ProFactuur
Account aanmaken

Privacy policy

Last updated: 17 October 2026. Lees dit beleid in het Nederlands

1. Who we are

ProFactuur is a product of Zentio, Lafelterweg 2A, 3770 Riemst, Belgium, company number BE 1031.106.436. For questions about this policy or your data, contact us at support@profactuur.be.

2. Our two roles

  • Controller for the data of our own users: your account, company details, subscription and payments.
  • Processor for the data you put into ProFactuur about your own customers and suppliers: contacts, invoices, quotes, Peppol documents and Shopify orders. You remain responsible for that data. We only process it on your instructions, under the data processing agreement that is part of our terms of service.

3. What data we process and why

  • Account and login: name, email address, password (stored encrypted) and the date and version of your acceptance of the terms. Purpose: managing your account and providing the service. Legal basis: performance of the contract.
  • Company details: company name, address, company and VAT number, IBAN, email address and logo. Purpose: creating correct documents. Legal basis: performance of the contract.
  • Billing data: our own invoices to you and related data. Legal basis: legal obligation.
  • Payment data: payments are handled by Stripe. We never see or store card numbers. Legal basis: performance of the contract.
  • Technical logs and IP addresses: only for security and abuse prevention, for example at sign-up (Cloudflare Turnstile). Legal basis: legitimate interest in a secure service.
  • Personal data access log: who opened a contact, invoice, credit note or export and when, including our platform administrators. Purpose: oversight and accountability. Legal basis: legitimate interest and the legal duty to keep data secure.
  • Proof of instructions: when Peppol is activated or a quote is approved online, we keep the name, date, time and IP address as proof. Legal basis: legitimate interest.
  • Contact messages: name, email address and message content, to answer your question.

We never sell your data and never use it for advertising.

4. Shopify integration

  • Which data: orders, products and customer data from orders (name, email address, address and phone number).
  • Purpose: only to create and send invoices and credit notes. No marketing, no sale of data and no profiling.
  • Customer data requests (customers/data_request): we collect the data we hold about that customer and deliver it to the merchant.
  • Erasure requests (customers/redact): personal data is erased from stored Shopify data. Invoices and credit notes are kept because of the legal retention obligation.
  • After the app is uninstalled (shop/redact): the access tokens and Shopify data of that store are erased. Invoices and credit notes are kept.
  • Shopify webhook logs are automatically deleted after 30 days.

5. Sub-processors

  • Lovable Cloud: hosting and database (based on Supabase), in the EU (Ireland region), and the email service ProFactuur uses to send emails and documents.
  • Recommand: our Belgian Peppol service provider, only if you activate Peppol.
  • Stripe: subscription payments.
  • Shopify: source of orders, only if you use the integration.
  • Cloudflare Turnstile: spam protection at sign-up.
  • AI provider: only if you connect an AI assistant yourself, and only for the data you request through it.

Data is stored encrypted and sent encrypted. Some providers may process data outside the EU/EEA. In that case appropriate safeguards apply, such as an adequacy decision or standard contractual clauses. Ask us at support@profactuur.be for details.

6. Retention

  • Invoices, credit notes and accounting documents: according to the legal retention obligation (10 years).
  • Account data: as long as your account exists. After termination you can get an export for 30 days.
  • Personal data access log: 12 months.
  • Webhook logs: 30 days.
  • Proof of Peppol instruction: as long as the company is active on Peppol, plus 10 years. Proof of quote approval: as long as the quote is kept.
  • Contact messages: up to 2 years.

7. Security

We use encryption at rest and in transit. Access is isolated per company, so you only see the data of your own company. Every access to personal data is logged. API keys are only stored as a cryptographic hash. In case of a security incident we follow a fixed procedure and notify within 72 hours where the law requires it.

8. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. Email us at support@profactuur.be. You can also lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

Are you a customer of a business that uses ProFactuur? Please contact that business first. It is responsible for your data.

9. Changes

If we change this policy, we publish the new version on this page with a new date. For important changes we notify you by email.