This Privacy Policy describes how Eaglessoft, trading as Invocit (“Invocit”, “we”, “us”), collects, uses and processes personal data through our cloud platform (the “Platform”) and our website (the “Website”).
We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Belgian and European data protection legislation.
By using our services, you acknowledge that you have read and understood this Privacy Policy.
Invocit acts as the Data Controller for your account and usage data (Sections 3–4), and as the Data Processor when you use the Platform to manage your business documents (Section 5).
Email address, first and last name, display name, phone number (optional), language preference and profile picture (optional). This data comes directly from you or from your identity provider when you log in.
Company name, address, contact information, VAT number, tax identification number, bank account details (IBAN) and company logo.
When you use the Platform, you may enter invoices, proposals, credit notes, purchases, customer and supplier details, product information, prices, tax rates and payment records.
Important: For this data, you are the Data Controller and Invocit is the Data Processor. You are responsible for having a lawful basis to process the personal data you enter. See Section 5.
IP address, browser type, session identifiers and timestamps — collected during authentication, policy acceptance and in audit logs.
Login timestamps, audit log entries (user, action, resource, timestamp) and policy acceptance records. We do not collect page views, click behaviour or browsing patterns.
We use your data only for the following purposes:
When you manage business documents in Invocit, we process your customers’, suppliers’ and contacts’ personal data on your behalf and under your instructions.
In accordance with Article 28 GDPR, we:
We do not access, modify or delete your data without your instruction, except for technical operations (encrypted backups, maintenance).
If you require a standalone Data Processing Agreement (DPA), contact [email protected].
We implement appropriate technical and organisational measures, including:
To deliver our services we rely on carefully selected third-party providers (“sub-processors”). Each processes data only under agreements that meet GDPR requirements. Because our integrations evolve over time, we describe the categories of providers we use here rather than list individual vendors; the current named list is maintained separately (Section 7.3).
These are essential to running the Platform for every customer:
These providers receive data only when you actively turn on and use the corresponding feature. If you never enable a feature, no data is shared with its provider:
Because our sub-processors change as the Platform evolves, we maintain a current, detailed sub-processor list identifying each provider, its purpose and its location. This list is available on request at [email protected]. We will notify you of material changes to our sub-processors so you can exercise any rights you may have.
Your data is processed within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary, we ensure appropriate safeguards under the GDPR (Standard Contractual Clauses, adequacy decisions or other approved mechanisms).
Contact [email protected] for details.
We retain your data only as long as necessary:
After retention, data is securely deleted or irreversibly anonymised. You may export your data in standard formats before account closure.
Under the GDPR, you may:
Contact [email protected] to exercise your rights. We respond within one month (extendable by two months for complex requests). Exercising your rights is free; manifestly excessive requests may incur a reasonable fee.
If a breach occurs that risks your rights and freedoms, we notify the supervisory authority within 72 hours. If the risk is high, we inform you without undue delay.
For customers using Invocit as a processor: we notify you promptly so you can meet your own notification obligations.
You may lodge a complaint with the supervisory authority in your EU Member State. In Belgium:
Gegevensbeschermingsautoriteit Drukpersstraat 35, 1000 Brussels +32 (0)2 274 48 00 — [email protected] www.gegevensbeschermingsautoriteit.be (https://www.gegevensbeschermingsautoriteit.be)
We appreciate the opportunity to address concerns first — please contact [email protected].
We may update this Privacy Policy. Significant changes are communicated via the Platform or email. Amended versions take effect 14 days after publication (immediately if required by law).
Belgian law applies. The competent courts of Brussels have exclusive jurisdiction, without prejudice to your right to submit disputes to a court in your EU Member State of habitual residence.
[email protected] — Eaglessoft, Excelsiorlaan 31, 1930 Zaventem, Belgium — +32 456 735 966
