Privacy Policy

1. Who is responsible?

SmartWerk is the data controller for personal data processed via smartwerk.nl, unless stated otherwise.

Contact details:

• SmartWerk
• Netherlands
• Chamber of Commerce (KVK): available on request by email
• E-mail: support@smartwerk.nl
• https://www.smartwerk.nl

2. Scope

This policy applies to website visitors, account holders, document recipients, and invited bookkeepers.

3. What data do we process?

• Account data: email, auth ID, subscription status
• Business/profile data you enter
• Documents you create in SmartWerk
• Client data you store in SmartWerk (you remain responsible). For the data processing agreement (GDPR Art. 28) see /terms section 12.
• Technical data and cookies (see /cookies)
• Payment data via Stripe

4. Purposes and legal bases

• Contract performance
• Legal obligation
• Legitimate interests (security, improvement)
• Consent for non-essential cookies

5. Retention

Data is kept while your account is active. When you delete your account (Dashboard → Profile → Delete account), we erase your personal data from our active systems without undue delay, typically immediately.

Exceptions: (a) legal retention for tax and administration (up to 7 years where applicable); (b) encrypted backups for up to 30 days; (c) minimal security or error logs at processors (e.g. Vercel, Sentry, Resend, Stripe) under their retention policies; (d) data already sent to third parties (e.g. invoice emails to your clients) which we cannot recall.

6. Processors

We do not sell your data. Processors include Google Firebase/Google Cloud, Vercel (hosting), Stripe, Resend (transactional email), and optionally Sentry.

7. Transfers outside the EEA

We use appropriate safeguards such as EU SCCs where required.

8. Security

HTTPS, access controls, and limited production access.

9. Your rights

Access, rectification, erasure, restriction, objection, portability, withdraw consent, complaint to the Dutch DPA (Autoriteit Persoonsgegevens).

Self-service erasure: sign in → Dashboard → Profile → Delete account. Confirm with your account email. Self-service export (portability): Dashboard → Profile → Export my data (ZIP/JSON). For other access requests, contact us via section 1 (we respond within 30 days).

10. Cookies

See /cookies for details.

11. Children

Not intended for users under 16.

12. Changes

We may update this policy and notify you of material changes.