Legal
Privacy statement
This is a translation. Only the Dutch version is legally binding.
Kwantro is inventory management software. In providing it we process personal data: of visitors to this website, of people who order or get in touch, and of our customers' employees who use the app. Here you can read exactly what we process, why, for how long, and with whom.
1. Who we are
, registered with the Dutch Chamber of Commerce (KvK) under number , located at , is the provider of Kwantro (website kwantro.com and app app.kwantro.com). Questions about privacy can be sent to . We do not have a data protection officer: our core activities do not consist of large-scale monitoring of individuals or the processing of special categories of personal data, so this is not required.
2. Two roles
- We are the controller for the data of website visitors, of people who order or fill in the contact form, of customers' contact persons and owners, and for invoicing and support.
- We are the processor for the data that customers and their employees enter in the app: names and email addresses of users, their role and locations, who carried out which stock movement, count or task, photos and attachments. The customer (your employer or client) is the controller for that data; we act in accordance with the data processing agreement and the customer's instructions.
3. Which data, why and for how long
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Order: company name, Chamber of Commerce (KvK) and VAT number, billing address, name and email address of the owner, phone number (optional), chosen plan and location names | Processing the order, creating the environment, invoicing | Performance of the contract; legal obligation (accounting records) | Invoices and invoice data 7 years (statutory tax retention). An unpaid order: 2 years |
| Payment data: payment status, payment method, Mollie reference, possibly a direct debit mandate | Processing and verifying payments | Performance of the contract | 7 years with the invoice. We never see account or card numbers; Mollie processes those |
| Account: name, email address, password (encrypted only, as a hash), language, two-factor authentication, time of login | Signing in, security, the app in your language | Performance of the contract (on behalf of the customer) | As long as the account exists. If you delete your account, immediately; if the customer ends the contract, 30 days afterwards |
| Use in the app: role, locations, stock movements, counts, tasks, orders, loans, approvals, with name and time | Inventory management and accountability for the customer | Performance of the contract (on behalf of the customer) | As long as the customer uses the service; the owner can have movements deleted automatically after 12 to 120 months. After the end: 30 days |
| Photos and files: packing slips, product photos, photos of loss, attachments, company logo | Updating stock, recognising products, substantiating write-offs | Performance of the contract (on behalf of the customer) | As long as the customer uses the service. After the end: 30 days |
| Audit log: who changed settings, roles, members or integrations and when, and when support had access | Security and accountability towards the customer | Performance of the contract (on behalf of the customer); recording support access: our legitimate interest | 3 years |
| Contact form and email to support@, info@ or facturen@: name, company, email address, phone number (optional), your message | Answering your question, arranging a demo or quote | Performance of (pre-)contractual measures; legitimate interest | Up to 2 years after the last contact |
| Notifications: push token of your phone or browser, your notification preferences | Sending notifications you have switched on yourself | Performance of the contract; you can switch them off at any time | Until you switch notifications off; a token not used for 180 days is deleted |
| Technical logs: IP address (for orders and contact only as a hashed value, against abuse; when signing in, our login system keeps the IP address of the session for as long as it exists), time, error messages | Security, preventing abuse, resolving incidents | Legitimate interest | Our own logs 90 days; connection logs at our hosting providers shorter |
| Database backups | Recovery after an incident | Legitimate interest | 90 days, encrypted |
We collect no more than necessary: no date of birth, no citizen service number (BSN), no special categories of personal data. Kwantro is not intended for such data and customers agree not to enter it.
Emails we send. Activation and invitation emails, password resets, invoices and payment reminders are part of the service and cannot be switched off. The weekly overview, the weekly story and the email about new versions you switch on or off yourself in the app. We send no newsletters or advertising.
4. Suppliers (sub-processors)
We do not sell data and share it only with suppliers needed to deliver the service. With each of them we have a data processing agreement or their data processing terms apply.
| Supplier | Purpose | Where |
|---|---|---|
| Supabase | Database, file storage, authentication and the app's functions | Amazon Web Services data centre in Ireland (EU) |
| Cloudflare | Serving the website and the app (hosting, connection security) and forwarding email sent to our addresses | Cloudflare Inc. (US), with servers in the EU; EU standard contractual clauses |
| Google (Gmail) | Storage of email you send to support@, info@ or [email protected] | Google Ireland Ltd. (EU) / Google LLC (US); Data Privacy Framework and EU standard contractual clauses |
| Resend | Sending email: activation, invitations, password resets, invoices, weekly overview, confirmations | Resend Inc. (US); EU standard contractual clauses |
| Mollie | Payments and direct debit mandates. Mollie receives the data needed for the payment; we never see account or card numbers | Mollie B.V., Amsterdam (EU) |
| Anthropic | AI features, only if you use them (see 7) | Anthropic PBC (US); EU standard contractual clauses; data is not used to train models |
| Expo | Delivering push notifications in the mobile app (only if you switch notifications on) | Expo (650 Industries, US); EU standard contractual clauses |
| Push services of Apple, Google and Mozilla | Delivering notifications in the browser or on the phone (only if you switch notifications on). The content of browser notifications is encrypted; the push service cannot read it | US, with EU standard contractual clauses |
| GitHub | Storage of the nightly backups, encrypted with a key that only Kwantro holds | GitHub Inc. (US); EU standard contractual clauses |
If a new supplier is added that processes customers' personal data, we inform owners at least 30 days in advance (see the data processing agreement).
5. Transfers outside the EU
Your data is stored in the EU (Ireland). Only the encrypted nightly backup is held at GitHub (US), under the EU standard contractual clauses and with a key that only Kwantro holds. Some suppliers are based in the United States or may access data there, for example for support. For this we rely on the EU standard contractual clauses and, where the supplier is certified, the EU-US Data Privacy Framework. For the AI features, only the data needed for that single request is sent.
6. Security
- Each company's data is separated at database level (row level security); this is tested automatically with every change to the software.
- Connections are encrypted (HTTPS/TLS). Passwords are stored only as a hash. Purchase prices are shielded at column level from anyone not permitted to see them.
- Two-factor authentication is available and can be made mandatory by the owner; the app can be locked with a PIN that is stored only on the device.
- An encrypted backup every night, with an automatic restore test. Backups are kept for 90 days.
- Our staff only access a company environment after explicit, temporary permission from the owner, read-only and recorded in the audit log.
- Changes to settings, roles, members and integrations are recorded in the company's audit log.
We report data breaches to the affected customers without undue delay (within 48 hours of discovery at the latest) and, where required, within 72 hours to the Dutch Data Protection Authority.
7. AI features
Some features use artificial intelligence from Anthropic: reading packing slips, counting a shelf from a photo, the assistant, the usage forecast, the weekly story and summaries. Only when a user uses such a feature do we send the packing slip or photo, the question and the product and stock data required for it to Anthropic. Employee names are not included, unless they appear in a packing slip, photo or question. Anthropic does not use the data to train models and keeps it no longer than necessary for the response and for abuse monitoring. AI outputs are suggestions; a human checks them before anything is booked. No automated decisions with legal effects for individuals are made.
8. Your rights
You have the right to access, rectification, erasure, restriction and portability of your data, and to object to processing based on legitimate interest.
- Do you use the app through your employer or client? Then they are the controller for your data. First contact the owner of the company in Kwantro; we will assist them. In the app you can change your name, language and password yourself, export your own data and delete your account (unless you are the only owner of a company).
- For all other data (orders, invoices, contact) email . We respond within one month. To be sure it is really you, we may ask you to email from the address we have on file.
If you disagree with how we handle your data, we would like to hear from you. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Cookies and storage
This website places no cookies and uses no analytics or advertising services. We also load fonts and videos from our own servers, so your IP address is not sent to third parties. The app only uses storage in your browser or on your phone that is needed to stay signed in, remember your preferences and work offline. Everything is listed in the cookie statement.
10. Changes
We update this statement when our service or the law changes. The date at the top shows when that last happened. In the event of a material change we inform owners by email or in the app.