--- title: "Privacy statement ยท EenFactuurMaken.nl" description: "Which personal data EenFactuurMaken.nl processes, why, for how long, with which processors, and what rights you have under the GDPR." url: "https://eenfactuurmaken.nl/en/legal/privacy" markdown_url: "https://eenfactuurmaken.nl/en/legal/privacy.md" language: "en-GB" --- Legal # Privacy statement How EenFactuurMaken.nl handles your personal data, and what rights you have. Last updated: 12 October 2026 Please note: this is a template This text is a starting point and has not yet been reviewed by a lawyer. The Dutch version prevails. ## 1. Who we are EenFactuurMaken.nl is a service of DigitX BV, located at Aalsburg 1807, 6602 VH Wijchen, registered with the Dutch Chamber of Commerce (KvK) under number 82240264. Questions about privacy? Email privacy@eenfactuurmaken.nl. ## 2. Our two roles For your account data (such as your name, email address and subscription) we are the controller. That's what this privacy statement is about. We process your customers' data that you put into EenFactuurMaken.nl, such as names and addresses on invoices, on your behalf. You are then the controller and we are the processor. Our data processing agreement applies to that. ## 3. What data we process - Account data: name, email address, a hash of your password, your passkeys (only the public key) and your two-factor settings. - Business data: company name, address, KvK number, VAT number, IBAN, contact details and your logo. - Invoices, customers and products you enter yourself. - Subscription data: your plan, payments and our invoices to you. Payment details such as your IBAN or card are processed by Stripe; we don't see full card or account numbers. - Email log: to whom we sent an invoice or reminder on your behalf, when, and whether it was delivered. - Technical data: IP address, browser and time, for security, sessions and preventing abuse. - Support contact: the messages you send us. ## 4. Why, and on what legal basis - Performance of the contract: your account, creating, sending and keeping invoices, and your subscription. - Legal obligation: we keep our own records, such as the invoices we send you, for 7 years. - Legitimate interest: security, preventing abuse and fraud, and improving the service with data that can't be traced back to you. - Consent: only if we want to send you something that isn't needed for the service, such as a newsletter. You can withdraw that consent any time. ## 5. Processors We work with a few parties that process data for us. We have a data processing agreement with each of them. - Hetzner Online GmbH (Germany): servers, database and backups. - Resend, Inc. (United States; sending from the EU region in Ireland): sending email. - Stripe Payments Europe, Limited (Ireland), part of Stripe, Inc. (United States): payments for Pro. ## 6. Data outside the EU We store your account, invoices and customers in the European Union (Hetzner, Germany). We send email through Resend from Ireland, but Resend is a US company: data about sent emails (such as recipient, subject and delivery status) and the emails themselves are also processed in the United States and kept there for up to 30 days. Stripe processes payments from Ireland and belongs to the US company Stripe, Inc. For data that ends up outside the EU, the EU-US Data Privacy Framework (where the party is certified) and the European Commission's standard contractual clauses apply. ## 7. How long we keep data - Your account and business data: as long as your account exists. If you delete your account, we erase it within 30 days. - Invoices on the Free plan: 60 days after creation. We warn you twice by email first; an invoice you haven't downloaded is only deleted at least 3 days after a warning. - Invoices on Pro: 7 years, the statutory retention period. If you stop Pro, they stay for another 60 days, after which the Free plan period applies. - Our own invoices to you and payment data: 7 years, because the law requires it. - Security logs: at most 12 months. - Backups: at most 12 months. After that, deleted data is gone from them too. ## 8. Cookies We only use functional cookies, for example to keep you signed in. No tracking cookies and no advertising scripts. Read more in our cookie statement. ## 9. Security We take appropriate technical and organisational measures, such as encrypted connections, passkeys and two-factor authentication, strict separation between users and encrypted backups. Our Security page explains how. ## 10. Your rights You have the right to access your data, have it corrected or erased, restrict processing, object, and take your data with you (data portability). Much of this you can do yourself in your settings: update data, export it and delete your account. If that doesn't work, email privacy@eenfactuurmaken.nl. We respond within a month. To protect your data, we may ask you to confirm that you own the account. Is it about your customers' data on your invoices? Then they should contact you. We'll help you with that. ## 11. Complaints Not happy with how we handle your data? Let us know first and we'll look for a solution together. You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). ## 12. Changes When we change this privacy statement, you'll see it in the date at the top. For important changes, we'll email you in advance.