Invenza Data Processing Agreement

Document version 1.0 · Effective date 9 October 2026

This is a translation. In case of any discrepancy between the Dutch text and this translation, the Dutch text prevails (article 2.16.6 of the terms). Dutch version

This data processing agreement forms part of the Invenza Terms of Use and Contract Terms (hereinafter "the terms") and governs how the Provider processes personal data on behalf of its customers.

1. Definitions, parties and roles

1.1 Capitalised terms, such as Provider, Platform, Services, User, Firm, End Client, Data, Administration and Agreement, have the meaning that Chapter 0 of the terms gives them. "GDPR" is the General Data Protection Regulation (Regulation (EU) 2016/679). Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in article 4 of the GDPR.

1.2 This data processing agreement forms part of the Agreement, as provided in article 2.9 of the terms. In the event of a conflict, it prevails, for the processing of personal data, over all other documents of the Agreement, as provided in article 0.9 of the terms.

1.3 The roles in the processing are distributed as follows:

Data of an End Client. For the personal data in the Data of an End Client's Administration, the End Client is the controller. The Provider processes that personal data as processor for the End Client.
Data of the Firm. For the personal data in the Data of the Administration that the Firm uses for its own account, and for the personal data about its employees that the Firm itself enters as Data into the Platform, the Firm is the controller. The Provider processes that personal data as processor for the Firm.
The Firm's own assignment. The Firm makes the Platform available to its End Clients: it invites them and their Users, follows up their Administration and can export Data to its own accounting software. What the Firm does with an End Client's data for its own accounting assignment for that End Client falls under the Firm's own responsibility as controller and not under this data processing agreement. An export to third-party accounting software takes place under the Firm's own agreement with that third party, as provided in article 2.8.10 of the terms.
Data for which the Provider is itself responsible. For the Users' account, login and usage data, for the proof of acceptance of the terms, of this data processing agreement and of the mandate referred to in Chapter 3 of the terms, and for the legal audit records, the Provider is itself the controller, as provided in article 1.6 of the terms and explained in the privacy notice. This data processing agreement does not apply to it.

In this data processing agreement, "the Controller" is in each case the End Client or the Firm, depending on who is the controller under this article for the personal data concerned.

1.4 The Firm and each End Client each accept this data processing agreement themselves, expressly and in the Platform: the Firm's Users do so on behalf of the Firm and an End Client's Users on behalf of that End Client. The Platform asks every User of the Firm or of an End Client for that acceptance at login, as long as the User has not yet given it. A User who refuses the acceptance is logged out and can log in again only after giving it. As proof of each acceptance, the Provider records the version of this data processing agreement, the time, the User, an enterprise number of the enterprise for which the User acts and the IP address from which the User accepted. For the Data of an End Client that has not yet accepted this data processing agreement itself, or that has no User, the Firm also accepts it on behalf of that End Client, on the basis of the mandate that the Firm warrants under article 2.2.2 of the terms. The Firm provides each End Client with this data processing agreement or the link to it. The End Client may rely directly on this data processing agreement.

1.5 Even when the End Client accepts this data processing agreement itself, it does not become a Contracting Party and does not conclude an Agreement with the Provider within the meaning of Chapter 2 of the terms, as provided in article 0.6 of the terms: for the End Client, this data processing agreement is a separate agreement with the Provider, which governs only the processing of that End Client's Data. This is why the Provider's notifications under this data processing agreement run through the Firm, except where this data processing agreement provides otherwise. The Firm passes on a notification that concerns an End Client to that End Client without unreasonable delay. For questions, instructions and requests under this data processing agreement, the End Client may also contact the Provider directly at privacy@invenza.be.

2. Subject matter, nature, purpose and duration of the processing

2.1 Subject matter: the processing of the personal data in the Data that is needed to deliver the Services, namely invoicing, quotes and their electronic signing, credit notes, receipts and imported documents, customer, supplier and article management, the import of documents by e-mail, the sending and receiving of electronic invoices via the Peppol network, the export to third-party accounting software on a User's instruction, and the supporting AI functions to the extent that they are available to the Controller.

2.2 Nature: the storing, organising, structuring, consulting, displaying, forwarding, exporting and deleting of personal data, in each case via the Platform and the sub-processors referred to in article 7.

2.3 Purpose: the Provider processes the personal data exclusively to deliver, secure and support the Services under the Agreement. It does not use them for its own purposes, does not sell them and does not use them for advertising, as provided in article 2.6.3 of the terms.

2.4 Duration: the processing lasts as long as the Agreement is in force, and afterwards as long as the Provider keeps the Data in accordance with article 13.

3. Data subjects and categories of personal data

3.1 The processing concerns the following categories of data subjects:

customers, suppliers and other trading partners of the Controller, and their contact persons;
employees and contact persons of the Firm and of the End Client, to the extent that their data is in the Platform as Data;
senders and addressees of e-mails sent to an import address of the Platform;
signatories of quotes;
other persons mentioned in documents that the Controller uploads to the Platform or lets in.

3.2 The processing concerns the following categories of personal data:

identification and contact data, such as name, address, e-mail address and telephone number;
enterprise numbers, VAT numbers and Peppol identification;
financial data contained in invoices, credit notes, quotes and receipts, such as amounts, account numbers and payment data;
the content of documents, e-mails and attachments that the Controller uploads to the Platform or lets in;
data about the signing of a quote, such as the signatory's name, e-mail address, times, IP address and browser data;
the content of conversations with the AI assistant.

3.3 The Platform is not intended for special categories of personal data or for personal data relating to criminal convictions and offences (articles 9 and 10 of the GDPR). The Controller does not enter such data, unless it is unavoidably contained in an invoice or another accounting document.

4. Instructions

4.1 The Provider processes the personal data exclusively on the basis of documented instructions from the Controller, including with regard to transfers to a third country or an international organisation, unless a provision of Union or Member State law to which the Provider is subject requires it to process. In that case, the Provider informs the Controller of that legal requirement before the processing, unless that law prohibits such notification on important grounds of public interest.

4.2 The documented instructions are the Agreement, this data processing agreement and the actions that the Users of the Firm and of the End Client take in the Platform within the functions of the Platform, such as entering, changing, sending, exporting or deleting data. The Controller gives additional instructions in writing via privacy@invenza.be. If an additional instruction requires a change to the Platform that is not reasonably feasible, the Provider notifies the Controller of this without unreasonable delay.

4.3 For the Data of an End Client, the Provider may regard the instructions of the Firm and of the Firm's Users as instructions of the End Client, given on the basis of the mandate referred to in article 1.4. If the End Client gives an instruction that conflicts with an instruction of the Firm, the Provider follows the End Client's instruction and notifies the Firm of this.

4.4 If, in the Provider's opinion, an instruction infringes the GDPR or other provisions of Union or Member State law on data protection, the Provider informs the Controller of this immediately. The Provider may suspend the execution of that instruction until the Controller has changed or confirmed it.

5. Confidentiality

5.1 The Provider ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are bound by an appropriate statutory obligation of confidentiality.

5.2 Those persons have access to the personal data only to the extent necessary for the delivery, maintenance, security and support of the Services, or to carry out an instruction of the Controller.

6. Security

6.1 The Provider takes all measures required by article 32 of the GDPR. The technical and organisational measures that the Provider applies on the effective date of this data processing agreement are set out in Annex 1.

6.2 The Provider may adapt those measures to the state of the art and to new risks, provided that the general level of security does not decrease.

6.3 The Controller is itself responsible for the security of its own access to the Platform, such as keeping login credentials confidential (article 1.3 of the terms) and granting access to the right persons.

7. Sub-processors

7.1 The Controller gives the Provider a general written authorisation to engage sub-processors. The current list of sub-processors, with their legal entity, the place of processing, the transfer basis and an overview of the changes, is on the sub-processors page. The sub-processors that are listed on that list on the effective date of this data processing agreement are approved. A sub-processor that is added to the list after that date is announced by the Provider as provided in article 7.4, with the right to object of article 7.5.

7.2 The Provider imposes on each sub-processor by contract the same data protection obligations as those in this data processing agreement, in particular the obligation to provide sufficient guarantees as to the implementation of appropriate technical and organisational measures, so that the processing meets the GDPR. For a sub-processor that works only with its own standard terms, such as a large cloud service supplier, this is done through that sub-processor's processing terms, which offer at least the level of protection of article 28 of the GDPR.

7.3 If a sub-processor fails to fulfil its data protection obligations, the Provider remains fully liable to the Controller for the performance of those obligations, within the limits of article 12.

7.4 The Provider announces a new sub-processor by updating the list referred to in article 7.1 and notifying the Firm of this by e-mail at the Firm's e-mail address known in the Platform, at least 30 days before the new sub-processor starts processing personal data. A change that in fact amounts to a new sub-processor, such as a different legal entity, a place of processing outside the European Economic Area (EEA) or a new purpose of the processing, is announced by the Provider in the same way. The Firm passes the notification on to its End Clients, as provided in article 1.5. The Provider notifies the discontinuation or any other change of a sub-processor for information in the same way.

7.5 The Controller may, within 30 days of the notification, object to a new sub-processor, by e-mail to privacy@invenza.be, on reasonable grounds relating to the protection of personal data. The Provider and the Controller then seek a solution in good faith, such as not engaging the new sub-processor for the Controller's Data or switching off the function for which that sub-processor is needed.

7.6 If the objection has not been resolved within 30 days after the Provider received it, the Firm may terminate the Agreement free of charge and without penalty or compensation, regardless of the notice periods of article 2.5 of the terms. If the objection concerns the Data of an End Client, the Firm may in the same way also terminate only the use of the Platform for that End Client's Administration. The right to an export of the Data under articles 2.5.10 up to and including 2.5.15 and 2.6.4 of the terms continues to apply in full.

7.7 Maventa, a service of Visma, is a sub-processor for the documents exchanged via the Peppol network, as provided in article 2.8.9 of the terms. Maventa's sub-processors are listed at https://www.visma.com/trust-centre/product-search/.

7.8 The following are not sub-processors of the Provider: the vendors of accounting software to which the Firm has Data exported, as provided in article 1.3 of this data processing agreement and in article 2.8.10 of the terms, and the web service of the Crossroads Bank for Enterprises, which is a data source to which the Provider passes on only an enterprise number.

8. Transfer outside the European Economic Area

8.1 A transfer of personal data to a country outside the EEA or to an international organisation takes place only if it complies with chapter V of the GDPR, on the basis of an adequacy decision of the European Commission or of appropriate safeguards, such as the standard contractual clauses of the European Commission.

8.2 For each sub-processor, the list referred to in article 7.1 states the place of processing and the transfer basis, also for access from outside the EEA, such as access for support. With the general authorisation of article 7.1, the Controller also gives the instruction for the transfers that are listed on that list.

8.3 The Provider announces a new place of processing outside the EEA as provided in article 7.4, with the right to object of article 7.5.

9. Assistance to the Controller

9.1 Taking into account the nature of the processing, the Provider assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to data subjects' requests to exercise their rights under chapter III of the GDPR. The Controller can do much of this itself in the Platform, such as consulting, correcting and deleting Data and exporting invoices. Where this is not possible in the Platform, the Provider provides assistance on request via privacy@invenza.be.

9.2 If the Provider receives a request directly from a data subject about personal data that it processes for a Controller, it forwards that request to the Controller without unreasonable delay or refers the data subject to the Controller. It does not itself respond to the request on the merits, unless the Controller instructs it to do so.

9.3 Taking into account the nature of the processing and the information available to it, the Provider assists the Controller in ensuring compliance with the obligations under articles 32 up to and including 36 of the GDPR: the security of the processing, the notification of a personal data breach to the supervisory authority and its communication to the data subjects, the data protection impact assessment and the prior consultation of the supervisory authority. To that end, the Provider makes this data processing agreement, Annex 1 and the list of sub-processors available, and answers reasonable additional questions on request.

9.4 Assistance under this article is free of charge insofar as it is reasonable and falls within the ordinary operation of the Platform. For assistance that goes beyond this and requires considerably more time, the Provider may charge a reasonable fee, which it communicates in advance. No fee is owed if the assistance is needed because of a breach by the Provider or by a sub-processor, or for an export of the Data, as provided in article 2.5.14 of the terms.

9.5 The Provider cooperates with the supervisory authority on request, as provided in article 31 of the GDPR.

10. Personal data breaches

10.1 The Provider notifies a personal data breach affecting data that it processes for the Controller without unreasonable delay and at the latest within 48 hours after becoming aware of it.

10.2 The notification is made by e-mail to the Firm's e-mail address known in the Platform. If the breach concerns the Data of an End Client, the Provider also notifies it by e-mail to that End Client's contact persons known in the Platform. An additional notification in the Platform is possible. The Firm ensures that its e-mail address in the Platform is correct.

10.3 The notification contains at least:

the nature of the breach, where possible including the categories of data subjects and of personal data records concerned and, approximately, the number of data subjects and the number of personal data records concerned;
the name and contact details of the Provider's contact point where more information can be obtained, namely privacy@invenza.be;
the likely consequences of the breach;
the measures that the Provider has taken or proposes to take to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

10.4 If it is not possible to provide all the information at the same time, the Provider provides it in phases, without further undue delay.

10.5 The Provider immediately takes reasonable measures to contain the breach and limit its consequences, documents the breach, the consequences and the measures taken, and assists the Controller with the notification to the supervisory authority and the communication to the data subjects (articles 33 and 34 of the GDPR). The Controller itself decides on that notification and that communication. The Provider does not make them in the name of the Controller, unless the Controller instructs it to do so.

10.6 A notification under this article is not an acknowledgement of fault or liability.

11. Information and audits

11.1 The Provider makes available to the Controller all information necessary to demonstrate compliance with the obligations under article 28 of the GDPR and under this data processing agreement. To that end, it first makes available the documentation referred to in article 9.3 and answers the Controller's written questions within 30 days.

11.2 If that information is not reasonably sufficient, the Provider allows for and contributes to audits, including inspections, by the Controller or by an independent auditor whom the Controller authorises for that purpose. An auditor is bound to confidentiality and is not a competitor of the Provider.

11.3 An on-site audit takes place at most once per period of 12 months, except at the request of a supervisory authority or after a personal data breach that concerns the Controller's Data. The Controller announces an on-site audit in writing at least 30 days in advance, stating its scope; after a breach or at the request of a supervisory authority, a reasonably shorter period suffices. The audit takes place during office hours, without disproportionately disrupting the operation of the Platform, and remains limited to the processing of the Controller's Data. It gives no access to data of other customers of the Provider, nor to the premises of sub-processors, such as data centres. For sub-processors, the Provider relies on the audit reports and certifications that they make available.

11.4 The Controller and the auditor treat all information they obtain in an audit as confidential and use it only to assess compliance with this data processing agreement.

11.5 Each party bears its own costs of an audit; the costs of an auditor are borne by the Controller. If an on-site audit takes up more than one working day of the Provider, the Provider may charge a reasonable fee for the additional time, which it communicates in advance. If the audit shows that the Provider fails to comply with a material obligation under this data processing agreement, the Provider bears its own costs, charges no fee and remedies the breach without unreasonable delay.

11.6 If, in the Provider's opinion, an instruction relating to an audit or a request for information infringes the GDPR or other provisions of Union or Member State law on data protection, the Provider informs the Controller of this immediately.

12. Liability

12.1 For the Provider's liability under this data processing agreement, article 2.13 of the terms applies. An End Client that relies directly on this data processing agreement does so within the same limits.

12.2 This data processing agreement does not affect the rights of data subjects under article 82 of the GDPR.

13. Duration, return and deletion

13.1 This data processing agreement applies as long as the Provider processes personal data as processor for the Controller, and therefore also after the end of the Agreement during the retention period of article 13.2.

13.2 After the end of the Agreement, the Provider keeps the Data for another 24 months, as provided in article 2.6.4 of the terms, so that the Firm or the End Client can reactivate the service without loss of data, can obtain an export on request and the Data remains available in the event of a dispute. Within that period, the Provider provides the Firm or the End Client, on request and free of charge, with an export of their Data, as provided in articles 2.5.11 and 2.5.14 of the terms. That export is the return of the personal data within the meaning of article 28(3)(g) of the GDPR.

13.3 The Firm may ask by e-mail to privacy@invenza.be that the Provider deletes the Data earlier, as provided in article 2.5.13 of the terms. After the end of the retrieval period referred to in article 2.5.13 of the terms, which is equal to the retention period of 24 months or, on request, shorter, the Provider fully deletes the Data, with or without a request, within 30 calendar days and confirms this by e-mail to the Firm. The shorter retention periods of article 2.5.10 of the terms, such as 90 days for the history of the import by e-mail and 180 days for the validation results of e-invoices, continue to apply.

13.4 Copies in backups disappear within the ordinary rotation period of those backups, as described in Annex 1. Until then, they remain secured in accordance with Annex 1 and the Provider uses them only to restore the Platform after a failure or an incident.

13.5 Excepted from the deletion are only: (a) the proof of acceptance of the terms, of this data processing agreement and of the mandate referred to in Chapter 3 of the terms, and the legal audit records, which the Provider keeps as controller and not as processor until 10 years after the end of the Agreement, or longer as long as a dispute is pending, as provided in article 2.6.4 of the terms; (b) the data that the Provider must keep under a legal obligation; (c) the public data from the Crossroads Bank for Enterprises referred to in article 2.5.13 of the terms; and (d) the own documents, folders and logos of an enterprise that at that time still uses the Platform as a Firm or as the Administration of another Firm, as provided in article 2.5.13 of the terms.

13.6 The statutory retention obligation for accounting and VAT documents rests on the Firm and the End Client themselves, as provided in article 2.6.4 of the terms.

14. Amendment and final provisions

14.1 The Provider may amend this data processing agreement under the arrangement of article 2.1.2 of the terms, with the same announcement to the Firm and the same right to terminate the Agreement free of charge. In addition, the Platform again submits a materially amended version for acceptance at login to every User of the Firm and of an End Client, as provided in article 1.4; in this way an End Client that has accepted this data processing agreement itself can also accept or refuse the amended version. A change to the list of sub-processors follows article 7 and not this article.

14.2 The Provider keeps a copy of every published version of this data processing agreement.

14.3 Belgian law applies to this data processing agreement. For disputes, article 2.17 of the terms applies.

14.4 Questions about this data processing agreement can be addressed to the Provider at privacy@invenza.be.

Annex 1 — Technical and organisational measures

This annex describes the measures that the Provider applies on the effective date of this data processing agreement. They may evolve under article 6.2, without the general level of security decreasing.

Hosting in Belgium. The Platform, the database and the document storage run on Microsoft Azure in the Belgium Central region (Belgium). The database backups are kept zone-redundantly in the same region.
Encryption in transit. The Platform and the document storage are reachable only via HTTPS with at least TLS 1.2. Requests over an unencrypted connection are redirected to the secure connection. Connections to the database use at least TLS 1.2.
Encryption at rest. The database is encrypted with Transparent Data Encryption and the document storage with the standard encryption of Azure Storage.
SFTP server for the export to accounting software. This measure was added to this annex under article 6.2 after the effective date of this data processing agreement, when the list of sub-processors changed. A Firm can choose as the destination of the export to accounting software the SFTP server that the Provider rents from Hetzner Online GmbH, in a data centre in Germany (EU). The export files are sent encrypted via SFTP to that server. Each Firm has its own account on that server that gives access only to its own folder. Administration of the server is possible only with a key and not with a password. The export files stay on that server until the accounting software collects them.
No public access to documents. Public access to the document storage is disabled.
Separate login service. Users log in via a separate login service based on OpenID Connect. Passwords are stored only as a non-reversible hash. The browser receives no access keys for the Platform's programming interface: the web application keeps them on the server side.
Access per role and per enterprise. Each User has a role (customer, bookkeeper or administrator). Every request to the server is checked against that role and against the enterprises to which the User has access, so that a User sees only the Data of the enterprises to which it has access.
Secrets and keys. The Platform's secrets in production, such as the connection details of the database and the document storage, the keys of the services used and the encryption keys, are kept in Azure Key Vault, with role-based access, and not in the source code. Passwords and keys that a User enters in the Platform for a connection with accounting software are stored encrypted in the database; the key with which they are encrypted is kept in Azure Key Vault.
Logs and audit. The Platform records relevant actions in an audit log. Access to the database is audited; those audit logs are kept for 90 days.
Retention periods and automatic clean-up. The history of the import by e-mail is deleted automatically after 90 days, the validation results of e-invoices after 180 days, and technical logs after the retention periods that the Platform applies for them. The Data of a terminated Agreement is deleted as provided in article 13.
Backups. The database backups allow recovery to a point in time within the last 7 days; Microsoft Azure deletes older backups automatically. Deleted documents remain recoverable for 7 days and disappear afterwards.
Reporting vulnerabilities. Security problems can be reported in accordance with the vulnerability reporting policy.
No regression. The Provider replaces a measure only with a measure that offers at least the same level of protection.