Skip to main content

Privacy Policy

Last updated: 26 March 2026

1. Data Controller

DPAkit is responsible for the processing of personal data as described in this privacy policy. For questions, please contact us at [email protected].

2. What Data Do We Process?

We process the following personal data:

  • Account data: first name, last name, email address and company name upon registration.
  • Usage data: login times, actions within the application and error messages, solely for improving the service.
  • Payment data: payment transactions are processed via Mollie B.V. DPAkit does not store payment card details.
  • Data you enter: information about your vendors and data processing agreements that you enter in DPAkit. You remain the data controller for this data; DPAkit acts as a data processor.

3. Purpose and Legal Basis

We process your data for the following purposes:

  • Performance of a contract (Art. 6(1)(b) GDPR) — to give you access to DPAkit and deliver the service.
  • Legitimate interest (Art. 6(1)(f) GDPR) — to analyse usage and improve the service.
  • Legal obligation (Art. 6(1)(c) GDPR) — to comply with accounting and tax obligations.

4. Retention Periods

We retain your personal data for as long as your account is active. After cancellation, account data is deleted within 90 days. Invoice data is retained for 7 years in accordance with statutory requirements.

5. Sub-processors

DPAkit uses the following sub-processors:

  • Hosting: the application and data are stored on servers located in the Netherlands.
  • Brevo (Sendinblue SAS): for sending transactional emails. Data transfers to the EU are covered by standard contractual clauses.
  • Mollie B.V.: for payment processing. Mollie is established in the Netherlands.

6. International Transfers

Your data is not transferred outside the European Economic Area as a matter of principle. Should this be necessary, we will put in place appropriate safeguards pursuant to Art. 46 GDPR.

7. Your Rights

Under the GDPR you have the following rights:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)

Requests can be submitted to [email protected]. We respond within 30 days.

8. Complaints

If you have a complaint about how we handle your personal data, you can file a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

9. Cookies

DPAkit uses only functional cookies necessary for the operation of the service (session authentication). No tracking or marketing cookies are placed.

10. Changes

We may update this privacy policy from time to time. The most current version is always available on this page. We will notify you by email of any material changes.