Privacy policy
Last updated on 21 October 2026
Invenza is an online application for invoicing, quotes, credit notes and accounting integrations. This privacy policy explains which personal data we process, why we do so, how long we keep it and what your rights are. We have deliberately written it in plain language.
1. Who we are and how to reach us
The controller for the data we manage ourselves (see section 2) is:
Ali Eren
Sole proprietorship (natural person)
Hoekstraat 12, 3582 Beringen, Belgium
VAT number: BE 0742.764.434
Enterprise number: 0742.764.434
E-mail for privacy questions: privacy@invenza.be
Do you have a question about your data or do you want to exercise a right? E-mail us at the address above. We reply within the statutory period of one month.
2. Who does this policy apply to? Two roles
Invenza is used by accounting firms, their staff and the businesses they support as clients. Depending on the data, our role differs:
- We are the controller for the data of our own users: your account, your login details, your use of the application and the technical data generated in the process. For that data we decide ourselves why and how we process it. The same applies to the data we use to invoice our own fee to accounting firms and, where the terms of use allow it, directly to their end clients (see section 4).
- We are a processor for everything you or your accounting firm enter into the application or have imported: your customers and suppliers, invoices, quotes, credit notes, receipts, imported e-mails, uploaded documents and the content of your conversations with the AI assistant. For that data, the business using Invenza (or its accounting firm) is the controller. We process it solely to provide the service, on the instructions of that business and under our data processing agreement (in Dutch).
Are you a customer, supplier or contact person of a business that uses Invenza (for example because you received an invoice or a quote to sign)? Then that business is your point of contact for privacy questions. We assist it in doing so.
3. Which personal data do we process?
We only process data that is needed to make the application work. Specifically:
- Identification and contact data: name, e-mail address, phone number and job title of users and contact persons.
- Login data: your password (only in an encrypted, non-reversible form), the security characteristics of your account and your login sessions.
- Company data: enterprise number, VAT number, addresses and bank details (IBAN and BIC) of your business and of your customers and suppliers. For sole traders this is personal data too.
- Document content: invoices, quotes, credit notes, receipts and the lines, amounts, payment references and remarks they contain.
- Imported e-mails: if you use e-mail import, we process the sender, recipient, subject, body and attachments of e-mails sent to your import address.
- Uploaded documents and the recognised text: the PDFs and photos you upload or import, and the text our document recognition (OCR) extracts from them.
- Electronic signature of quotes: the signature the recipient draws, the time at which the quote was viewed, signed or declined, any reason for declining and, on signing, the signer's IP address and browser details (user agent). That IP address and those browser details are also shown on the signed copy of the quote.
- Login and confirmations at account activation: when you accept, at account activation, the terms of use or the electronic-invoicing (Peppol) mandate, or confirm that you have taken note of the privacy policy, we record which version you accepted or took note of, the timestamp and the IP address from which you did so, as evidence. The same applies when you accept the data processing agreement at sign-in on behalf of your company or your accounting office.
- AI assistant: the questions you ask, the answers you receive and, if you use voice input, the text recognised from your speech. We do not keep the audio itself.
- Technical and usage data: IP address, browser type, pages visited, chosen language, session identifier, error messages and performance measurements.
Data from the KBO: when you look up an enterprise number, we obtain the name, address, legal form, legal situation and VAT registration of that enterprise from the Crossroads Bank for Enterprises (KBO/BCE) through the KBO Public Search web service of the FPS Economy. For a sole proprietorship this is personal data. We use this data only to fill in company and customer details and never for direct marketing. We show the KBO as the source together with the date of the data.
We do not process special categories of personal data (such as health data) and we do not carry out profiling or automated decision-making with legal effects.
4. Why do we use your data, on which legal basis and for how long do we keep it?
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Creating your account, logging you in and making the application available | Identification, contact and login data | Performance of the contract (Art. 6(1)(b) GDPR) | As long as your account exists. After closure we delete or anonymise the data, except what we are legally required to keep. |
| Creating, sending, receiving and following up invoices, quotes and credit notes (including via Peppol) | Company data, document content, contact details of customers and suppliers | Performance of the contract (Art. 6(1)(b) GDPR) | As long as the business uses Invenza; during that period it can export its invoices itself. After the agreement for the use of Invenza ends, we keep the data for 24 more months, so that the service can be reactivated and any dispute can be handled, and provide an export on request; after that we delete it. Copies in backups expire within the normal rotation period of those backups. The statutory retention obligation for accounting and VAT records in Belgium (currently 7 to 10 years) rests with the business and its accounting firm; they export the records they need for that purpose in good time. |
| E-mail import: automatically recognising documents in e-mails | Imported e-mails and attachments | Performance of the contract | The raw e-mail and its attachments are deleted automatically 90 days after processing. The recognised document stays with the invoice or receipt it was used for. |
| Electronic signing of quotes | Signature, timestamps, reason for declining, the signer's IP address and browser details | Performance of the contract (on behalf of the business sending the quote) | As long as the quote is kept. |
| Recording and proving, at account activation or at sign-in, your acceptance of the terms, the data processing agreement or the mandate and that you took note of the privacy policy | Version and timestamp of acceptance or taking note, accounting-office identifier (for the Peppol mandate) and IP address | Legitimate interest in being able to prove which terms and which mandate were accepted and that you took note of the privacy policy (Art. 6(1)(f) GDPR) | Kept as evidence for the duration of the relationship and the legal limitation period; not deleted by the automatic purge or an erasure request. We refuse erasure of this data because it is needed for the establishment, exercise or defence of legal claims (Art. 17(3)(e) GDPR). |
| AI assistant: answering questions about your invoices, customers and figures | Conversation content, voice transcripts | Performance of the contract | Until you delete the conversation or your account is closed. |
| Sending e-mails: invitations, password resets, invoices, reminders | Contact details, document content | Performance of the contract | Sending records are kept as long as the related invoice or quote is kept. |
| Security, error detection and improvement of the application | Technical and usage data, error messages | Legitimate interest (Art. 6(1)(f) GDPR): a secure and working service | Monitoring data (Application Insights): 90 days. Other technical logs: page-visit logs 90 days; event and error logs 180 days. Service-call logs are retained for a maximum of 180 days and then deleted automatically; the operation field may contain operational request data (e.g. the enterprise number from a KBO or Peppol lookup) and is not separately erased on request. |
| Invoicing and collecting our own fee: to the accounting firm and, where the terms of use allow it, directly to the end client whose administration the fee relates to | Public company data from the Crossroads Bank for Enterprises (name, address, enterprise number), the e-mail address of a user of the firm or of the end client, the evidence that the terms and the payment obligation were accepted, usage data of the application per administration, and our invoices, payments and reminders. Never the content of your invoices, quotes or other documents. | Performance of the contract (Art. 6(1)(b) GDPR) with the accounting firm or with the end client that accepted the payment obligation when an account was activated, legal obligation (Art. 6(1)(c) GDPR) for our accounting and VAT, and legitimate interest (Art. 6(1)(f) GDPR) in being able to send and collect our invoices | We keep our invoices and the records that support them for as long as Belgian accounting and VAT law requires (currently 7 to 10 years). While that legal retention obligation runs, they are not deleted by the automatic purge or an erasure request (Art. 17(3)(b) GDPR). |
| Complying with legal obligations and handling disputes | All relevant data | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest | As long as the legal obligation or the limitation period runs. Legal-evidence records (quote-signing and erasure audit trail) are retained for up to 10 years after the end of the agreement, or longer as long as a dispute is pending, and are not deleted by the automatic purge or an erasure request. |
We only ask for consent where the law requires it. That is not the case for the current application: we do not set marketing cookies and we do not use your data for advertising.
5. Who receives your data? Our sub-processors
We never sell your data. We only share it with the service providers we need to make Invenza work. The table below shows which provider receives what and where that happens.
The current list of our sub-processors, with the legal entity, the transfer mechanism and a log of changes, is on our sub-processors page.
| Service provider | Purpose | Location | Which data |
|---|---|---|---|
| Microsoft Azure (App Service, SQL Database, Blob Storage) | Hosting, database and document storage | Belgium Central (Belgium, EU) | All application data |
| Our own login service (Duende IdentityServer) | Login and account management | Same Azure hosting in Belgium | Account data, name, e-mail address, roles |
| Microsoft Azure OpenAI | AI assistant and document understanding | EU region | Conversation content, document text, customer names appearing in your question |
| Microsoft Azure AI Document Intelligence | Text recognition (OCR) of uploaded invoices and receipts | EU region | Uploaded documents |
| Microsoft Azure AI Speech | Voice input for the AI assistant | EU region | Speech, converted to text |
| Microsoft Application Insights | Error and performance monitoring | Germany West Central (Germany, EU) | IP address, user ID and role of logged-in users, pages visited, error messages |
| Maventa (a Visma service) — Peppol access point | Electronic invoicing over the Peppol network | EU | Invoice content and identification of sender and recipient |
| Mailgun | Receiving e-mails for the e-mail import | EU region | E-mails and attachments sent to your import address |
| Combell NV — outbound e-mail | Sending invitations, password resets, invoices and reminders | Belgium (EU) | Recipient e-mail address and the content of the e-mail |
| Hetzner Online GmbH | Storage of accounting export files on an SFTP server until the accounting software collects them | Germany (EU) | Content of the export files: invoices as PDF and structured file |
The accounting links (Adsolut and Yuki) are not in this table. They are optional links that your accounting firm enables itself. The data then goes to the firm's own account or administration with that accounting-software provider, under the firm's own agreement with that provider (for Adsolut, the firm also chooses the destination server itself: a server it controls itself or the SFTP server we rent from Hetzner, see the table above). For that data, the firm acts as a separate recipient and controller, not as our sub-processor. This concerns invoices as PDF and structured file (Adsolut) and invoice data and documents (Yuki). For questions about that processing, please contact your accounting firm.
The KBO Public Search web service of the FPS Economy is not in this table either. It is a data source, not a sub-processor: when you look up a company, we only send the enterprise number and receive data from the public register of the Crossroads Bank for Enterprises in return. The service does not process data on our behalf and is located in Belgium (EU).
Maventa (a Visma service) uses its own service providers for the Peppol service. According to the sub-processor list published by Visma (https://www.visma.com/trust-centre/product-search/, retrieved on 22 September 2026), Maventa's service providers are currently all located within the EEA.
In addition, when the application loads, your browser requests a few files directly from external services: scripts from content delivery networks of Microsoft and Cloudflare and, to show your initials, an image from an avatar service (ui-avatars.com), with your display name included in the request. Those services see your IP address and, for the avatar, your name. The privacy policies of those services apply to those requests.
Where the law requires it, we may also share data with public authorities, courts or our legal advisers.
6. Transfers outside the European Economic Area
Our primary storage (database, documents, login service) is located in Belgium. Our monitoring is located in Germany and our AI services run in Microsoft EU regions. Your data therefore stays within the EEA in principle.
All sub-processors in the table in section 5 process your data within the EEA. Should a service provider ever process data outside the EEA, Chapter V GDPR applies: such a transfer is only permitted on the basis of an adequacy decision of the European Commission or with appropriate safeguards such as the European Commission's standard contractual clauses, and we will state this in this policy. For the accounting links (see section 5), the data goes to your accounting firm's own account with its accounting-software provider, under the firm's own agreement with that provider. If you want to know what applies to a particular provider, ask us via the contact address in section 1.
The external services your browser contacts directly (see section 5) are not covered by this; the privacy policies of those services apply.
For Maventa (see section 5), there is currently no transfer outside the EEA: according to the sub-processor list published by Visma (https://www.visma.com/trust-centre/product-search/, retrieved on 22 September 2026), Maventa's service providers are all located within the EEA.
7. How do we protect your data?
- All traffic between your browser and Invenza goes over HTTPS (TLS). Requests over an unencrypted connection are automatically redirected to the secure connection.
- The database and document storage are encrypted at rest on Microsoft Azure infrastructure.
- Login goes through a separate, secured login service (OpenID Connect). We only store passwords as a non-reversible hash.
- Access to data is restricted per role (client, accountant, administrator) and per business: a user only sees the businesses he or she has access to.
- Secret keys and passwords for integrations are kept in a secured key vault, not in the code.
- The application uses security headers in the browser and is regularly subjected to security reviews.
No system is entirely without risk. If you notice a security problem, please report it to us as described in our vulnerability disclosure policy.
8. Your rights
For the data for which we are the controller, you have the right to:
- access the data we process about you;
- have inaccurate data rectified;
- have your data erased, unless we are legally required to keep it;
- have the processing restricted;
- receive your data in a common format (portability);
- object to processing based on our legitimate interest.
Send your request to privacy@invenza.be. To prevent abuse we may ask you to confirm your identity. If your request concerns data that a business has entered about you in Invenza, we forward it to that business or refer you to it, because it is the controller for that data.
For data we obtained from the KBO, you can exercise your right of access, your right to rectification and your right to object with us via privacy@invenza.be. If the data is incorrect in the KBO itself, it must be corrected in the KBO through an enterprise counter or the FPS Economy. We update our copy within one month of your request.
Not satisfied with the way we handle your data? You can lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
contact@apd-gba.be
10. Changes to this policy
We update this policy when our service, our service providers or the legislation change. The date of the latest change is shown at the top of this page. For important changes we notify our users via the application or by e-mail.