you delete your account, your account and conversions are deleted immediately. Deleted data disappears from the backups no later than 15 days later.

12. Information and audits

The processor makes available to you all information necessary to demonstrate compliance with Article 28 GDPR. After at least 30 days’ notice, you may have an audit carried out by yourself or by an independent auditor bound by confidentiality, at most once a year and during business hours, except after a personal data breach. You bear the cost of the audit unless it reveals a shortcoming of the processor.

13. Liability and final provisions

Liability is governed by Article 8 of the terms of service, without prejudice to Article 82 GDPR. In case of conflict between this agreement and the terms of service, this agreement prevails as regards the protection of personal data. Article 11 of the terms of service (German law, courts of Frankfurt am Main) also applies.

Questions about this agreement: support@xaf-ok.nl.