Privacy statement

Who we are

Cefio is accounting software for small and medium-sized businesses in the Netherlands. It is run by Cefio B.V., registered with the Dutch Chamber of Commerce (KVK) under number 42159745, Sydneystraat 6, 1175 RN Lijnden, the Netherlands.

Questions about privacy or this statement: karthik@cefio.eu.

Two roles

We handle personal data in two different roles.

• Controller: for our website, the waitlist, your Cefio account, billing and support. We decide why and how this data is used, and this statement covers it.
• Processor: for the data inside your administration, such as your customers, suppliers, employees, invoices, bank transactions and payroll. You (the business using Cefio) are the controller of that data. We only process it on your instructions, under the data processing agreement (verwerkersovereenkomst) that is part of every Cefio agreement (cefio.eu/en/dpa).

What we collect and why

• Waitlist and contact: name, email address, company and the plan you are interested in. Used to email you about Cefio. Basis: your consent, which you can withdraw at any time.
• Your account: name, email address, phone number, company details (from the KVK register) and login data. Used to provide the service, secure your account and support you. Basis: our agreement with you.
• Billing: company name, billing address, VAT number and payment details. Payments are handled by our payment provider; we do not store full card numbers. Basis: our agreement and our legal duty to keep financial records.
• Bank data: see the next section.
• Your administration: invoices, contacts, transactions, VAT and payroll data that you enter or connect. Processed as your processor (see above).
• Technical data: IP address, browser and device type, and logs of sign-ins and actions in the app. Used for security, fraud prevention and fixing errors. Basis: our legitimate interest in a secure service.

Bank connections

When you connect a business bank account, Cefio reads your account data through Enable Banking, a licensed provider under the European payment services rules (PSD2). You give consent at your own bank, with your own bank login. Cefio never sees or stores your bank login details.

• What we read: account holder name, IBAN, account name and currency, balances, and transactions (date, amount, counterparty name and IBAN, and description).
• Why: to import transactions into your books, match payments to invoices and show your cash position and forecast.
• Read-only: this connection cannot move money. Cefio never holds client funds. Any payment you prepare in Cefio needs your own approval at your bank.
• How long: your bank consent is valid for a limited period (at most 180 days, depending on your bank) and you renew it yourself. You can disconnect at any time in Cefio or withdraw consent at your bank. After that we read no new data.
• Retention: transactions already imported are part of your administration and are kept with it (see Retention).

AI features

When you ask Cefio a question or use an AI feature, your question and the figures needed to answer it are sent to our AI provider, Anthropic, to generate the answer. Under our commercial agreement, Anthropic does not use this data to train its models. Voice input is converted to text by ElevenLabs; Cefio does not store the audio.

Cefio prepares and suggests; a person always approves. We make no automated decisions that have legal or similarly significant effects on you.

Who we share data with

We do not sell or rent personal data. We share it only with providers that help us run Cefio, under a data processing agreement, and only as far as they need it. The current list, with locations, is in annex 3 of our data processing agreement (cefio.eu/en/dpa):

• Hosting and databases: Amazon Web Services (Frankfurt, EU), Vercel, Supabase (Frankfurt, EU) and MongoDB Atlas.
• Bank connections: Enable Banking Oy (Finland).
• Payroll: Loket (Van Spaendonck, the Netherlands), for businesses that run payroll through Cefio.
• Company data: the Dutch Chamber of Commerce (KVK) and the EU VAT number check (VIES).
• AI: Anthropic (AI answers) and ElevenLabs (voice to text).
• Email: Resend (emails from the app) and Migadu (our mailboxes).
• Payments: Stripe (subscription billing).

We also share data when the law requires it, for example with the Dutch tax authorities.

Data outside the EU

We store your administration in the EU. Some providers are based in the United States (such as Anthropic, ElevenLabs, Resend, Stripe and Vercel). Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Retention

• Waitlist: until you unsubscribe, and at most 24 months.
• Account data: for as long as you use Cefio, then up to 12 months for support and disputes.
• Your administration and billing records: 7 years after the end of the financial year, as Dutch tax law requires. After your contract ends you can export everything, or keep read-only access with an archive licence.
• Technical logs: at most 12 months.

Security

Data is encrypted in transit and at rest. Each company's data is kept separate, access is limited to people who need it, and payments need an extra approval step. An independent security test takes place before go-live, and our GDPR and ISO 27001 reviews are underway. If a data breach affects you, we tell you and, where required, the Dutch Data Protection Authority.

Your rights

You can ask to see, correct, delete or receive a copy of your personal data, to restrict its use or to object to it, and you can withdraw consent at any time. Email karthik@cefio.eu. We reply within one month.

If your data is in a business's administration (for example as their employee or customer), please contact that business first; we will help them answer you.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Cookies

Our website uses no tracking or advertising cookies and no third-party analytics. The app uses only the cookies needed to keep you signed in and secure.

Changes

We may update this statement. The date at the top shows the latest version. If a change matters to you, we tell you in the app or by email before it takes effect.