Privacy policy
Last updated: 10 November 2026
This policy explains which personal data MVdW-Software processes when you visit this website, create an account on the portal, use our apps or contact us, why we do so, and what your rights are.
1. Who we are
The controller is MVdW-Software, Maxim Van de Wynckel, Draaiersstraat 33, 9300 Aalst, Belgium, VAT BE 0729.544.225. Contact for all privacy questions: info@mvdw-software.com. More about us: mvdw-software.com.
2. When we are controller and when processor
- Controller: for your account, billing, support and the security of the platform, we decide why and how your personal data is processed.
- Processor: the apps process data from your Exact Online administrations and from other systems you connect (for example GitLab) on your behalf and only on your instructions. For that data your organization is the controller and the data processing agreement applies. The documentation of each app lists exactly what it reads and stores.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, email address, language, password (stored as a one-way hash), two-factor settings, organization memberships and roles, sign-in events (time, IP address, device) | Providing, securing and supporting the platform | Contract; legitimate interest (security) |
| Billing data: organization name, billing address, VAT number, subscriptions, invoices and payment status. Card or bank details are handled by Mollie and never stored by us | Billing, accounting, preventing payment fraud | Contract; legal obligation |
| Support data: your messages, tickets and the information you send us | Answering your questions and solving problems | Contract; legitimate interest |
| Technical data: request logs, audit log (sign-ins, permission changes, connections, denied requests) and error reports, without business data, tokens or passwords | Security, abuse prevention, stability, accountability towards your organization | Legitimate interest |
| Service emails: verification, password reset, invoices, security and important service notices | Operating the service | Contract; legitimate interest |
| Data processed by the apps (Exact Online and connected systems) | Delivering the app you use | On your instructions, as processor |
We do not use your data for advertising, we do not sell it, and we do not take decisions about you based on automated processing. We only send marketing emails with your consent.
4. How long we keep it
- Account data: until you delete your account or your organization, after which it is erased except where we must keep it.
- Audit log: as long as your organization exists and for 30 days after it is removed, for security purposes.
- Billing data and invoices: as long as accounting law requires (currently 7 years).
- Support data: until the matter is resolved and for a reasonable period afterwards.
- Technical logs and error reports: for a limited period needed for security and stability.
- Data of the apps: not stored beyond what an app needs to function and the optional, time-limited cache you control; erased when you switch it off, disconnect or remove your organization.
5. Who receives your data
- Service providers (sub-processors) that help us run the platform: a hosting provider in the EU, an email delivery provider and Mollie for payments. The current list is available on request and is part of the data processing agreement.
- Systems you connect, such as Exact Online, GitLab or an AI assistant. They receive data because you instruct it, and they have their own privacy policies.
- Authorities, when the law requires it.
We do not sell personal data.
6. Transfers outside the EEA
We host in the EU and do not intend to transfer personal data outside the European Economic Area. If a provider ever does, we require an adequate level of protection, for example through the European Commission's standard contractual clauses.
7. Security
We protect personal data with technical and organizational measures such as access control, encryption and an audit log. See the security page.
8. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Mail us at info@mvdw-software.com; we answer within one month. If you think we process your data unlawfully, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be), or to the authority of your own country. If your data in an app concerns you as a customer of one of our customers, please contact that organization first.
9. Cookies and this website
We only use strictly necessary cookies (session and security), which need no consent. Your chosen language is stored in your browser. We use no tracking or analytics. This website loads its icons from a content delivery network (cdnjs, operated by Cloudflare), which means your IP address is visible to that provider when you open a page.
10. Children
The platform is meant for businesses and professionals and is not directed at children.
11. Changes
We may update this policy. For material changes we inform account holders at least 30 days in advance.