Data processing agreement
This agreement sets out how Briefbee handles the personal data of your customers. You accept it when you create your account.
1. Parties and roles
The processor is Briefbee, a sole proprietorship registered in the Netherlands (Zinkstraat 24, Box C9926, 4823 AD Breda (postal address), KvK number: 42188412, hallo@briefbee.nl). The controller is you, the business or freelancer that creates an account, called “the business” below.
For the personal data of customers in quotes, the business decides the purpose and means. Briefbee processes it only on the business's behalf. For the business's own account data, Briefbee is itself the controller; see the privacy policy.
2. What is processed
| Item | Description |
|---|---|
| Data subjects | The business's customers and contact persons |
| Types of data | Names, addresses, emails, phone numbers, job descriptions and chat messages |
| Purpose | Drafting and managing quotes for the business; learning from its own old and approved quotes; sending quotes to the accounting software of the business (Moneybird, Informer or e-Boekhouden) when the business connects it and asks for it |
| Duration | While the account exists, plus up to 30 days for deletion |
No special categories of personal data are expected. Do not enter them.
3. Only on instruction
Briefbee processes the data only on the business's documented instructions. Those instructions are this agreement and the use of the app's features. If Briefbee believes an instruction breaks the law, it says so.
- Briefbee does not use customer data for its own purposes, advertising or training models, and does not sell it.
- Briefbee emails the business's customers only when the business presses "Approve and send" on a quote: that one email, in the business's name, with the quote. Briefbee sends them nothing else.
- When learning from old quotes, customer details are filtered out and only line items, rates and writing style remain.
4. Confidentiality and security
- Only the provider has access to the data, and only for support when the business asks for it.
- Connections are encrypted (in transit).
- Server logs contain ids only, no personal data.
- Anyone with access is bound by confidentiality.
5. Sub-processors
The business gives general authorisation for the sub-processors on the Sub-processors page. Briefbee imposes the same obligations on them as in this agreement.
If Briefbee wants to add or replace a sub-processor, it tells the business at least 30 days beforehand. The business can then object or close the account.
The accounting software (Moneybird, Informer, e-Boekhouden) is not a sub-processor. It is the business's own service, used on its instruction.
6. Transfers outside the EU
Briefbee passes no personal data to China. To draft quotes, the job description, the quote wording and the text of uploaded documents are passed to Anthropic, which processes data worldwide, including in the United States. Safeguard for this transfer: the standard contractual clauses (Module Two and Three) in Anthropic's data processing addendum. Anthropic deletes inputs and outputs within 30 days and does not use them for training.
7. Data breaches
If Briefbee discovers a security breach involving customers' personal data, it notifies the business without undue delay and within 48 hours of discovery.
The notice states what is known: the nature of the breach, the data involved, likely consequences and measures taken. Briefbee helps the business report to the Autoriteit Persoonsgegevens and to the people affected.
8. Data subject rights and assistance
If the business gets a request from a customer for access, correction or deletion, Briefbee gives reasonable help, such as exporting or deleting data. If Briefbee itself receives such a request from a customer, it refers the customer to the business.
Briefbee also helps with a data protection impact assessment and with consultation of the supervisory authority, as far as reasonable.
9. Verification
On request, Briefbee provides the information needed to show it complies with this agreement. An audit is possible by arrangement, with reasonable notice. Questions: hallo@briefbee.nl.
10. End of the agreement
After the account is deleted, Briefbee erases the customer data within 30 days, unless the law requires keeping it. Before deleting, the business can export the data, soon under Settings (Instellingen).
11. Governing law
Dutch law applies. Disputes go to the court of Zeeland-West-Brabant. This agreement is part of the terms of service; on personal data, this agreement prevails if the two conflict.