Demo
Verwerkersovereenkomst

Bij Qbil Software B.V., het beschermen van persoonsgegevens en het handhaven van de hoogste normen op het gebied van informatiebeveiliging zijn fundamenteel voor onze werkwijze. Wij verwerken persoonsgegevens in overeenstemming met de toepasselijke wetgeving inzake gegevensbescherming, waaronder de Algemene verordening gegevensbescherming (AVG).

Wanneer klanten gebruiken Qbil-Handel of Moo Software, kan Qbil persoonsgegevens namens hen verwerken. Deze pagina bevat onze standaard Verwerkersovereenkomst, waarin onze verantwoordelijkheden als verwerker en onze toewijding aan de bescherming van persoonsgegevens worden beschreven.

Ons informatiebeveiligings- en privacybeheerprogramma wordt ondersteund door internationaal erkende normen, waaronder ISO/IEC 27001, ISO/IEC 27701, en onze NIS2-nalevingskader.

Raadpleeg onze voor informatie over de externe dienstverleners die wij inschakelen ter ondersteuning van onze diensten. Subverwerkers pagina.

Verwerkersovereenkomst

Qbil Software B.V. | Qbil-Trade and Moo Software | Version 2.2

This Data Processing Addendum (DPA) forms part of the agreement between Qbil Software B.V. (Qbil) and the customer identified in that agreement (Customer) for processing personal data in Qbil-Handel en Moo Software. It takes effect for a Customer only when a person authorised to act for that Customer expressly accepts this version. References to the GDPR mean Regulation (EU) 2016/679.

1. Roles and instructions
  • The Customer is the controller and determines the purposes and essential means of processing Customer Personal Data.
  • Qbil is the processor and processes it only on documented instructions from the Customer, including the service agreement and the Customer’s configuration and use of the services, unless EU or Member State law requires otherwise.
  • In that case Qbil informs the Customer before processing, unless the law prohibits this on important grounds of public interest.
  • Qbil will promptly inform the Customer if, in Qbil’s opinion, an instruction infringes the GDPR or other applicable EU or Member State data protection law.
  • Qbil will ensure that personnel authorised to process Customer Personal Data are subject to confidentiality obligations.
2. Description of processing
  • Processing lasts for the term of the services and the deletion periods in section 7.
  • Its subject matter is the personal data the Customer enters into, generates through, or otherwise makes available in the services.
  • The purpose is to provide ERP software for commodity and ingredient trading, including hosting, support, maintenance, backups, security and, where enabled for the Customer, product usage analytics.
  • Processing may include collection, recording, organisation, storage, retrieval, consultation, transmission, restriction, erasure and backup.
  • Data subjects may include the Customer’s users, staff, business contacts, suppliers, customers and other people whose information the Customer enters.
  • Data categories may include names, business contact details, user identifiers and authentication data, transactional and operational records, support communications and, if enabled, analytics events and session interaction data.
  • The Customer should not enter special categories of personal data unless separately agreed and appropriate safeguards are in place. 
3. Security and assistance
  • Qbil implements appropriate technical and organisational measures under Article 32 GDPR, taking account of risk, including access controls and authentication, encryption in transit, protection of stored data where applicable, logging, monitoring, backup, maintenance and incident response.
  • Qbil regularly reviews these measures and will not materially reduce the overall protection of Customer Personal Data during the service term.
  • Taking account of the nature of the processing and information available to Qbil, Qbil will assist the Customer with the security and personal data breach obligations in Articles 32–34 GDPR, data protection impact assessments and prior consultation under Articles 35–36, and requests to exercise data subject rights.
  • The Customer remains responsible for its own lawful basis and information to its users and other data subjects.
4. International transfers
  • Qbil processes and stores Customer Personal Data primarily in the European Economic Area (EEA).
  • A transfer outside the EEA will take place only where a valid transfer mechanism applies, such as a European Commission adequacy decision or applicable Standard Contractual Clauses, with supplementary measures where required.
  • A confidentiality undertaking by itself is not a transfer mechanism.
  • The published sub-processor list identifies relevant providers and transfer information.
5. Subverwerkers
  • The Customer gives Qbil general written authorisation to use the Sub-processors identified at https://www.qbilsoftware.com/sub-processors/ for the services and purposes stated there.
  • Qbil selects Sub-processors that offer sufficient guarantees, enters into a written agreement imposing in substance the applicable data protection obligations of this DPA, and remains responsible to the Customer for their performance.

 

Notice of a change

  • Qbil will notify the Customer of an intended addition or replacement of a Sub-processor by email to the contract contact on file and by in-app notice at least 30 calendar days before the Sub-processor begins processing Customer Personal Data.
  • The notice will identify the Sub-processor, the service it provides, its location, the relevant transfer safeguards and the proposed start date.
  • Qbil will update the published Sub-processor list when the change takes effect.
  • Objections
  • The Customer may object to the intended addition or replacement on reasonable data-protection grounds within the 30-day notice period, using the in-app “ask a question” option or by replying to the notice email.
  • Qbil will acknowledge and respond to the objection within five working days.
  • From the moment a timely objection is recorded, Qbil will exclude the Customer from processing by the proposed Sub-processor while the objection remains unresolved.
  • Qbil and the Customer will first seek to address the concern. Where feasible, Qbil may permanently exclude the Customer from the processing performed by the proposed Sub-processor.

 

Termination following an unresolved objection

  • The termination rights below apply only where:
    • the Customer objected within the 30-day notice period on reasonable data-protection grounds;
    • Qbil was unable to address the Customer’s concern; and
    • Qbil was unable to permanently exclude the Customer from the affected processing.
  • Where the proposed Sub-processor would process Customer Personal Data only for an optional feature or service, including product analytics or session replay, the Customer may terminate that optional feature or service with immediate effect and at no charge.
  • Where the proposed Sub-processor would process Customer Personal Data for the core platform, the Customer may terminate the agreement for the affected service by giving three months’ notice.
  • During that three-month notice period, the proposed Sub-processor will not process the Customer’s Personal Data. The exclusion starts when the Customer’s objection is recorded and continues until termination takes effect.
  • No termination charge is due. Fees paid in advance for the terminated service will be refunded pro rata for the unused period. No further compensation is payable by either party as a consequence of the termination.
  • The applicable termination right must be exercised within the original 30-day notice period. It cannot be exercised after that period and does not create a general right of termination.
  • Where the Customer terminates an optional feature or service or the agreement for an affected service under this section, Qbil will provide the applicable data export at no charge. Section 7 applies to the return, export and deletion of Customer Personal Data.

 

No objection within the notice period

  • If the Customer does not object within the 30-day notice period, the Customer is deemed to have authorised that particular addition or replacement under the general authorisation provided in this section.
  • This applies only to a future addition or replacement of a Sub-processor after the Customer has accepted this DPA. It does not constitute acceptance of this version of the DPA or of a material amendment under section 11.
6. Personal data breaches
  • Qbil will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
  • Qbil will provide information reasonably available about its nature, likely consequences and measures taken or proposed, and supplement the notice as further information becomes available.
  • Qbil will take appropriate containment and remediation measures and assist the Customer with its notification duties.
7. Retention, return and deletion

Service data

  • During the agreement, Qbil retains Customer Personal Data for as long as necessary to provide the services or as instructed by the Customer.
  • At the end of the affected service, the Customer may choose whether Qbil:
    • securely deletes the Customer Personal Data; or
    • returns or makes the Customer Personal Data available for export and subsequently securely deletes the remaining active service data and existing copies, unless EU or Member State law requires further storage.
  • The method used to return or make Customer Personal Data available for export will be agreed with the Customer as part of the exit process, taking account of the service concerned and the technically available options. Depending on those circumstances, this may consist of a database export, a set of files or temporary access to the Customer’s environment for export purposes.
  • Customer Personal Data will subsequently be securely deleted from the active service environment, unless applicable law requires longer storage.

 

Backups

  • Backups are not separately purged. Copies may remain after deletion of active service data until they are overwritten in the normal backup rotation and are removed no later than the end of the backup retention period applicable to the Customer’s service level, with a maximum of five years.
  • During that period, the same security measures continue to apply. The data is not used for any other purpose and is not restored other than for recovery.

 

Analytics and replay

  • Product analytics event data is retained for seven years from collection. This retention period is determined by PostHog’s paid plan and cannot be shortened through PostHog’s retention settings.
  • This retention period does not prevent the deletion of data relating to a specific person in response to a valid deletion request, as described in section 8.
  • Session replay recordings, if enabled, are configured with a retention period of 90 days from recording and are scheduled for deletion when that period expires.
  • If session replay is not enabled, no replay recordings are made.
  • Qbil will confirm completion of deletion at the Customer’s request.
8. Data subject requests
  • Qbil will, taking account of the nature of the processing, assist the Customer through appropriate technical and organisational measures to answer requests for access, rectification, erasure, restriction, portability and objection.
  • Qbil will promptly refer a request received directly from a data subject to the Customer unless legally prohibited.
  • Requests concerning analytics or replay may be submitted through support; Qbil will route them for manual deletion where applicable.
  • Session replay will not be enabled until an operational procedure for deleting both a person’s analytics records and associated recordings has been documented.
9. Audit and compliance information
  • Qbil will make available information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to reasonable audits, including inspections, by the Customer or an independent auditor mandated by the Customer.
  • The parties will agree reasonable advance notice, scope, confidentiality and security measures, and may use current independent audit or certification evidence before any on-site inspection.
  • Qbil will inform the Customer immediately if, in its opinion, an audit instruction infringes the GDPR or applicable data protection law.
10. Security and privacy programme

Qbil maintains information security and privacy management processes, including ISO/IEC 27001 and ISO/IEC 27701 certifications and work on NIS2 readiness. Certifications do not replace the obligations in this DPA.

11. Amendments and acceptance

Non-material corrections

  • Qbil may publish corrections that do not materially affect the parties’ rights or obligations, such as an updated contact address, typographical corrections or a change to the URL of the sub-processor list where the list remains accessible.
  • Qbil will identify the revised version and date of publication.
  • Such non-material corrections take effect on publication.

 

Material changes

  • A material amendment to this DPA, including a new purpose of processing, material change in data categories, material reduction in safeguards or a substantive change to Customer rights, requires notice to the contract contact by email and in-app at least 30 calendar days in advance.
  • Qbil will provide the proposed text and an opportunity to ask questions or object.
  • A material amended version takes effect for a Customer only after a person authorised on its behalf expressly accepts that version; silence or continued use does not constitute acceptance.
  • Until then, the previously accepted version governs, and Qbil will not begin processing under the proposed material amendment for that Customer.
  • If the parties cannot agree, they will discuss exclusion of the affected optional processing or termination of the affected service under section 5.

 

Acceptance of version 2.2

  • Acceptance of this v2.2 is recorded per Customer tenant with the accepting person’s name, job title, user identity, timestamp, document version and language, together with the statement: “I am authorised to accept this on behalf of my organisation.”
  • Questions raised through the acceptance screen are recorded and handled before processing under this version is enabled for that tenant.
  • This initial acceptance must be express.
12. Contact and precedence

Questions and notices may be sent to:

Qbil Software B.V.

Landjuweel 16-4
3905 PG Veenendaal
Nederland
E-mail info@qbilsoftware.com
Website: https://www.qbilsoftware.com

 

If this DPA conflicts with the service agreement on processing of Customer Personal Data, this DPA controls to the extent of that conflict. Other terms of the service agreement remain in effect.

 

Laatst bijgewerkt: 29 October 2026 v2.2.

Voor meer informatie over hoe Qbil Software B.V. uw gegevens beschermt en de naleving waarborgt, kunt u terecht op: