Data Processing Agreement

This Data Processing Agreement applies as soon as your company ("controller") has AVoffice ("processor") process personal data through a company account in Pytros. It automatically forms part of the Terms of Service and doesn't need to be signed separately, unless your company specifically requests that — email info@avoffice.nl in that case.

AVoffice processes personal data solely on the instructions of your company, for the purpose of providing Pytros, and not for its own purposes. This agreement lasts as long as your company account is active and ends automatically once that account (and its data) is deleted.

Purpose: providing Pytros's functionality (including customer, supplier, and staff management, invoicing, quotes, jobs, and planning). Categories of data subjects: customers and contact persons, suppliers, employees of your company. Categories of data: name, contact details, address details, financial/invoicing data, and — to the extent you fill this in yourself in employee records — job title, contract and wage data, date of birth, and emergency contact details. AVoffice doesn't process special categories of personal data (such as health or national ID data) unless you enter it yourself, outside the fields intended for it, in a free-text field — only do so if strictly necessary.

AVoffice: - processes personal data only under this agreement and the instructions that follow from normal use of Pytros; - imposes confidentiality obligations on everyone who has access to the data on AVoffice's behalf; - takes appropriate technical and organizational security measures (see the section on security below); - reports a (suspected) data breach without undue delay, and in any case within 48 hours of becoming aware of it, to you as the controller; - provides reasonable assistance with data subject requests (access, correction, deletion) and with a possible DPIA, to the extent that's within Pytros's capabilities.

AVoffice engages Supabase as a sub-processor for hosting, database, and file storage, with the project set to an EU region. AVoffice may engage new sub-processors and will inform your company in advance; you may object within a reasonable period, after which we'll work together to find a solution.

- Encryption of data in transit and at rest. - Role-based access within each company account (Row Level Security), so that, for example, employee records are only accessible to an Owner or Admin of that company. - Hashed password storage. - Access to production systems limited to what's needed to maintain Pytros.

On reasonable request, AVoffice provides insight into the security measures taken. An on-site audit only takes place after prior agreement on scope, timing, and cost, and no more than once a year unless there's a concrete reason (such as a data breach).

You can create a full export of your company data at any time via Settings > Backup. After your company account is terminated, data is deleted as described in the Privacy Policy (30 days in the trash, then permanent deletion), unless a statutory retention period requires longer storage.

The liability, governing law, and jurisdiction provisions in the Terms of Service apply here as well. In the event of a conflict between this Data Processing Agreement and the Terms of Service regarding the processing of personal data, this Data Processing Agreement prevails.