Data processing agreement
When you use Fyldd, we process personal data on your behalf. This data processing agreement (DPA) sets out how we do that, in line with article 28 GDPR. It forms part of the contract.
This translation is provided for convenience; only the Dutch version is legally binding.
1. Roles
For the data you enter into Fyldd about your customers and work, you are the controller and Bitvire is the processor. We process this data solely on your instructions and according to your directions, and not for our own purposes.
2. Types of data and data subjects
On your behalf we process, among other things:
- Data — name and contact details, addresses and locations, work orders, hours and materials, photos and signatures.
- Data subjects — your customers and contacts, and your own users (the people who work with the app).
3. Sub-processors
You give Bitvire permission to engage the following sub-processors. In the event of a replacement or addition we inform you in advance, so that you can object.
- Mollie B.V.: Verwerkt abonnementsbetalingen (iDEAL, SEPA-incasso) en bewaart de betaalstatus. Amsterdam, Nederland (EU).
- Hetzner Online GmbH: Levert de servers en database waarop Fyldd en jouw gegevens draaien. Duitsland / Finland (EU).
- Proton Mail (Proton AG): Verzendt en ontvangt transactionele e-mail (uitnodigingen, wachtwoordherstel, meldingen). Zwitserland, dat volgens een adequaatheidsbesluit van de Europese Commissie een passend beschermingsniveau biedt.
4. Security
We take appropriate technical and organisational measures: encryption of traffic (TLS), hashed passwords, strict separation of data per company (tenant isolation), role-based access and an audit log of changes. We make regular backups.
Administrative access by Bitvire. Authorised administrators of Bitvire may gain access to your data in order to deliver, secure, maintain and support the service — solely for those purposes, on a “need-to-know” basis and bound by confidentiality. We never use that access for our own purposes. Every instance of administrative access is recorded in a separate, tamper-proof log (who, when, which company). This access forms part of your instructions to us as processor (art. 28 GDPR).
5. Data breaches
If we discover a personal data breach that affects your data, we report it to you without undue delay, with the information you need to meet your own notification obligation towards the Dutch Data Protection Authority and data subjects.
6. Rights of data subjects
If you receive a request from a data subject (access, rectification, erasure, portability), we help you with it. You carry out many actions yourself in the app; for the rest you can ask us to assist.
7. Return and deletion
On termination of the contract you can export your data. After that we delete the personal data we process on your behalf within a reasonable period, unless we are legally required to keep it longer.
8. Where we process
Processing takes place within the European Union. For sending and receiving email we engage Proton Mail, which carries out this processing in Switzerland. Under an adequacy decision of the European Commission, Switzerland offers an adequate level of protection. We do not set up further transfers to third countries without appropriate safeguards.
9. Questions
Questions about this data processing agreement or need a separately signed copy? Email privacy@fyldd.com. See also our privacy statement.