Verwerkersovereenkomst

1. Who this is for

This data processing agreement (verwerkersovereenkomst) applies whenever Cefio B.V. (KVK 42159745, "Cefio") processes personal data on behalf of a customer while providing Cefio. It is part of the Cefio terms and conditions. On data protection, this agreement takes precedence over the terms.

The customer is the controller. Cefio is the processor. Words such as personal data, processing, controller, processor, sub-processor and personal data breach mean what they mean in the General Data Protection Regulation (GDPR, in Dutch: AVG).

2. What Cefio processes, and why

Cefio processes personal data only to provide Cefio to the customer: bookkeeping, VAT, bank connections, invoicing, payroll, payments prepared for approval, reporting and the AI features. Annex 1 lists the people and data involved. Cefio processes for as long as the customer uses Cefio, and afterwards only to return or delete the data (article 10).

3. Instructions

Cefio processes personal data only on the customer's documented instructions. The terms, this agreement and the customer's use and settings of Cefio are those instructions. Cefio tells the customer if it believes an instruction breaks the law. If the law requires Cefio to process personal data in another way, Cefio tells the customer first, unless the law forbids that.

4. Confidentiality

Everyone at Cefio who can access personal data is bound by confidentiality, by contract or by law, and only has access where their work requires it.

5. Security

Cefio takes appropriate technical and organisational measures to protect personal data (GDPR article 32). Annex 2 describes them. Cefio may improve them, but never lower the overall level of protection.

6. Sub-processors

The customer gives Cefio general permission to use sub-processors. Annex 3 lists them.

• Cefio announces a new or replaced sub-processor at least 30 days in advance, by email or in the app.
• The customer may object on reasonable grounds within that period. If Cefio cannot address the objection, the customer may end the affected part of the service without a termination charge.
• Cefio gives every sub-processor the same data protection obligations as this agreement, in writing, and remains responsible to the customer for its sub-processors.

7. Transfers outside the EU

Cefio stores customer administrations in the European Union. Personal data goes outside the European Economic Area only with a valid safeguard under the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Helping the customer

• Requests from people: Cefio forwards any request it receives from a person whose data is in the customer's administration within five working days, and helps the customer answer it.
• Cefio helps the customer with security, data protection impact assessments and prior consultation of the supervisory authority, as far as it concerns Cefio's processing.
• Cefio gives the customer the information needed to show that this agreement is being followed.

9. Personal data breaches

Cefio informs the customer without undue delay, and at the latest within 36 hours after becoming aware of a personal data breach that affects the customer's data. Cefio gives what is known at that moment (what happened, which data and people, likely consequences, measures taken) and adds information as it comes in, so the customer can meet its own 72-hour duty to report to the Autoriteit Persoonsgegevens. Cefio keeps a record of all breaches.

10. At the end

The customer can export its data at any time (see Switching and leaving Cefio in the terms). After the end of the contract and the retrieval period, Cefio deletes the customer's personal data within 90 days, and from backups within a further 90 days, unless the law requires Cefio to keep it or the customer has an archive licence. On request, Cefio confirms the deletion in writing.

11. Audits

Cefio provides, on request, the information needed to check compliance, such as security reports, certifications and summaries of independent security tests. If that is not enough, the customer may have an audit done by an independent auditor bound by confidentiality, at most once a year, with 30 days' notice and at its own cost, unless the audit follows a breach by Cefio.

12. Liability, term and law

The liability clause in the terms applies to this agreement. This agreement runs for as long as Cefio processes personal data for the customer. Dutch law applies, and disputes go to the competent court in Amsterdam.

Annex 1: people and data

People whose data may be processed: the customer's users, directors and shareholders, employees and other staff, job applicants entered for payroll, and the customer's customers, suppliers and other contacts.

• Identity and contact details: name, address, email address, phone number, date of birth.
• Financial data: bank account numbers (IBAN), balances, transactions, invoices, payments, receivables and payables, VAT data.
• Payroll data: citizen service number (BSN), salary and wage components, employment contract details, tax and social security data, as needed for payroll and wage tax returns.
• Documents the customer uploads, such as receipts, invoices and contracts.
• Questions to the AI assistant and the data needed to answer them.
• Usage data: sign-ins, actions and settings in the app.

Special categories of personal data are not needed for Cefio. The customer does not enter them, except where the law requires it for payroll.

Annex 2: security measures

• Hosting and storage in the European Union (Frankfurt), with encryption in transit (TLS) and at rest.
• Each customer's data is kept logically separate from other customers' data.
• Access on a need-to-know basis, multi-factor authentication for administrative access, and access logging.
• Daily backups and a tested recovery procedure.
• Payments prepared in Cefio need the customer's own approval at its bank; bank connections are read-only.
• Security updates applied promptly, and an independent security test before go-live and after major changes.
• Confidentiality agreements and security awareness for everyone with access.
• An incident and breach procedure with a breach register.
• Sub-processors chosen on their security and bound by data processing agreements.
• Our AI provider does not use customer data to train its models.

Annex 3: sub-processors

• Amazon Web Services EMEA SARL: hosting and storage. Frankfurt, EU.
• Supabase Inc.: database and sign-in. Frankfurt, EU.
• MongoDB Inc. (Atlas): database. EU region.
• Vercel Inc.: application and website hosting. EU region, US company.
• Enable Banking Oy: bank connections (account information). Finland.
• Loket (Van Spaendonck): payroll processing, for customers that run payroll. Netherlands.
• Anthropic PBC: AI answers. United States.
• ElevenLabs Inc.: speech to text for voice input. United States.
• Resend Inc.: emails sent by the app. United States.
• Migadu: Cefio's mailboxes. Switzerland.
• Stripe Payments Europe Ltd: subscription billing. Ireland.

Last change to this list: 23 October 2026.