Ekaterina
NLFREN
Start 30 days free

Data processing agreement

Version of 30 October 2026

  1. Parties

    You, as controller, and BV La Lumière Consulting, as processor (art. 28 GDPR).

  2. Subject and duration

    The Ekaterina service, for as long as the subscription runs.

  3. Nature and purpose

    Storing, reading, coding, booking, drafting and sending administrative documents, under your Autopilot settings.

  4. Types of data

    Identity and contact details, invoicing and payment data, IBAN, company and VAT numbers. For staff: national register number, address, pay and absences.

  5. Data subjects

    Your customers, suppliers, employees, directors and contact persons.

  6. Instructions

    We process only on your documented instructions. Your Autopilot settings, your limits and your approvals are those instructions.

  7. Confidentiality

    Anyone with access is bound to secrecy.

  8. Security

    Encryption in transit, secrets stored only as a hash, roles per user, a log that cannot be changed, separation per workspace and per organisation (art. 32 GDPR).

  9. Subprocessors

    Only those on the list. We announce a new one 30 days ahead; you can object. They carry the same obligations.

  10. Assistance

    We help with data subject requests, with a data protection impact assessment and with breaches.

  11. Breaches

    We notify a breach without undue delay (art. 33(2) GDPR), so you can notify within 72 hours.

  12. End

    Export and deletion within 30 days of the end, except what the law requires us to keep.

  13. Audit

    Information on request; an audit after reasonable prior notice.