Easyclose Privacy Statement

Version: [version x]. Effective date: [date].

1. About this privacy statement

Easyclose is a Dutch online service for financial reporting, month-end close and consolidation for SMEs. In this privacy statement we explain in plain language which personal data we process, why we do so, how long we keep them and which rights you have.

We have written this document so that you can quickly find what you are looking for. Capitalised terms (such as Customer, User, Service, Customer Data, Website and Processor Agreement) have the same meaning as in the Easyclose general terms and conditions.

Who does this privacy statement apply to? This privacy statement applies to everyone whose account, contact, billing or usage data we process. That is first of all the Customer who creates an Account, but also the Users invited by a Customer to work in an environment (such as team members or staff of a bookkeeping or accountancy firm). When a Customer adds you as a User, we receive your name, email address and role from that Customer. In that case, that Customer is the source of these data. We process these data as controller in order to arrange your access, for security and for the audit log.

The privacy statement is an information document. It is not part of the agreement, but explains how we handle personal data. For the financial data that you enter into Easyclose yourself, a separate Processor Agreement applies (see below).

2. Important distinction: what this document does and does not cover

At Easyclose there are two kinds of personal data, each with its own role and its own document. This distinction matters, so we set it out clearly right away.

In plain language: the data with which you log in, pay and communicate with us are Easyclose's own responsibility, and this privacy statement explains how we handle them. The figures you enter into Easyclose are your responsibility: you determine why and how they are processed, you are the controller for them and we are your processor. We process those data exclusively according to your instructions and according to the Processor Agreement. How we shield and secure that Customer Data is described in the Processor Agreement.

This privacy statement therefore only covers the data in the left-hand column: the personal data for which Easyclose is itself the controller.

The time limit within which Easyclose informs the Customer of a data breach affecting the Customer Data is governed by the Processor Agreement (Article 8.2). That time limit is separate from your own statutory 72-hour notification period towards the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

3. Who is responsible and how to reach us

The controller for the data referred to in this statement is:

[legal form and registered name], trading under the name Easyclose, with its registered office at [registered office address], registered in the trade register of the Dutch Chamber of Commerce (Kamer van Koophandel) under number [Chamber of Commerce (KvK) number], VAT identification number [VAT identification number].

Easyclose is the controller for the account, contact, billing and usage data referred to in this privacy statement.

Contact for privacy questions: you can reach us via [name of contact person] at the email address hallo@easyclose.nl. For questions about this privacy statement, for exercising your rights or for other privacy matters, you can always use this address.

Data protection officer. We are not legally required to appoint a data protection officer and we do not have one. Our core activity is not aimed at large-scale, systematic monitoring of individuals or at large-scale processing of special categories of personal data. If you have a privacy question, you can always contact us via hallo@easyclose.nl.

4. Which personal data we process, for what purposes and on which legal basis

Below you can see, per category, which data we process, what we use them for and on which legal basis (Article 6 GDPR). The retention periods are set out in chapter 5.

Some of these data we receive directly from you. If a Customer adds you as a User, we receive your name, email address and role from that Customer (the source of those data), as explained in chapter 1.

4.1 Account data

What: your first name and surname, position, email address, your password (which we store exclusively in encrypted, irreversible form, a so-called hash, so that no one can read it back), whether you have verified your email address, any two-factor authentication setting, the name of your Organisation, your role in it (such as owner, administrator or reader) and your personal preferences in the app (such as a chosen font).

What for: to create your Account, let you log in, arrange your access and the shielding of your data, and secure your Account.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR). Without these data we cannot offer you a working Account.

4.2 Contact and support data

What: the content of your emails and support requests, and the data you provide to us in that context.

What for: to answer your questions, support you and be able to demonstrate our service provision.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR) for support that belongs with your subscription, and our legitimate interest (Article 6(1)(f) GDPR) in good communication and being able to retrieve earlier contact.

4.3 Billing and payment data

What: the name of your Organisation, the name and contact details of your billing contact person, the invoicing address, the VAT number, the Chamber of Commerce (KvK) number, the IBAN and the payment status of your subscription. The full payment details (such as a complete account number or card number that you enter when paying) run through our payment service provider; we do not keep those ourselves.

What for: to invoice and collect payment for your subscription and to comply with our administrative and invoicing obligations.

Legal basis: performance of the agreement (Article 6(1)(b) GDPR) and a legal obligation (Article 6(1)(c) GDPR), in particular the statutory tax retention obligation.

4.4 Usage, log and security data

What: technical data about your use of the Service, such as login times, technical log files, error messages and data needed to detect misuse and malfunctions. For detecting errors in the production environment we may use error monitoring.

What for: to make the Service work technically, secure it, prevent misuse and fraud, detect errors and improve the Service.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR). The specific interest here is: the security of the Service and the prevention of misuse and fraud, the technical operation and improvement of the Service, and the ability to investigate incidents. For analysis and improvement we use data where possible in anonymised or aggregated form that cannot be traced back to you. You may object to processing on this basis (see chapter 10).

4.5 Administrative data (audit log)

What: we record certain administrative actions in an immutable log (a so-called append-only audit log). It records, among other things, which user performed which administrative action and at what time.

What for: to be able to demonstrate the security and traceability of sensitive actions (accountability) and to protect your data.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in security, verifiability and the protection of your data.

4.6 Data of the built-in AI assistant

What: when you use the built-in AI assistant, we record for which components you have given consent (mapping, amounts and import) and who gave that consent, and we keep a usage counter. The AI assistant only gains access to certain data after you have given express consent for each component; you can manage that consent at any time within the Service.

What for: to make the AI assistant work according to your consent and to be able to track its use.

Legal basis: your consent per component (Article 6(1)(a) GDPR) for the access of the AI assistant, and performance of the agreement (Article 6(1)(b) GDPR) for being able to offer this feature. We do not use Customer Data for training or fine-tuning AI models, and through the Processor Agreement we ensure that our AI supplier is contractually prohibited from doing so as well. This feature is offered as soon as and insofar as it is available in the Service.

4.7 Waiting list sign-up

What: your email address and the name of your organisation, if you sign up for our waiting list before go-live.

What for: to be able to inform you as soon as you can create an Account and to keep you informed about the go-live.

Legal basis: your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time; after that we delete your sign-up.

4.8 Newsletter and marketing (if applicable)

What: your email address and organisation name, if you sign up for a newsletter or similar messages.

What for: to inform you about updates and news about the Service.

Legal basis: your consent (Article 6(1)(a) GDPR), with an unsubscribe option in every message. If you withdraw your consent, we stop sending.

4.9 Website visitor data

What: aggregated data about visits to our Website that cannot be traced back to you, such as the number of visitors and which pages are viewed. For this we primarily use a privacy-friendly, cookieless measurement method. If you give consent for it, we additionally use Google Analytics, which places cookies; see chapter 6.

What for: to see how our Website is used and to be able to improve it.

Legal basis: for the cookieless measurement, our legitimate interest (Article 6(1)(f) GDPR) in insight into and improvement of our Website; because that measurement is cookieless and does not identify you, no consent is required for it. For Google Analytics the legal basis is your consent (Article 6(1)(a) GDPR); we only load this measurement after you have agreed via our cookie notice, and you can withdraw your consent at any time.

Do you have to provide these data? To create and use an Account we need at least your email address and (for invoicing) your organisation and billing details. Without those data you cannot take out an Account or subscription. The other data are optional or arise automatically through the use of the Service.

5. Retention periods

We do not keep personal data longer than necessary. Per category we apply the following principles:

• Account data: as long as your Account is active, and thereafter briefly for winding up and our administration. After deletion, your data may still be present for a short time in encrypted backups, until those backups disappear within the regular backup cycle. The separate arrangement that you can still retrieve or have restored your own data for three months after the end of the agreement concerns the Customer Data and is governed by the Processor Agreement and the general terms and conditions, not by this privacy statement.
• Billing and administrative data: seven years, on the basis of the statutory (tax) retention obligation.
• Contact and support communication: up to a maximum of two years after handling, for follow-up and as evidence of what was agreed.
• Usage, log and security data: briefly, in principle between thirty and ninety days, unless we need them longer in connection with an incident.
• Security log (audit log): this log is immutable (append-only) and is retained for as long as necessary for accountability and security.
• Website visitor data: the cookieless measurement is aggregated and cannot be traced back to you. For Google Analytics we apply a limited retention period (14 months by default) at the level of the measurement data.
• Waiting list, newsletter and marketing: until you withdraw your consent or until the purpose lapses (for example after go-live for the waiting list).

If no statutory period applies to certain data, we do not keep them longer than necessary for the purposes for which we collected them.

6. Cookies, local storage and the account-free Demo

Functional storage (necessary). To let you log in and make the Service work, we store necessary data in your browser, such as your login or session token and a local cache (a copy of your environment, so that the app loads quickly). This is strictly necessary, functional storage and not a form of tracking. The local cache stays in your browser and is not used for other purposes; it disappears when you log out or clear your browser storage. No consent is required for this.

Privacy-friendly, cookieless visitor measurement. To see how our Website is used, we additionally measure visits in a privacy-friendly, cookieless way (via Cloudflare Web Analytics and a simple visitor counter). No cookies are placed and visitors are not tracked across different websites. Any session identifier is anonymous and disappears as soon as you close the tab. Because this measurement is cookieless and does not identify you, no consent is required for it.

The account-free Demo. On our Website you can try a Demo with fictitious data. This Demo runs entirely locally in your browser, without an Account. No financial data are sent to Easyclose and none of your figures are stored on our servers. Whatever is stored locally in your browser, you can delete yourself by clearing your browser's storage. The visitor measurement described above (including Google Analytics, with your consent) may also apply to the Demo page.

7. With whom we share data (sub-processors)

We do not sell your data. We share them only with service providers who work on our behalf and under our instructions (sub-processors), and only insofar as necessary to provide the Service. We conclude processor agreements with these parties. In outline, these are service providers for:

• Hosting and database: storage of data, authentication and backups, with a hosting region within the European Union (Frankfurt).
• Infrastructure, static hosting and the MCP server: making the Website and the app available, protection against attacks, email routing and the privacy-friendly visitor measurement.
• Sending transactional email: such as verification and password recovery messages; this takes place within the European Union (Ireland).
• AI functionality: for the built-in AI assistant, as soon as and insofar as this feature is available.
• Website statistics: for measuring website use with Google Analytics, exclusively for visitors who have given consent for this via our cookie notice (see chapter 6).
• Error monitoring: for detecting errors in the production environment, as soon as and insofar as this feature is available.
• Payments and invoicing: as soon as paid subscriptions become available, via a payment service provider and a bookkeeping service for our own administration.

A current list of these sub-processors stating their names, including their processing location, is included as an annex to the Processor Agreement and is additionally available from us on request via hallo@easyclose.nl.

We may additionally share data when the law obliges us to do so, for example on the basis of a court or government order. We base such disclosure on compliance with a legal obligation (Article 6(1)(c) GDPR) or on our legitimate interest (Article 6(1)(f) GDPR).

8. Transfers outside the European Economic Area

We deliberately choose storage and processing within the European Union: our database and backups are located in the Frankfurt region, and where possible we use EU regions with our service providers. The sending of transactional email also takes place within the European Union (Ireland).

Some of our service providers may process personal data outside the European Economic Area (EEA), or have a parent company outside the EEA. At present, this generally concerns the following situations:

• the supplier of the AI functionality (as soon as and insofar as the built-in AI assistant is available);
• Google Analytics for website statistics (exclusively for visitors who have given consent for this), whose supplier has a parent company in the United States;
• the error monitoring, depending on the chosen region (as soon as and insofar as this feature is available);
• the infrastructure and hosting party for the Website, the app and the protection against attacks, which has a parent company outside the EEA (in the United States).

Insofar as personal data are processed outside the EEA in that context, we ensure an appropriate transfer mechanism in accordance with the GDPR. As a rule, this is done via the standard contractual clauses adopted by the European Commission (Standard Contractual Clauses), with additional measures where necessary, or on the basis of an adequacy decision. Which parties process outside the EEA at which time and on which basis can be found in the sub-processor list, stating names, annexed to the Processor Agreement. You can request a copy of the safeguards applied from us via hallo@easyclose.nl.

9. How we secure your data

We take appropriate technical and organisational measures to protect your data. In plain language, this comes down to, among other things:

• Data isolation per organisation. The data of each organisation are shielded from one another at database level (with so-called Row Level Security), so that an organisation can see only its own data and cannot view or modify the data of other organisations.
• Encryption. Data are encrypted in transit (via TLS/HTTPS) and stored encrypted at rest.
• Passwords in irreversible form. We keep passwords only in encrypted (hashed) form, never as readable text.
• Access management. We work with roles, mandatory email verification and the option of two-factor authentication.
• Backups within the European Union.

A more detailed explanation of our security can be found on the security page on the Website.

10. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Access: you may request which personal data we process about you.
• Rectification: you may have incorrect or incomplete data corrected or supplemented.
• Erasure ("right to be forgotten"): you may in certain cases request the deletion of your data.
• Restriction: you may in certain cases request that the processing be temporarily suspended.
• Portability (data portability): you may receive your data in a common format or have them transferred. For your own data, the Service offers a built-in export function for this, with which you can download a complete copy of your data as a single file at any time.
• Objection: you may object to processing that we base on our legitimate interest.
• Withdrawal of consent: insofar as we process data on the basis of your consent, you may withdraw that consent at any time. Withdrawal applies for the future and does not make the processing before the withdrawal unlawful.

How do you exercise your rights? Send a request to hallo@easyclose.nl. To protect your privacy, we may ask you to confirm your identity. We respond in principle within one month; in the case of a complex or extensive request we may extend that period by a maximum of two months and we will let you know in good time.

Please note: if it concerns personal data within the Customer Data (the financial records that you process in Easyclose yourself), then you are the controller for those data. Requests from data subjects concerning those data are handled by you; we support you in this as described in the Processor Agreement.

Complaint to the supervisory authority. If you disagree with how we handle your data, we would appreciate it if you contact us first via hallo@easyclose.nl, so that we can work it out together. In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

11. No automated decision-making

We do not take decisions with legal effects for you, or decisions that similarly significantly affect you, that are based solely on automated processing or profiling.

The built-in AI assistant and the MCP server work on the financial Customer Data under your own responsibility and exclusively with the access rights of the logged-in User. They make suggestions and answer questions, but do not take decisions about you as a person and do not automatically determine your access or treatment. The Processor Agreement applies to the processing of personal data within the Customer Data.

For analysis and improvement of the Service we use data where possible in anonymised or aggregated form that cannot be traced back to you.

12. Changes to this privacy statement

We may adjust this privacy statement from time to time, for example in the case of new features or changed regulations. The current version is always on the Website. In the event of important changes we will inform you, for example by email or via a notification in the Service.

We provide each version with a version number and a date, and we keep a record of which version applied at which time.

Version: [version x]. Last updated: [date].