Data processing agreement

01Roles

You are the controller of the personal data in your bookkeeping (such as customer details on invoices). Admillio is the processor: we process that data solely on your behalf and according to your instructions, and never for our own purposes.

02Which data and for what purpose

This concerns personal data that appears in your bookkeeping:

• Contact and billing details of your customers and suppliers
• Data on receipts and in bank transactions
• Data of employees, insofar as you record it

03Sub-processors

For hosting, storage and bank connections we use a limited number of sub-processors, all with servers within the EU and bound by the same obligations. An up-to-date list is available on request; we will inform you in advance of any new sub-processors, so that you can object.

04Security measures

• Encryption of all connections (TLS) and of data at rest
• Access management based on least privilege and two-factor authentication
• Daily backups with separate storage
• Logging and monitoring of access to production systems

05Data breaches

If we discover a data breach affecting your data, we will inform you without undue delay, and no later than 48 hours after discovery, with all the information you need for any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

06Support with data subject rights

Do you receive a request from a customer for access, correction or deletion? You can handle it yourself with the export and management features in Admillio. If you cannot resolve it, we will help within a reasonable period.

07Audits

Once a year you may (at your own expense) have an audit carried out or ask us for our most recent security documentation. We will reasonably cooperate with this.

08Term and termination

This agreement applies for as long as you have an Admillio account. On termination you can export all data; we then delete it, except for what we are legally required to retain.