OpenZero is a service of No Name B.V. This policy sets out which personal data we use, for what purposes, how long we keep it and what your rights are.
Who we are
No Name B.V., trading as OpenZero
Dierenriem 42A, 7071 TH Ulft
KvK 77121481 · VAT NL860907910B01
Privacy questions: [email protected]
Two roles
We decide for ourselves what we do with the data of our clients and their contact persons, of visitors to the website and of people who send us a message. For that data we are the controller and this policy applies.
We work on instructions when we keep a client's books. The bank transactions, invoices and receipts in those books often contain data of other people: suppliers, customers and employees of our client. We process that data as a processor, only for those books and in accordance with the Data Processing Agreement we conclude with each client. Our client is responsible for that data. Questions about that data are best put to our client; we help it with the answer.
Which data we use and for what
| Whose | Which data | For what | Legal basis |
|---|---|---|---|
| Clients and their contact persons | name, email address, phone number if you provide it, company details, KvK number, language | entering into and performing the subscription, contact about your books | performance of the contract |
| Clients | payment method (Stripe stores it; we only see the type and the last digits), payment status and invoices | collecting the subscription each month | performance of the contract |
| Clients | our invoices and payments | our own bookkeeping | legal obligation (statutory tax retention obligation) |
| Users of the portal (including employees and budget holders of a client) | name, email address, role, department, the last digits of a company card, login details, when you logged in, approvals you gave | logging in with a link sent by email, showing which receipts we need from you, approving expenses | performance of the contract with our client; our legitimate interest in asking the right person |
| Our bookkeepers | name, email address, password (stored encrypted), two-step verification, what they did in the system | access to the system and keeping track of who did what | performance of the employment contract; legitimate interest (security) |
| People who use the contact form | name, email address, phone number if you provide it, your message | answering your question | legitimate interest |
| Visitors to the website | IP address and technical data in server logs | keeping the website secure and working, preventing misuse | legitimate interest |
You are not obliged to give us data. Without a name, email address and company details we cannot enter into a subscription.
Software and automation
We read receipts and invoices with software, including artificial intelligence (AI). That software makes suggestions: which bank transaction a receipt belongs to and to which general ledger account something is booked. A bookkeeper checks those suggestions. We only book automatically the bookings that follow from rules your bookkeeper has approved, and the bookkeeper also checks those by sampling. We do not take decisions about people that are taken by software alone and have legal effects.
We do not use clients' data to train AI models, and our AI suppliers do not do so either.
Who we share data with
We do not sell data. We only share it with parties we need to provide the service. We have agreements on security and confidentiality with each of them.
| Party | For what | Where |
|---|---|---|
| DigitalOcean | hosting of the website, the database and the documents | Amsterdam (EU) |
| Stripe | payments of the subscription and our invoices | Ireland (EU); Stripe may transfer data to the United States |
| Microsoft (Azure AI Document Intelligence) | reading text from receipts and invoices | EU |
| Anthropic (Claude) | making suggestions for matching and booking | United States |
| Enable Banking | retrieving bank transactions if you connect your bank | Finland (EU) |
| Our email service | sending emails, such as login links and reminders | EU |
| Netherlands Chamber of Commerce (KvK) | looking up company details at sign-up | Netherlands |
In addition, we work in the accounting package you choose, such as Moneybird, Exact Online, Twinfield, SnelStart, QuickBooks or Xero, and we retrieve payouts from Stripe, Mollie, PayPal or Shopify if you connect them. This happens at your request and under the terms of those parties.
If the law requires us to, we give data to competent authorities, such as the Dutch Tax and Customs Administration (Belastingdienst).
Data outside the EU
Anthropic is based in the United States. To make suggestions, Claude receives the text of a receipt or invoice and the details of the bank transaction. We have agreed standard contractual clauses of the European Commission with Anthropic. Under its commercial terms, Anthropic does not use this data to train models and deletes it within 30 days.
Stripe may transfer payment data to Stripe, Inc. in the United States. Standard contractual clauses also apply to that.
You can request a copy of these agreements at [email protected].
How long we keep data
| Data | How long |
|---|---|
| Client and contact details | as long as you are a client, and 2 years after that |
| Our invoices and payments | 7 years (statutory tax retention obligation) |
| Documents, transactions and bookings in our systems | as long as you are a client. After the end you can download them for 30 days; after that we delete them within 60 days. Your books themselves are in your own accounting package. |
| Logins, sessions and the log of who did what | 2 years |
| Messages sent via the contact form | 1 year, or longer if you become a client |
| Server logs | 30 days |
| Backups | 14 days |
Security
- All connections are encrypted (https).
- We store access credentials for accounting packages and banks encrypted.
- Our bookkeepers log in with a password and two-step verification, and only see the clients they work with.
- We keep track of who did what. We make a backup every day.
Do you notice something that looks like a data breach? Report it via [email protected].
Cookies
We only use cookies that are needed to make the website work:
- a cookie that keeps you logged in (
oz_session); - a cookie that remembers your choice of language (
oz_lang).
We do not use cookies for statistics or advertising, and no third-party trackers. That is why we do not ask for consent for cookies.
Your rights
You can ask us:
- to access your data;
- to correct it;
- to erase it;
- to restrict its use;
- to transfer it to you or to someone else.
You can also object to use based on our legitimate interest. Email [email protected]. We reply within one month. Sometimes we first ask you to show that the data is yours.
Does it concern data in the books of one of our clients? Then we forward your request to that client.
Do you disagree with how we handle your data? Let us know. You can also lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
If we change this policy, we put the new version on this page. In the case of major changes, we let clients know by email first.