Data processing agreement

Last updated: 10 November 2026

This agreement forms part of the terms of service between your organization ("controller") and MVdW-Software, Maxim Van de Wynckel, Draaiersstraat 33, 9300 Aalst, Belgium, VAT BE 0729.544.225 ("processor"). It applies to personal data that the apps of the MVdW-Software app platform that connects to Exact Online process for the controller, in its Exact Online administrations and in other systems it connects, and meets Article 28 of the GDPR.

1. Subject, nature and duration

The processor retrieves, transforms, synchronizes and delivers the controller's data to the systems and apps the controller authorizes, so the apps can deliver their documented functions. Processing lasts as long as the controller uses an app and ends as set out in article 11.

2. Categories of data and data subjects

• Data subjects: the controller's contact persons, customers, suppliers, employees and users.
• Data: names, contact details, VAT numbers, invoices and bookkeeping data and, depending on the app, project, time and user data. Each app's documentation lists what it uses. The controller decides which categories it connects and does not connect special categories of data unless needed and lawful.

3. Instructions

The processor processes personal data only on documented instructions of the controller, which are these terms, the configuration of apps, permissions, API keys and authorized assistants, and the requests made with them. The processor informs the controller if it believes an instruction infringes data protection law.

4. Confidentiality

Everyone with access is bound by confidentiality, and access is limited to what is needed to run, support and secure the service.

5. Security

The processor takes appropriate technical and organizational measures, described on the security page and in the annex: least privilege and per-app permissions, protected sign-in with two-factor authentication for organization owners, encryption of stored credentials and caches and of data in transit, an audit log, and regular vulnerability scanning.

6. Storage

The processor does not store the controller's business data except what an app needs to function as documented and optional, encrypted caches of limited duration that the controller controls and that are erased when disabled.

7. Sub-processors

The controller gives general authorization for the sub-processors used to run the platform: an EU hosting provider and an email delivery provider. The current list is available on request. The processor imposes the same data protection obligations on them, remains responsible for them, and announces additions or replacements at least 30 days in advance; the controller may object on reasonable grounds, after which the parties look for a solution or the controller may cancel.

8. Transfers

Processing takes place in the European Economic Area. A transfer elsewhere only takes place under the safeguards of Chapter V of the GDPR.

9. Assistance

The processor assists the controller, with reasonable effort and taking into account the nature of the processing, with data subject requests, security, data protection impact assessments and prior consultations. Requests received directly from data subjects are passed on to the controller.

10. Personal data breaches

The processor notifies the controller without undue delay after becoming aware of a personal data breach affecting its data, with the information needed to meet notification duties.

11. End of processing

When the controller removes its organization or the agreement ends, the processor erases the connections, tokens, keys and caches. The audit log is kept for 30 days afterwards for security purposes and then erased. Invoices and accounting data are kept as the law requires. On request before removal, the controller can obtain its data from the apps' own interfaces.

12. Audits

The processor provides the information needed to demonstrate compliance and allows reasonable audits by the controller or an auditor it appoints, announced in advance, during business hours, without disrupting operations and subject to confidentiality.

13. Onward recipients

Systems and AI services the controller connects to an app are the controller's recipients, not the processor's sub-processors; the controller is responsible for them.

14. Custom services

If a project requires different or wider processing, the parties agree it in writing.

15. Liability, precedence and law

Liability is governed by the terms of service. If this agreement conflicts with the terms regarding personal data, this agreement prevails. Belgian law applies.

Annex: security measures

• Access control: per-app and per-administration permissions, no access by default, separate permissions for change and delete.
• Authentication: protected passwords, throttling of failed attempts, two-factor authentication for organization owners.
• Encryption: stored credentials, tokens and caches are encrypted; all traffic is encrypted in transit.
• Minimization: data is passed through; short-lived access for apps; access keys shown once.
• Logging: audit log of sign-ins, permission changes, connections and denied requests.
• Operations: EU hosting, hardened and isolated services, regular vulnerability scanning and updates.