This Data Processing Agreement forms part of the agreement between the client and No Name B.V. (trading as OpenZero, KvK 77121481, Dierenriem 42A, 7071 TH Ulft) for the OpenZero service. The client is the controller; we are the processor. Words such as personal data, processing and personal data breach have the same meaning as in the General Data Protection Regulation (GDPR).
1. What we process
| Purpose | keeping the client's books, as described in our terms and conditions |
|---|---|
| What we do | retrieving transactions, receiving and reading documents, matching, booking, storing, showing to the client and, at the end, deleting |
| Whose data | suppliers, customers and other business relations of the client, the client's employees who use the portal, and other persons who appear in transactions or documents |
| Which data | names, addresses, email addresses, phone numbers, IBANs, amounts, payment descriptions, the content of invoices and receipts, and for users of the portal their role, department and the last digits of a company card |
| Special categories of data | not intended. If they nevertheless appear in a document (for example a receipt from a healthcare provider), we treat them like all other data and process them only for the books |
| How long | as long as the agreement runs, and after that as set out in article 9 |
2. Only on instructions
- We process the personal data only on the client's instructions: for the service and in accordance with the client's written instructions. This agreement and the terms and conditions are those instructions. We only carry out any other processing if the law requires us to. In that case we let the client know first, unless the law prohibits this.
- If we consider that an instruction infringes the GDPR, we say so immediately.
- We do not use the data for ourselves. Nor do we use it to train software or AI models.
3. Confidentiality
Everyone at our company who works with the data is bound by a duty of confidentiality. Only employees who need the data for the service are given access to it.
4. Security
We take appropriate technical and organisational measures. These include:
- encrypted connections (TLS);
- encrypted storage of access credentials for accounting packages and banks;
- access for our bookkeepers only with a password and two-step verification, and only to the clients they work with;
- a log of who did what;
- daily backups;
- hosting in the EU;
- keeping software up to date.
We keep the measures up to date and adjust them where necessary.
5. Sub-processors
- The client consents to the sub-processors in the table below.
- If we want to add or replace a sub-processor, we give notice of this by email at least 30 days in advance. If the client has reasonable grounds to object, we look for a solution together. If that fails, the client may terminate the agreement with effect from the date on which the change takes effect.
- We impose on each sub-processor at least the same obligations as set out in this agreement. We remain responsible to the client for what they do.
| Sub-processor | For what | Where |
|---|---|---|
| DigitalOcean LLC | hosting of the service, the database and the documents | Amsterdam (EU) |
| Microsoft Ireland Operations Ltd (Azure AI Document Intelligence) | reading text from documents | EU |
| Anthropic PBC (Claude) | suggestions for matching and booking | United States, with standard contractual clauses |
| Enable Banking Oy | retrieving bank transactions if the client connects its bank | Finland (EU) |
| Our email service | emails to users of the portal | EU |
The client's accounting package, its bank and its payment providers are not sub-processors. The client has its own agreement with them, and we work there on the client's instructions.
6. Transfers outside the EU
We only transfer personal data to a country outside the European Economic Area if the GDPR permits this, for example with standard contractual clauses of the European Commission. At present this only applies to Anthropic.
7. Assistance with requests and obligations
- If we receive a request from someone exercising their rights, such as access or erasure, we forward it to the client. We help the client to respond to it.
- We also help the client with:
- a data protection impact assessment;
- a prior consultation of the Autoriteit Persoonsgegevens;
- securing the data.
- If that assistance takes more than a few hours, we may charge for that time at our usual rate, but only if we have said so in advance.
8. Data breaches
- If we discover a personal data breach, we notify the client without undue delay, and in any event within 36 hours of discovering it. In doing so we provide:
- what has happened;
- which data and how many persons are affected;
- what the likely consequences are;
- what we have done and are still doing.
- The client decides whether to notify the breach to the Autoriteit Persoonsgegevens and to the data subjects. We do not do this ourselves, unless the client asks us to.
- We keep a record of all breaches.
9. After the end
After the end of the agreement, the client can still download its documents from the portal for 30 days. After that we delete the personal data within 60 days, including from backups as soon as they expire. Data we are required by law to keep, we delete as soon as we are allowed to. On request we confirm the deletion in writing.
10. Audits
- We give the client all information needed to show that we comply with this agreement.
- The client may have this audited once a year by an independent expert who is bound by confidentiality. The client gives at least 30 days' notice of this.
- The client pays the costs of the audit. If it turns out that we did not comply with this agreement on a material point, we pay them.
11. Liability and term
- Article 9 of our terms and conditions applies to liability.
- This agreement runs for as long as we process personal data for the client.
- This agreement is governed by Dutch law. Disputes are submitted to the District Court of Gelderland (rechtbank Gelderland).
- In the event of conflict, this Data Processing Agreement prevails over the terms and conditions as regards personal data.