Skip to main content
FactuurPro

Privacy policy

FactuurPro, provided by [Company name] (Chamber of Commerce [KvK number], registered at [address]), processes personal data of visitors, users and the customers of users. This policy explains which data that is, why we process it and which rights you have under the General Data Protection Regulation (GDPR).

Please note: this text is a draft containing placeholders such as [Company name] and [KvK number]. Have it reviewed by a legal professional before publishing.

1. Who is responsible?

[Company name] is the controller for the data we process to provide the website and your FactuurPro account (for example your account details and usage data).

For the data you enter into FactuurPro about your own customers (such as names, addresses and invoice details), you are the controller and we act as processor. This is governed by the data processing agreement that forms part of our terms of service.

2. Which data do we process?

Depending on how you use FactuurPro, we process the following categories of data:

  • Account data: name, email address, password (stored hashed), language preference and login history (IP address, browser, time).
  • Company data: company name, Chamber of Commerce number, VAT identification number, address, IBAN and logo.
  • Administration data: customers, quotes, invoices, payments, reminders and the related emails you send through FactuurPro.
  • Bank data: if you activate a bank connection, transaction data from the connected account (date, amount, counterparty, description).
  • Billing data for your subscription: invoice details and payment status. Card or account details are processed by our payment provider and are not stored by us.
  • Usage and technical data: log files, error reports and, only with your consent, anonymised analytics data.
  • Contact data: name, email address and the content of messages you send via the contact form.

3. Purposes and legal bases

We process your data only for the following purposes and on the following legal bases:

  • Performance of the contract: providing your account, creating and sending invoices and quotes, sending reminders and processing payments.
  • Legal obligation: retaining invoice and payment records under tax retention rules (generally seven years in the Netherlands).
  • Legitimate interest: securing the platform, preventing abuse and fraud, and improving our service based on aggregated usage data.
  • Consent: placing analytics cookies and, if you opt in, sending product updates by email. You can withdraw consent at any time.

4. AI features

When you use the AI assistant, the text you enter and the relevant context (such as a quote line or customer name) are sent to our AI provider to generate a suggestion. We share no more than is needed for the request.

Our AI provider processes this data as a processor and does not use it to train models. AI features are only enabled on paid plans by default and you decide whether and when to use them.

5. Who do we share data with?

We do not sell personal data. We do use processors that help us deliver the service:

  • Hosting and database storage within the European Union.
  • Email delivery for transactional emails (invoices, reminders, account notifications).
  • Payment provider for billing subscriptions.
  • Bank connection provider (licensed under PSD2) when you connect a bank account yourself.
  • AI provider for the AI assistant, as described in section 4.
  • Analytics tool for website statistics, only after consent via the cookie settings.

6. Transfers outside the EU

We store your data within the European Economic Area. Where a processor handles data outside the EEA, we ensure appropriate safeguards such as the European Commission’s standard contractual clauses or an adequacy decision.

7. How long do we keep data?

We keep data no longer than necessary:

  • Account data: for as long as your account exists and up to 30 days after deletion, so you can recover from a mistake.
  • Invoices, credit notes and payment records: seven years after the end of the financial year, in line with tax retention rules.
  • Log files and security data: up to twelve months.
  • Contact form messages: up to twelve months after they are handled.
  • Analytics data: anonymised and kept for a maximum of 26 months.

8. How do we protect your data?

We take appropriate technical and organisational measures, including:

  • Encrypted connections (TLS) for all traffic.
  • Passwords are stored hashed only; sensitive tokens are encrypted.
  • Role-based access and an audit log of important changes.
  • Regular backups and separate environments for development and production.
  • Restricted staff access on a need-to-know basis.

9. Your rights

Under the GDPR you have the following rights:

  • Access to the data we process about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure (‘right to be forgotten’), insofar as no legal retention obligation applies.
  • Restriction of processing and objection to processing based on legitimate interest.
  • Data portability: you can export your data yourself from your account at any time.
  • Withdrawal of consent, without affecting the lawfulness of earlier processing.

10. Questions or complaints

To exercise any of your rights or ask a privacy question, contact us at [email address] or via the contact form. We respond within one month.

If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Changes

We may update this privacy policy, for example when we add features or when legislation changes. For significant changes we will notify you by email or through a notice in your account. The date at the top shows when the policy was last changed.