Legal
Data processing agreement
This is a translation. Only the Dutch version is legally binding.
When you use Kwantro, we process personal data of your employees on your behalf. The General Data Protection Regulation (GDPR, Article 28) then requires a data processing agreement. This is that agreement. It applies automatically when you order or use the service; the owner can explicitly accept it in the app (Settings → Privacy and data) and view the accepted version. For Enterprise customers a signed, customised version can also be concluded.
1. Parties and definitions
1.1 Controller (hereinafter: the customer): the business or organisation that uses the Kwantro service under the terms and conditions.
1.2 Processor (hereinafter: Kwantro): , Chamber of Commerce (KvK) , .
1.3 Terms such as personal data, processing, data subject, sub-processor and personal data breach have the meaning given in the GDPR. The terms service, owner, user, location and customer data have the same meaning here, also without capital letters, as in the terms and conditions.
2. Subject matter and duration
2.1 Kwantro processes, on the customer's instructions, the personal data needed to deliver the service, as described in Annex 1. The customer determines the purpose and means of the processing and warrants that it is lawfully permitted to have the data processed.
2.2 This agreement applies for as long as the agreement for the service exists, and thereafter for as long as Kwantro still holds personal data of the customer.
3. Instructions from the customer
3.1 Kwantro processes the personal data solely on the basis of written instructions from the customer. The agreement, this data processing agreement and the customer's use of the service's features and settings constitute those instructions. Kwantro does not process the data for its own purposes and does not sell it.
3.2 Kwantro may use technical usage data that cannot be traced to individuals (such as counts and performance) to secure and improve the service.
3.3 If Kwantro considers an instruction to be in breach of the GDPR or other legislation, it will inform the customer immediately and may suspend execution until the customer has amended or confirmed the instruction.
3.4 If Kwantro is legally required to disclose personal data to a public authority, it will inform the customer in advance, unless prohibited by law, and will limit the disclosure to what is required.
4. Security
4.1 Kwantro takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing, taking into account the state of the art, the costs, the nature of the data and the risks. The measures are set out in Annex 2. Kwantro may amend them as long as the level of security is not reduced.
4.2 The customer is responsible for security on its side: which users it invites, which roles and permissions it grants, whether it makes two-factor authentication mandatory, and whether users keep their login details confidential.
5. Sub-processors
5.1 The customer gives Kwantro general authorisation to engage sub-processors. The current list, with the task and place of establishment of each sub-processor, is in the privacy statement and forms an annex to this agreement.
5.2 Kwantro imposes on sub-processors the same obligations as set out in this agreement, insofar as applicable to their task, and remains responsible to the customer for their work.
5.3 Kwantro announces a new or replacement sub-processor that processes personal data of the customer at least 30 days in advance, by email to the owner and on the website. The customer may raise a reasoned objection within that period. If the parties cannot reach agreement, the customer may terminate the agreement as of the date on which the sub-processor is engaged; the prepaid amount for the remaining period will be refunded.
6. Transfers outside the EEA
6.1 The personal data is stored in the European Union (Ireland); only the encrypted nightly backup is held at GitHub (United States), with a key managed solely by Kwantro. Processing outside the European Economic Area takes place only by sub-processors from the list, with appropriate safeguards under Chapter V of the GDPR: an adequacy decision (including the EU-US Data Privacy Framework) or the EU standard contractual clauses, where necessary with supplementary measures such as encryption.
6.2 For the AI features, only the data needed for that single task is transferred (see Annex 1).
7. Data breaches
7.1 Kwantro reports a personal data breach affecting the customer's data without undue delay, and no later than 48 hours after discovery, by email to the owner. The notification contains, insofar as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed, and a point of contact. Information not yet available will follow as soon as it is.
7.2 Kwantro supports the customer with any notification to the Dutch Data Protection Authority and to data subjects. The customer decides whether and how to notify; Kwantro does not notify on the customer's behalf unless the customer requests it.
7.3 Kwantro keeps a register of breaches, their consequences and the measures taken.
8. Rights of data subjects and assistance
8.1 If Kwantro receives a request from a data subject (access, rectification, erasure, restriction, portability or objection) concerning the customer's data, it forwards the request to the customer and does not handle it itself, unless the customer asks it to.
8.2 Kwantro assists the customer through the tools in the service: the customer can add, modify and remove users, correct data, make a full export (JSON) and set retention periods. Where that is insufficient, Kwantro provides reasonable assistance. If that assistance requires disproportionate effort, Kwantro may charge a reasonable fee, after consultation.
8.3 Kwantro assists the customer, where necessary and reasonable, with a data protection impact assessment (DPIA) and with prior consultation of the supervisory authority, insofar as these relate to the service.
9. Confidentiality
9.1 Everyone at Kwantro with access to the customer's personal data is bound to confidentiality, by contract or by law. Access is limited to those who need it for their task.
9.2 Kwantro only accesses the customer's environment after explicit, temporary permission from the owner in the app (read-only, recorded in the audit log), or when strictly necessary to investigate an outage or security incident; this too is recorded.
10. Audits
10.1 Kwantro makes available to the customer all information necessary to demonstrate compliance with this agreement, including descriptions of the security measures and, where available, reports or certificates of the sub-processors.
10.2 The customer may, at most once a year and after written notice of at least 30 days, at its own expense conduct or commission an audit, including inspections, by an independent expert appointed by the customer and bound by confidentiality. The audit must not disrupt the service for other customers and gives no access to other customers' data. If the audit reveals a shortcoming, Kwantro remedies it within a reasonable period.
11. Liability
11.1 The liability of the parties under this agreement is governed by the provisions of the terms and conditions (Article 17), provided that this limitation does not apply insofar as Article 82 GDPR does not permit it.
11.2 The customer indemnifies Kwantro against fines and claims resulting from the customer acting in breach of the GDPR, including entering data that it is not permitted to have processed.
12. Termination and deletion
12.1 After the end of the agreement for the service, the customer may request an export of all data for up to 30 days afterwards (via the app or by email). Kwantro deletes the personal data, including files, 30 days after the end date, unless a statutory retention obligation applies (invoice data: 7 years).
12.2 Encrypted backups are deleted automatically after 90 days, so at most 90 days after deletion no backup contains the data any more. Backups are used only for recovery after an incident and are not searched separately.
12.3 On request, Kwantro confirms in writing that the deletion has been carried out.
Annex 1: the processing
| Subject matter | Providing Kwantro: inventory management per location with multiple users, including notifications, reports, integrations and support. |
|---|---|
| Purpose | Allowing the customer's users to sign in and collaborate, recording who performed which action (stock, counts, tasks, orders, loans, approvals), sending notifications and emails that users have switched on, and giving the customer insight and accountability. |
| Data subjects | Owners, managers and employees of the customer who use the app; invitees; possibly contact persons of the customer's suppliers (name, email address) and persons who borrow something (name). |
| Personal data | Name, email address, language, role and custom role, assigned locations, settings and notification preferences, push token, time of login, two-factor authentication status; actions in the service with timestamp (movements, counts, tasks, orders, loans, approvals, changes to settings); photos and files uploaded by users (packing slips, product photos, photos of loss, attachments) insofar as they show or contain individuals; the content of notes and questions to the assistant, insofar as they contain personal data. |
| No special categories of data | The service is not intended for special categories of personal data, citizen service numbers (BSN) or children's data. The customer does not enter such data. |
| Processing operations | Storing, consulting, modifying, deleting, backing up, sending email and push notifications, exporting, transferring to the AI supplier insofar as a user uses an AI feature (packing slip, photo, question and the required product and stock data). |
| Retention period | For the duration of the agreement; stock movements for as long as the owner sets (12 to 120 months or unlimited); audit log 3 years; after the end 30 days, backups 90 days. |
| Location | European Union (Ireland); encrypted backups at GitHub (US). Sub-processors outside the EEA: see the privacy statement. |
Annex 2: security measures
- Separation of customers: every table has a company key and row level security; access rules are tested automatically (database and API tests) with every change to the software.
- Access and authentication: accounts by invitation only; passwords as a hash; two-factor authentication (TOTP), can be made mandatory per company, also for Kwantro's administration environment; PIN per device; roles and permissions per user and per location; purchase prices shielded at column level.
- Encryption: TLS for all connections; storage at the hosting provider encrypted; backups encrypted (AES-256) with a key managed solely by Kwantro.
- Logging and monitoring: audit log per company (settings, roles, members, integrations, support access), activity log of stock movements, system log of errors (90 days), limits against abuse (login attempts, forms, API).
- Continuity: nightly backup with automatic restore test, kept for 90 days; public status page; hosting with providers holding their own certifications (Supabase/AWS, Cloudflare).
- Organisation: minimal access for Kwantro staff; support access only with permission and read-only; confidentiality; schema changes only via controlled migrations; no secrets in the source code; security headers and a content security policy on website and app.
- Data deletion: deletion of users and companies including files; automatic retention periods (movements, audit log, push tokens, logs); GDPR export and account deletion by the user themselves.