01Controller
Andrei Boacă, sole proprietorship trading as Dreilex, KBO 0800.801.118, Dok-Noord 32 bus 504, 9000 Gent, Belgium ("Dreilex", "we"), is the controller for the processing described in this policy. Contact for privacy questions: [email protected]. We have not appointed a data protection officer (not required for our processing).
For the data of your customers and contacts that you enter in Kwintio (e.g. on an invoice), you are the controller and Dreilex is your processor; this is governed by the Data Processing Agreement (annex to the Terms of use).
02Which data, why and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: email address, name (optional), language, password (hash only), email confirmation, accepted version of the terms and date | Creating and securing the account, providing the service, proof of acceptance | Contract (6.1.b) |
| Company data: name, enterprise/VAT number, address, IBAN, logo, Peppol identifier, users and roles | Providing the service, Peppol registration | Contract (6.1.b) |
| Subscription and payments: plan, status, Stripe customer and subscription IDs, payment status, our invoices to you | Invoicing, accounting, VAT | Contract (6.1.b); legal obligation (6.1.c) for our accounting and VAT |
| Usage data: number of Peppol documents sent per month | Charging the included volume and additional documents | Contract (6.1.b) |
| Security data: IP address (in short-lived security logs and, hashed, for rate limiting), session data, login attempts | Security, fraud and abuse prevention | Legitimate interest (6.1.f): a secure service for all customers and preventing abuse |
| Support emails | Answering your questions | Contract (6.1.b), or legitimate interest (6.1.f) to answer questions from non-customers |
| Waitlist: email address, business type, language, source, date and rank of sign-up, campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), click IDs (gclid, gbraid, wbraid), the landing path and the referring site | Informing you about the launch and granting the waitlist offer (including by matching your email address at registration against the waitlist, after that address is confirmed). Measuring which advertising campaign led to the signup | Consent (6.1.a), which you can withdraw at any time; for granting the offer: contract (6.1.b) |
Mandatory or not? Account, company and subscription data are needed to conclude and perform the contract; without them we cannot provide Kwintio. Your name and logo are optional. The waitlist is voluntary.
We do not sell personal data, use no advertising or tracking cookies and take no automated decisions with legal effects (article 22 GDPR).
03Recipients and subprocessors
| Provider | Role | Location / safeguards |
|---|---|---|
| Cloudflare, Inc. (US) | Hosting of the application, database and document storage, email sending by the application, network security | Database and documents stored in the EU (EU jurisdiction). The global network may process requests outside the EEA: Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795); Cloudflare's data processing agreement also includes the EU standard contractual clauses |
| Stripe Payments Europe, Limited (Ireland) | Payment processing, subscriptions | Stripe is an independent controller for fraud prevention and its own financial obligations; card data never reach Kwintio. Transfers to Stripe, LLC (US): EU-US Data Privacy Framework and standard contractual clauses |
| BRBX BV, trading as Recommand (KBO 1012.081.766, Peer, Belgium) | Certified Peppol access point: sending, receiving and validating Peppol documents | EEA. For any verifications required by the Peppol rules, Recommand is an independent controller |
| Zoho Corporation B.V. (Netherlands) | Email for [email protected] (support) | EU data centre (zoho.eu) |
Public authorities (e.g. the tax administration) only receive data where the law requires it. The recipients of your Peppol documents receive the documents you send. You can request a copy of the safeguards for transfers outside the EEA at [email protected].
04Retention periods
- Account and company data: as long as the account exists. After the account is closed (in the app by the owner, or by email), we erase them 90 days after closure (or after the end of a running paid period), except what we must keep by law or what is stated otherwise below; until then the account remains available read-only for export. Accounts without a subscription and without issued documents that have been inactive for 24 months may be deleted 30 days after a prior email.
- Invoices and credit notes you issued or received via Kwintio (including the original UBL file): kept on your behalf for 7 years from 1 January of the year following the date of issue (article 60, § 3 of the Belgian VAT Code), unless you ask for earlier erasure after export. If you have a longer retention obligation (e.g. for the revision of VAT deductions on immovable property), export those documents in time.
- Our invoices to you and our accounting: 7 years from 1 January of the year following issue (legal obligation).
- Security logs and login-attempt data: at most 30 days.
- Backups: point-in-time recovery of the database at most 30 days; encrypted monthly exports at most 90 days.
- Support emails: 24 months after the last message.
- Waitlist: until the offer has been granted or until you unsubscribe, at the latest 12 months after launch; afterwards only the link with your company (without email address) is kept while the offer runs.
05Security
Encrypted connections (HTTPS), encryption at rest at our hosting provider, passwords only as salted hashes (PBKDF2-SHA256), secure session cookies (HttpOnly, Secure, SameSite), CSRF protection, access per company and per role, rate limiting, storage in the EU and backups. Dreilex's access to customer data is limited to what is needed for support or security.
06Your rights
You have the right of access, rectification, erasure, restriction, objection (to processing based on legitimate interest), portability and withdrawal of consent (without affecting the lawfulness of earlier processing). Write to [email protected]; we answer within one month (article 12 GDPR). You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
08Changes
We announce material changes in advance in the app or by email. The current version is always available at kwintio.be/privacy.
In case of discrepancies between language versions, the Dutch version prevails.
09The kwintio.be website: survey, visits, fonts
If you fill in our survey, we also store your answers, your email address, your first name (if you give it), whether you agree to a 15-minute call, your language and the date.
We use survey answers only for product research: to understand what entrepreneurs and businesses need and to decide what to build. If you agreed to a call, we may email you to schedule it. The legal basis is again your consent (Article 6(1)(a) GDPR), which you give by ticking the box in the survey. You can withdraw it at any time.
Survey answers are kept for the same period as the waitlist.
For the waitlist we don't ask for your name. We don't use cookies, third-party analytics or advertising trackers. We count page visits anonymously, without cookies for visitors and without storing IP addresses, to see how many people visit. Your browser only remembers your language choice, locally (localStorage, key kwintio-lang). It never leaves your device and you can clear it at any time.
To deliver the site and protect it against abuse, Cloudflare also processes technical data such as your IP address (our legitimate interest, Article 6(1)(f) GDPR). We don't keep this data.
Styles and fonts are served by kwintio.be itself. We do not load Google Fonts or a styling library from a third-party network.