Data processing agreement
This agreement applies between you as controller and Revintia as processor when you use Revintia to process personal data about your customers and staff. It constitutes a data processing agreement under Article 28 of the GDPR.
Subject matter and duration
The processing covers the operation of case, time, absence, inventory, purchasing and invoicing functions, the customer portal and messages to your customers. It runs for as long as Revintia holds data for you, including after a subscription or trial has ended, until the data has been returned or deleted.
Categories of data
Contact details for your customers and their staff, including customer portal users, information about equipment and work performed, photos and uploaded files, invoice data and messages to and from your customers, and information about your own staff such as time, absence and roles. Absence recorded as sickness may be health data under Article 9 of the GDPR.
Instructions
Revintia processes the data only on your instructions and to deliver the service. If law requires other processing, we inform you first unless the law prohibits it.
Confidentiality
Everyone with access to the data is bound by confidentiality. Access is limited to what is necessary for operations and support.
Sub-processors
You give general authorisation for the use of Supabase (database, files and login), Resend (outgoing email), Lovable (hosting, delivered through Cloudflare's network, and sign-in, invitation and password-reset emails) and Twilio (SMS, when the SMS module is used). Supabase, Resend, Cloudflare and Twilio are US companies; where data becomes accessible to them outside the EU/EEA, this is based on the European Commission's standard contractual clauses. When a company or VAT number is looked up, only the number is sent to the registers and lookup services named in the privacy policy. If you connect an accounting system or a Peppol access point, invoice data is transferred to it on your instructions. Changes are announced, and you may object.
Security
The technical and organisational measures are described on the security page and form part of this agreement.
Data subject rights
The system contains tools that find a person by email address, so you can answer access requests yourself and anonymise contact persons at your customers. Anonymisation does not cover staff, free text in cases or uploaded files; these must be handled manually. If we receive a request directly, we pass it on to you.
Personal data breach
If we discover a breach, we notify you without undue delay with what we know, so you can meet your own deadline for notifying the supervisory authority.
Deletion and return
On termination we return or delete the data, including uploaded files, as you choose, unless law requires continued storage. Data in the nightly database copies is removed when the copies are deleted automatically after 30 days. The most recent copy is never deleted before a newer one exists.
Audit
You may request the documentation necessary to demonstrate compliance, and may require an audit by arrangement.