Draft — to be finalized with legal counsel before launch.

Data processing agreement

This agreement applies to personal data in your Exact Online administrations that Exact Gateway processes for you (Art. 28 GDPR).

• Roles. Your organization is the controller; MVdW-Software is the processor.
• Subject and duration. Retrieving, transforming and delivering your Exact Online data to the systems and apps you authorize, for as long as your subscription runs.
• Categories. Contact persons, customers and suppliers (names, contact details, VAT numbers), invoices and bookkeeping data.
• Instructions. We process only to deliver the requests your API keys and authorized apps make, within the permissions you set.
• Confidentiality and security. Measures as described on the security page: encryption at rest and in transit, least privilege, two-factor authentication, audit logging, daily vulnerability scanning.
• Storage. No storage of Exact data except the optional, encrypted cache (at most 24 hours), erased when disabled.
• Sub-processors. EU hosting provider; email delivery provider. We inform you of changes in advance.
• Assistance. We help with data subject requests, breach notification (without undue delay) and data protection impact assessments.
• End. Deleting your organization erases its connection, tokens, keys, cache and audit data; invoices are kept as required by law.
• Onward recipients. Systems and AI services you connect to the gateway are your recipients, not our sub-processors.