---
title: "Data processing agreement · EenFactuurMaken.nl"
description: "EenFactuurMaken.nl's data processing agreement: how we process your customers' personal data on your behalf, in line with article 28 GDPR."
url: "https://eenfactuurmaken.nl/en/legal/dpa"
markdown_url: "https://eenfactuurmaken.nl/en/legal/dpa.md"
language: "en-GB"
---

Legal

# Data processing agreement

Agreements about the personal data EenFactuurMaken.nl processes on your behalf, such as your customers' data.

Last updated: 12 October 2026

Please note: this is a template

This text is a starting point and has not yet been reviewed by a lawyer. The Dutch version prevails.

## 1. Parties and roles

This data processing agreement is an agreement between you (controller) and DigitX BV, KvK 82240264 (processor). It is part of the terms of service and applies as soon as you create an account.

It covers the personal data you put into EenFactuurMaken.nl to create and send invoices, such as the details of your customers and their contact persons.

## 2. Subject, nature and purpose

We only process the data to provide the service: storing it, creating invoices and e-invoices, sending emails and reminders, exporting and making it available through the API. We do this as long as your account exists, and afterwards as long as needed for the retention periods in the terms.

## 3. Data subjects and data

- Data subjects: your customers and their contact persons, and possibly you yourself as a sole trader.
- Data: name, address, email address, phone number, KvK and VAT number, Peppol ID, and whatever you put on invoices, such as descriptions, amounts and notes.
- Don't put special categories of personal data, such as health data, or citizen service numbers (BSN) on invoices unless legally required.

## 4. Your instructions

We only process the data on your instructions. How you use and configure the service counts as those instructions. If we believe an instruction violates the GDPR, we'll tell you right away.

## 5. Confidentiality

Everyone at our end with access to the data is bound by confidentiality. Only people who need access for their work get it.

## 6. Security

We take appropriate measures in line with article 32 GDPR, including encrypted connections, strict separation between users, strong authentication, logging, encrypted backups and hosting in the EU. The current measures are on our Security page.

## 7. Sub-processors

You consent to the sub-processors below. We have agreements with each that are at least as strict as this agreement.

- Hetzner Online GmbH (Germany): hosting, database and backups.
- Resend, Inc. (United States; sending from the EU region in Ireland): sending email, such as invoices and reminders to your customers. Resend keeps sent emails and their data for up to 30 days, also in the United States.
- We announce new sub-processors at least 30 days in advance. You can object; if we can't resolve it, you can cancel.

## 8. Data breaches

If we discover a data breach affecting your data, we'll notify you without undue delay, and at the latest within 48 hours of discovering it. We'll give you the information you need to report the breach to the Dutch Data Protection Authority and inform data subjects yourself.

## 9. Assistance with requests and DPIAs

We help you respond to data subject requests, for example by offering export and deletion in the service. We also reasonably assist with a data protection impact assessment (DPIA).

## 10. Audits

On request, we provide the information needed to demonstrate that we comply with this agreement. An audit by an independent expert is possible at most once a year, at your expense and at a time agreed in advance.

## 11. Transfers

We store the data in the EU. If you send email through EenFactuurMaken.nl, those emails are also processed by Resend in the United States. We only transfer data outside the EEA with appropriate safeguards: the EU-US Data Privacy Framework (where the sub-processor is certified) and standard contractual clauses.

## 12. End of the agreement

When your account ends, you can export your data first. We then delete it within 60 days, unless a legal obligation requires us to keep it longer. It disappears from backups within 12 months.

## 13. Liability

Liability is governed by the terms of service.