Data processing agreement

About this version

This is version 2.0, effective from 20 October 2026, under the same transition rules as the terms of service (article 20 of those terms). Terms from the GDPR have the meaning the GDPR gives them; other capitalised terms have the meaning given in the terms of service. This is a translation; if it differs from the Dutch text, the Dutch text prevails.

1. Roles and subject matter

1.1 For the personal data in Customer Data, the Customer is the controller and Solven the processor.

1.2 Solven processes that data to provide the Service, as specified in Annex 1, and not for its own purposes.

2. Duration

This data processing agreement applies for as long as Solven processes personal data for the Customer, including after the end of the Agreement until the data has been deleted or anonymised (article 10).

3. Instructions

3.1 Solven processes the personal data only on the Customer’s documented instructions. The Agreement, the settings the Customer chooses in the Service and the way it uses the features constitute those instructions.

3.2 If Solven considers an instruction to infringe the GDPR, it informs the Customer immediately.

3.3 If Solven must process data under a legal obligation, it informs the Customer beforehand, unless the law prohibits this.

4. Confidentiality and access

4.1 Everyone who has access to the personal data on Solven’s behalf is bound by confidentiality.

4.2 Solven only looks into the Customer’s environment when this is needed for support, administration or handling an incident. Accessing an account is time-limited and recorded in the audit log.

5. Security

5.1 Solven takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing, as required by Article 32 GDPR. Annex 2 describes them.

5.2 Solven may adjust the measures, provided the level of security does not decrease.

6. Sub-processors

6.1 The Customer gives Solven general authorisation to engage sub-processors. Annex 3 lists the sub-processors Solven currently uses, with their task and the location of processing.

6.2 Solven imposes on each sub-processor at least the same obligations as set out in this data processing agreement, and remains responsible to the Customer for their performance.

6.3 Solven announces a new or replacement sub-processor at least thirty days in advance, by email or in the app, and updates Annex 3. The Customer may object with reasons within that period. If the parties cannot find a solution, the Customer may terminate the Agreement free of charge as of the date the change takes effect.

7. Transfers outside the EEA

Solven transfers personal data to a country outside the European Economic Area only if appropriate safeguards apply: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified recipients) or the European Commission’s standard contractual clauses. Annex 3 shows where this is the case.

8. Assistance to the Customer

8.1 The Service includes features that allow the Customer to handle data-subject requests itself: exporting, correcting and erasing or anonymising the data of a customer or user. Where that is not sufficient, Solven assists the Customer within reasonable limits.

8.2 If Solven receives a request directly from a data subject, it forwards it to the Customer and does not handle it itself.

8.3 Solven provides the information the Customer reasonably needs for a data protection impact assessment (DPIA) or a prior consultation with the supervisory authority.

8.4 For assistance beyond the features of the Service and a reasonable effort, Solven may charge reasonable costs, after consultation in advance.

9. Personal data breaches

9.1 Solven notifies a personal data breach affecting Customer Data without undue delay, and no later than 48 hours after discovering it, to the email address of the account owner.

9.2 The notification describes, as far as known: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures Solven has taken or proposes, and a contact person. Solven supplements what is not yet known as soon as it knows.

9.3 The Customer decides whether to notify the supervisory authority and the data subjects. Solven does not notify them of a breach in Customer Data itself, unless the law requires it to.

9.4 Solven documents every breach, with the facts, the effects and the measures taken.

10. Return and deletion

10.1 The Customer can export Customer Data itself at any time (article 14.2 of the terms of service).

10.2 After the Agreement ends, Solven deletes or anonymises the personal data within thirty days of a request from the Customer, and without a request no later than six months after the end. On request, Solven confirms the deletion In Writing.

10.3 Copies in the daily backups expire after thirty days; a backup Solven makes manually, for example before a restore, is deleted as soon as it is no longer needed. Data that Solven is legally required to keep is kept for as long as the law requires. Solven keeps the audit log, which records who did what in the Service and when, for as long as needed for security and as evidence, and uses it for nothing else.

11. Information and audits

11.1 On request, Solven makes available to the Customer all information needed to demonstrate compliance with this data processing agreement, including a description of its security policy.

11.2 If that information is not sufficient, the Customer may have an audit carried out at most once a year by an independent expert bound by confidentiality. The Customer announces the audit at least thirty days in advance; it takes place on Business Days and does not disrupt the Service.

11.3 The costs of an audit are borne by the Customer, unless the audit shows a material failure by Solven. Solven remedies an identified failure as quickly as reasonably possible. An audit by a supervisory authority is always possible.

12. Liability and miscellaneous

12.1 Article 18 of the terms of service applies to liability under this data processing agreement.

12.2 Changes to this data processing agreement follow article 20 of the terms of service. A new sub-processor falls under article 6.3 above.

12.3 Dutch law applies to this data processing agreement; disputes are submitted to the competent court of the District Court of Midden-Nederland.

Annex 1 — Specification of the processing

Purposes: providing the Service, in particular:

• customer and relationship management, intake, quotes and contracts;
• work orders, scheduling, execution and registration (such as photos, signatures, measurements and refrigerant registration);
• invoicing, payments and direct debit;
• the customer portal, email and push notifications;
• reporting and, when the Customer uses them, AI features, location tracking of technicians, subcontractor management and integrations with other systems.

Data subjects: customers and contact persons of the Customer; leads of the Customer; Users and other employees of the Customer; subcontractors of the Customer and their employees; suppliers of the Customer.

Personal data: name, address and contact details; customer and site data, such as the installation address; order, scheduling, work-order and invoice data; payment data (payment status, and for direct debit the name and IBAN); signatures, photos, documents, notes and voice notes; account data and the usage log (login times, IP address, device); location data of Users during trips, if the Customer enables location tracking, and the location when checking in and out of a job; data about subcontractors and their deployment.

Special categories of personal data: the Service is not intended for these, nor for national identification numbers (BSN). The Customer does not enter them.

Retention: for as long as the Agreement runs, and afterwards in accordance with article 10. Within that, shorter periods enforced by the Service apply: location data during trips 24 hours (the location at check-in and check-out belongs to the record of that job and follows its retention); conversations with the AI assistant 90 days; the text of sent emails 12 months; customers deleted by the Customer are anonymised after 30 days; daily backups 30 days.

Location of processing: within the EEA — the servers in Germany, object storage in the Netherlands — with the transfers listed in Annex 3.

Annex 2 — Security measures

• Hosting on a dedicated server in a data centre in Germany; the database and the application are not directly reachable from the internet, only through a web server with TLS.
• Encryption of all traffic with TLS, with HSTS and a strict browser security policy (CSP). Database backups in object storage are stored encrypted.
• Strict separation between customers: every database query filters by company, with a second check in the application layer; for the core tables, row-level security in the database as well.
• Role-based access: every feature is restricted by role, and the Customer decides which role a User has.
• Two-factor authentication (TOTP) available to all Users and mandatory for Solven administrators; passwords hashed with Argon2; temporary lockout after repeated failed login attempts; rate limits on the API and on login routes.
• An audit log that can only be appended to, not changed, with a verification chain that makes alteration detectable.
• Daily backups, kept for thirty days, with an automated restore test that regularly checks that a backup can actually be restored. The age of the latest backup is publicly visible on the status page.
• Automated tests on every change, including tests of the separation between customers and of role permissions, and a secured deployment pipeline.
• Limited access for Solven itself: only when needed, time-limited and recorded in the audit log.
• A documented procedure for incidents and personal data breaches (see article 9).

Annex 3 — Sub-processors

Always involved in the Service:

• Contabo GmbH — hosting of the servers, the database and the backups — all Customer Data — Germany (EEA).
• TransIP B.V. — object storage (Object Store, S3-compatible) — the Customer’s files (photos, documents, PDFs) and encrypted database backups — the Netherlands.
• TransIP B.V. — sending email from the Service — recipient, content and attachments of the email — the Netherlands.
• Mollie B.V. — payment links and payments — amount and invoice number, and for direct debit the name and IBAN — the Netherlands.
• Expo (650 Industries, Inc.) — push notifications and updates of the mobile app; notifications are delivered via Apple and Google — device token, title and text of the notification, IP address — United States (Data Privacy Framework or standard contractual clauses).
• GitHub, Inc. — the development and deployment pipeline, which has administrative access to the production environment — occasionally data in technical logs — United States (Data Privacy Framework or standard contractual clauses).

Only when the feature is in use: Anthropic Ireland, Limited, with processing by Anthropic, PBC — AI features, such as the assistant, reading receipts and documents, and summaries — the data needed for the requested task — United States (standard contractual clauses). OpenAI, L.L.C. or Microsoft (Azure OpenAI) — the AI Inbox module — emails from the connected mailbox — United States or EEA. Functional Software, Inc. (Sentry) — error reporting — technical data about the error, as far as possible without content — EU or United States (Data Privacy Framework).

Public services the Service consults: Kadaster (PDOK Locatieserver) converts addresses into coordinates for the map and route planning — the Netherlands. Open-Meteo provides the weather forecast in the planner based on a project’s location — Europe. Maps are shown with tiles from OpenStreetMap, which the User’s browser fetches directly — OpenStreetMap thereby sees the IP address and the map area.

At the Customer’s initiative: integrations the Customer switches on itself, such as Exact Online, Moneybird, a Google or Microsoft mailbox for the AI Inbox, and webhooks or the API to its own systems. With these, the Customer sends data to a party of its own choosing with which it has its own agreement.