Data processing agreement
This agreement sets out how we process personal data on your behalf when you use evoicely, as required by Article 28 of the General Data Protection Regulation (GDPR). It is part of our terms of service and applies automatically when you connect Stripe to evoicely. You don't need to sign anything.
Last updated: 19 October 2026
1. Parties and roles
You, the business that uses evoicely, are the controller of the personal data in your invoices. We, avirai (eenmanszaak, owner Koen Dercksen, KvK 97665916, hello@evoicely.com), operate evoicely and are your processor.
This agreement does not cover your own account data, such as your Stripe account ID, email address, business details and subscription. For that data we are the controller; see our privacy policy.
2. What we process and why
The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are described in Annex 1. We process the data only to provide evoicely to you.
3. Your instructions
We process the personal data only on your documented instructions. Your instructions are these terms and this agreement, and the choices you make in evoicely, such as switching email delivery on or off. We don't use the data for our own purposes.
If the law requires us to process the data in another way, we tell you before we do so, unless the law forbids that. If we believe an instruction breaks the GDPR or other data protection law, we tell you.
4. Confidentiality
Anyone we authorise to process the personal data is bound by confidentiality.
5. Security
We take appropriate technical and organisational measures to protect the personal data, as required by Article 32 GDPR. Annex 2 describes them. We may update these measures, as long as the level of protection does not go down.
6. Subprocessors
You give us general authorisation to use subprocessors. The current subprocessors are listed in Annex 3.
We tell you by email at least 30 days before we add or replace a subprocessor. If you object on reasonable data protection grounds, tell us within that period. If we can't resolve your objection, you can end your subscription before the change, and we refund prepaid fees for the period after that.
We bind each subprocessor to data protection obligations that offer at least the same protection as this agreement. We remain responsible to you for our subprocessors.
7. Transfers outside the EU
We store the personal data in the EU. We only transfer it outside the European Economic Area with a valid safeguard under Chapter V GDPR, such as the EU standard contractual clauses. Annex 3 shows where this applies.
8. Helping you
Your customers may ask you to exercise their rights, for example to access or delete their data. You can download every e-invoice from your evoicely account, and the data comes from your own Stripe account. If you need more help, we assist you as far as reasonably possible. If a data subject contacts us directly about your invoices, we pass the request on to you and don't answer it ourselves.
Taking into account the nature of the processing and the information available to us, we also help you meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
9. Personal data breaches
If we become aware of a personal data breach affecting your data, we notify you without undue delay, and where possible within 48 hours. We tell you what we know about the nature of the breach, the likely consequences and the measures we have taken or propose, and we send further details as we learn them.
10. End of processing
While your Stripe account is connected, you can download your e-invoices at any time. When you disconnect, we stop processing new invoices. We delete the personal data 90 days after you disconnect, unless the law requires us to keep it. Within those 90 days you can reconnect and download your e-invoices.
11. Demonstrating compliance
We give you the information you reasonably need to show that we meet this agreement. If that is not enough, you may have an audit carried out by an independent auditor bound by confidentiality, at your cost, at most once a year and with at least 30 days' notice. Audits must not disrupt our operations or reveal other customers' data.
12. Liability and precedence
The liability terms in our terms of service apply to this agreement, as far as the law allows. If this agreement and the terms conflict on the processing of personal data, this agreement prevails. This agreement lasts as long as we process personal data on your behalf. It is governed by Dutch law.
Annex 1: Description of the processing
| Subject matter | Converting your Stripe invoices and credit notes into e-invoices, and delivering them. |
|---|---|
| Nature of the processing | Fetching finalized invoices and credit notes from your connected Stripe account; converting them to XRechnung (UBL XML) and ZUGFeRD EN 16931 (PDF/A-3 with XML); validating them against the official rules; storing them and offering them for download in your account; and, only if you switch on email delivery, emailing them to your customer. |
| Purpose | Providing evoicely to you under the terms of service. |
| Data subjects | Your customers who are natural persons, and contact persons at your customers, as far as they appear in your invoices. |
| Types of personal data | Names, postal addresses, email addresses, VAT IDs, and invoice and credit note contents such as invoice lines, amounts, dates and numbers. |
| Special categories | None intended. Don't put special categories of personal data (Article 9 GDPR) in your invoices. |
| Duration | While your Stripe account is connected to evoicely, plus 90 days after you disconnect. |
Annex 2: Security measures
- All data is stored on servers in the EU.
- All connections to evoicely and to Stripe use encryption in transit (HTTPS/TLS).
- We don't store your Stripe login tokens. We only read invoices, credit notes, customers and tax rates from your Stripe account.
- Each seller can only see their own documents. Sign-in to your account goes through Stripe.
- Access to our admin tools requires a password and a one-time code (two-factor authentication).
- We keep only the data needed to create, deliver and store your e-invoices, and delete it as described in this agreement.
- We don't track whether recipients open the emails we send for you.
Annex 3: Subprocessors
| Subprocessor | What for | Where |
|---|---|---|
| Contabo GmbH (Germany) | Server hosting: storage and processing of all data | Data centre in France |
| Resend, Inc. (USA) | Sending e-invoices by email, only if you switch on email delivery | EU sending region (Ireland). Transfers to the USA are covered by Resend's data processing agreement, which includes the EU standard contractual clauses. |
| Anthropic, PBC (USA) | AI assistant we use to operate and maintain evoicely. It can process data stored on our servers, for example when we investigate a problem with a conversion. | USA. Transfers are covered by Anthropic's data processing agreement, which includes the EU standard contractual clauses. |
The invoice data comes from your own Stripe account, so Stripe is your provider, not our subprocessor. For our own subscription billing we use Stripe Payments Europe, Ltd. (Ireland), which receives only your account and billing data, not your customers' data; see our privacy policy.
Peppol delivery is not available yet. The Peppol access point we will use will be added to this list before Peppol delivery starts.