Privacy statement

Controller

MLR Ventures GmbH, represented by Benjamin de Jong, c/o Benjamin de Jong, Corinthstraße 63, 10115 Berlin, Germany. E-mail: info@jaarrekening.io.

What the privacy policy covers

• Controller or processor: for your account, purchases, website visits and messages to us we are the controller; what you record in your records (employees, contacts, bank transactions, tax data) we process as a processor on your behalf, under the data processing agreement.
• Data: account and contact details, purchases and VAT number, IP address and usage data in logs, error reports, messages to info@, website visits, and in your records, among other things, contacts, bank transactions, tax numbers and the payroll records with employees' citizen service numbers (BSN).
• Citizen service number (BSN): only for the payroll records and the employer's payroll tax return (art. 46 of the Dutch GDPR Implementation Act (UAVG), art. 28 of the Dutch Wage Tax Act 1964); employees' numbers are visible only to the administrator and the preparer and not in the audit trail; tax numbers that may contain a business owner's BSN are recorded in the audit trail without the number itself; the payroll records are not passed to AI features. The app does not send any returns to the Dutch Tax Administration.
• Purposes and legal bases: the contract (art. 6(1)(b) GDPR), our legal obligations (point (c)), our legitimate interest in a secure platform and a consistent display of the website (point (f)) and your consent for visitor statistics (point (a)). No decisions based solely on automated processing.
• Recipients: Supabase, Vercel, Anthropic (only what an AI feature needs; for a booking proposal also earlier bank transactions without salary payments, not the payroll records themselves), Stripe, Resend, Google Workspace, Sentry, Google Fonts, after consent Google Tag Manager and Analytics, and services you enable yourself, such as Ponto for the bank link. Transfers to the United States on the basis of standard contractual clauses or the EU-US Data Privacy Framework.
• Retention periods: the account for as long as it exists; purchases according to the retention obligation of our bookkeeping; your records for as long as they are in your workspace, with the statutory seven-year retention obligation resting with you, and deletion under the terms and conditions 30 days after the end of the agreement (manually for final financial years or payroll runs, which may take longer); own visitor statistics 30 days.
• Security: encrypted transport and encrypted storage, a mandatory second factor, roles enforced in the database, and a fixed plan for data breaches (notification to the supervisory authority within 72 hours where required).
• Your rights: access (also as a download in Settings), rectification, erasure, restriction, portability, objection and withdrawal of consent, and a complaint to a supervisory authority, in the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
• Cookies: cookies that are not strictly necessary only after your consent; the own visitor statistics do not store IP addresses; we do not ask for consent for advertising and always pass it on as refused via Google Consent Mode.

The full text of the privacy policy is on this page. See also Security and privacy for the full list of sub-processors.