Data Processing Agreement (GDPR art. 28)

Dreilex processes personal data on your behalf for the sole purpose of providing Kwintio: creating, sending and receiving invoices, credit notes and quotes via Peppol, archiving, exporting and making backups. The agreement runs as long as the Terms of use and thereafter as long as Dreilex keeps data on your behalf (article 10).

• Processing: storage, display, generation of PDF/UBL documents, sending and receiving via Peppol, export, backup, deletion.
• Data subjects: your customers, suppliers and their contact persons; your users (staff, accountant).
• Data: names, addresses, email addresses, phone numbers, enterprise/VAT numbers, IBAN, content and amounts of invoices, Peppol identifiers. Special categories of data (article 9 GDPR) and data on criminal convictions are not intended; do not enter them.

• You determine the purpose of the processing and are responsible for its lawfulness (including the information given to your customers).
• Dreilex processes the data only on your documented instructions – this agreement, the Terms of use and your actions in the application – including with regard to transfers to third countries, unless EU or Belgian law requires otherwise; Dreilex then informs you in advance unless the law prohibits it. Dreilex immediately informs you if, in its opinion, an instruction infringes the GDPR.
• Dreilex does not use your customer data for its own purposes. Only the number of Peppol documents sent is used by Dreilex as controller for invoicing (see the Privacy policy).

Persons authorised by Dreilex to process the data are bound by confidentiality.

Dreilex takes the technical and organisational measures of Annex 1 (article 32 GDPR) and adapts them to the state of the art.

• You give a general authorisation for the subprocessors listed in Annex 2.
• Dreilex informs you at least 30 days before a subprocessor is added or replaced. You may object on reasonable grounds within that period; if we find no solution, you may terminate the agreement free of charge with a pro rata refund of the paid, unused part.
• Dreilex imposes on its subprocessors by contract essentially the same data protection obligations and remains fully liable towards you for them.

The database and documents are stored in the EU. If a subprocessor can access or process data from outside the EEA, this happens only on the basis of an adequacy decision (e.g. the EU-US Data Privacy Framework, for certified recipients) or of EU standard contractual clauses (Implementing Decision (EU) 2021/914).

Taking into account the nature of the processing, Dreilex assists you with data subject requests (the application already offers access, rectification and export), with security, breach notification, data protection impact assessments and prior consultations (articles 32 to 36 GDPR). Dreilex forwards to you without delay any request it receives directly from a data subject.

Dreilex notifies you of a breach affecting your data without undue delay and at the latest within 48 hours after becoming aware of it, with the information of article 33(3) GDPR available at that time, and supplements it as more becomes known.

• At the end of the agreement you can export all your data (see article 10 of the Terms of use).
• Your choice (when closing the account in the app, or by email): unless you instruct Dreilex to erase everything, Dreilex keeps the issued, received and imported invoices and credit notes (with the original UBL file) read-only on your behalf until the end of the statutory retention period of 7 years from 1 January of the year following the date of issue (article 60, § 3 of the Belgian VAT Code) of the most recent document, at no additional cost, and erases them afterwards. You remain responsible for your own retention obligation.
• All other data (and, if you chose "erase everything", the invoices as well) are erased 90 days after closure; until then you can export everything. Backups are overwritten within the periods of Annex 1. Dreilex confirms the erasure in writing on request.
• If Dreilex stops Kwintio, it informs you at least 3 months in advance so that you can export everything.

Dreilex makes available the information needed to demonstrate compliance (this agreement, Annexes 1 and 2, certifications and data processing agreements of subprocessors). An audit by you or by an independent auditor bound by confidentiality is possible once a year (and additionally after a breach or at the request of a supervisory authority), at your cost, with 30 days' prior notice.

Article 12 (liability) of the Terms of use applies, without prejudice to article 82 GDPR. Belgian law applies; article 14 of the Terms of use (competent court) applies.

• Hosting at Cloudflare; database and document storage with EU jurisdiction; encryption in transit (TLS) and at rest.
• Passwords: salted PBKDF2-SHA256 hash; sessions in a __Host- cookie (HttpOnly, Secure, SameSite=Lax); CSRF token on every write request; email address confirmation.
• Separation per company: each request is checked against the active company and the user's role (owner, member, accountant read-only).
• Rate limiting on login and registration; security logs kept at most 30 days.
• Backups: point-in-time recovery of the database 30 days; monthly encrypted exports of the database in EU object storage, deleted after 90 days; documents in EU object storage; original UBL files kept unchanged.
• Secrets (API keys) only in the hosting provider's secret store, never in source code.
• Administrative access limited to the operator of Dreilex, protected by strong authentication. No access to production data for tools or service providers not listed in Annex 2. Development tools (including AI tools) work only in a separate test environment with fictitious data and have no access to production data; they are not subprocessors.
• Automated tests on every change; changes recorded in a change register.

In case of discrepancies between language versions, the Dutch version prevails.