Data processing agreement

Between Invoid Vision B.V., a Belgian limited company registered under KBO/BCE number 0777.887.045, with its registered office at Balegemstraat 17/7, 9860 Oosterzele, Belgium, trading as Dokus ("we"), and the company or person that holds the workspace ("you").

For the personal data in the documents and records you put into Dokus, you are the controller and we are the processor. For the data we collect to run your account and this website, we are the controller, and the privacy policy covers that.

If you give an accountant or bookkeeper access to your workspace, you are instructing us to show them its records. They see them read-only and cannot change them. That disclosure is your instruction, and what they do with the records afterwards is their responsibility as a separate controller.

Annex 1 sets out the subject matter, the duration, the nature and purpose of the processing, the categories of personal data and the categories of data subjects. In summary:

• Subject matter: the personal data contained in the documents, records and messages you put into Dokus, and the data needed to run your account.
• Duration: while you hold a workspace, and until deletion is complete under section 9.
• Purpose: storage, extraction, classification, matching, retrieval, invoicing and Peppol transmission, bank synchronisation, notifications, support, security and billing.
• Data subjects: you, your staff, your clients and suppliers, and anyone named in a document you upload.
• Data: identification and contact details, financial records, bank transaction data, invoice and contract content, and any other personal data a document contains.

We process the data only on your documented instructions. Those instructions are the Terms of Service, this agreement, and the choices you make in the product, such as connecting a bank, turning on email export or giving an accountant access.

We do not use your data for our own purposes and we do not sell it.

If an instruction appears to break data protection law, we tell you before we act on it, unless the law forbids us to.

Everyone who can access customer data is bound by confidentiality, whether they are staff or contractors. Access is limited to the people who need it for support, security or a legal obligation, and every access of this kind is recorded in your activity history.

We apply the technical and organisational measures in Annex 2. They cover access control, encryption in transit, encrypted backups, separation between tenants, logging, monitoring and incident response.

We do not claim certifications we do not hold. We hold no ISO 27001 or SOC 2 certificate, and the continuity page says so.

You authorise us to use the sub-processors listed in section 4 of the privacy policy. Each is bound by a data processing agreement with us and processes personal data only on our instructions.

That section also names the recipients that are not sub-processors. Bank connectivity is provided by Ponto, a service of Isabel NV/SA. Isabel NV/SA, and the bank you connect, act as independent controllers under PSD2, and no processing agreement applies to them.

We publish a new sub-processor on that page before it starts processing data for you, and the date at the top of this page changes with it. If you object on reasonable data protection grounds, you can stop using the affected feature or end the agreement. We will not treat an objection as a breach.

Hosted Dokus stores your documents and the records derived from them in Belgium. Some sub-processors are outside the European Economic Area, and the privacy policy names them. Those transfers are covered by the Standard Contractual Clauses (2021/914) and the additional safeguards the GDPR requires.

A private deployment runs in your own environment. This section applies only to the data you choose to send us for support.

The optional assistant, Ask, sends your question and the records needed to answer it to Anthropic PBC, United States, under a data processing agreement, and never as training data.

Where cloud document processing is configured, extraction and classification are performed by Anthropic as well. Where it is not configured, they run on infrastructure we operate in Belgium. Anthropic is named as a sub-processor for both purposes in the privacy policy.

No other part of Dokus sends document content to a model provider.

Your documents stay in your workspace while it is active.

When you delete a workspace inside the product, the request is recorded and can be cancelled for 30 days. After that the workspace is deleted: the documents, the records derived from them, the bank connections, the Peppol registration and the account data. Deletion is carried out by our team rather than automatically, and is complete within 30 days of the end of that window. We confirm in writing when it is done.

When you ask us by email to delete your account, we verify the request and complete the deletion within 30 days.

Some records survive deletion where Belgian law requires it. Invoices and accounting documents may be kept for up to 10 years, restricted to that legal purpose.

Operational history is kept for 24 months: the activity log and the assistant conversation history. Backups are kept on a rotation of 30 daily and 12 monthly copies, and are deleted as they rotate out.

If someone asks you for access to, correction of or erasure of data we hold for you, tell us and we will give you what you need to answer, within 10 working days. We do not answer the person directly unless you ask us to.

We help with a data protection impact assessment or a prior consultation where the processing makes one necessary.

We notify you without undue delay after we become aware of a personal data breach affecting your data, and in any event within 72 hours. The notification describes what happened, the data affected, the likely consequences and what we have done about it.

We keep a record of the breach and tell you what we have done to contain it.

You can ask us for what you need to show that the processing is compliant: this agreement, the sub-processor list, the measures in Annex 2 and answers to a security questionnaire. We answer security and procurement questions within one working day.

A visit to our premises or systems needs a written request, at least 30 days' notice and a confidentiality agreement. We agree the scope, the timing and who pays for it before the visit. We can meet the request with a report from an independent auditor instead.

Liability under this agreement is subject to the limitation of liability in the Terms of Service. Nothing here limits liability that cannot be limited by law.

This agreement runs for as long as we process data for you, and ends when deletion is complete.

We may change it to reflect a change in the service, the law or a sub-processor. The version and date at the top of the page change with it, and we publish the change before it takes effect. If a change materially reduces your rights, you can object and end the agreement.

Belgian law governs it. Disputes follow the governing law and jurisdiction clause in the Terms of Service.

This agreement is written in English. The other language versions are provided so that you can read it in your own language; if they differ, the English version prevails.

This annex sets out the processing described in section 2.

• Categories of personal data: identification and contact details; financial records such as invoices, receipts, bank statements and contracts; bank account identifiers, balances and transactions; correspondence and support messages; and any personal data contained in a document you upload.
• Categories of data subjects: you and your staff; your clients; your suppliers and other counterparties; and people named in your documents.
• Nature of the processing: collection, storage, extraction, classification, matching, retrieval, structuring, transmission and deletion.
• Purpose: keeping your records current, preparing and sending invoices over Peppol, matching bank transactions, reporting the VAT position, answering questions through Ask, exporting records to your accountant, and running the account.
• Duration: the term of the agreement, then the retention periods in section 9.
• Special categories: Dokus is not designed for special category data. If a document you upload contains it, it is processed on your instruction like any other content.

The measures we apply to the data described in Annex 1.

• Access control: authentication by email link or password, role-based permissions, and support sessions that are time-boxed and recorded in your activity history.
• Encryption in transit: TLS on every public endpoint, and TLS between the application and its database.
• Encryption at rest: backups are encrypted with restic before they leave the host. Document storage and the database sit on access-controlled volumes on infrastructure we operate.
• Separation: every query is scoped to a single workspace, and there is no cross-tenant read path.
• Logging: an activity log of every change, kept for 24 months, and alerts on failed sign-ins and unusual access.
• Backups: 30 daily and 12 monthly copies, encrypted, deleted as they rotate out.
• Monitoring: uptime and error alerts reach the people who build and run the service.
• Incident response: a single point of contact, the notification in section 11, and a written record of the incident.
• Deletion: as described in section 9, confirmed in writing.
• People: access limited to the people who need it, under confidentiality.