This is a translation. In case of any difference, the Dutch version prevails.
Data processing agreement
Version 5, 16 October 2026 (the server is in Europe; it used to say the Netherlands)
When your organization uses Qyveno, you put data in it: of your colleagues, your customers and other people. For that data you, as an organization, are responsible (the controller) and Qyveno only processes it on your instructions (the processor). This agreement sets out what Qyveno may and may not do in that role, as Article 28 of the General Data Protection Regulation (GDPR) requires. It is part of the terms and conditions and applies as soon as your organization has an account with Qyveno.
1. Parties
- Processor: Franco Wiltink, trading under the name Qyveno, in the Netherlands, reachable at info@qyveno.nl ("Qyveno"). Once Qyveno is registered with the Dutch Chamber of Commerce (KvK), the KvK number and the business address will be shown here.
- Controller: the organization that has an account with Qyveno, as recorded when that organization was created ("the customer").
2. What Qyveno processes, and what for
- Purpose: providing Qyveno as an online work platform: boards, items, updates, files, conversations, forms, automations, notifications and the related support. Qyveno processes the data only for that purpose and only on the customer's written instructions. The customer's use of Qyveno (what the customer enters, turns on and configures) counts as that instruction.
- Types of data: everything the customer and its users put in Qyveno, such as names, email addresses, phone numbers, job titles, texts, files and images, and in addition account data of users (name, email address, role, language, login times, and for security the IP address and browser of sessions) and what users fill in on their own profile (profile photo, phone numbers, location, date of birth and the date they joined the company).
- Data subjects: the customer's users, and the people about whom the customer puts data in Qyveno (for example the customer's clients, suppliers and contacts).
- Special categories of data: Qyveno is not meant for this. The customer does not put special categories of personal data (such as health) or citizen service numbers (BSN) in it, unless the customer has established itself that this is allowed and appropriately secured.
Qyveno does not use the customer's data for its own purposes: not for advertising, not to sell, and not to train AI models or have AI read it, except what Article 5 says about support.
3. Confidentiality
Qyveno keeps the data confidential. Only those who need it for the service can access it, and everyone who works on behalf of Qyveno is bound by confidentiality. Qyveno does not look into the customer's environment, except with support access (Article 6) or if the law requires it.
4. Security
Qyveno takes appropriate technical and organizational measures to protect the data against loss and unlawful use. The measures are listed in annex B. Qyveno may improve them, but will not lower the level.
5. Sub-processors
The customer gives Qyveno permission to engage the sub-processors in annex A. Qyveno imposes the same obligations on them as in this agreement and remains responsible to the customer for their work. If Qyveno wants to add or replace a sub-processor, Qyveno tells the customer's administrators by email at least 30 days in advance. If the customer has a well-founded reason to object, we look for a solution together; if that does not work, the customer may terminate the agreement.
Data only leaves the European Economic Area if there is a valid basis for it, such as an adequacy decision (for example the EU-US Data Privacy Framework) or the standard contractual clauses of the European Commission.
6. Support access
Qyveno can only enter the customer's environment if an administrator of the customer gives permission for it in Qyveno, for a chosen period (a day, a week or a month). The administrator can withdraw that permission earlier at any time. With access, Qyveno can look along and make changes to solve a problem, but cannot: delete the organization, change people or roles, see or create API keys or connections with passwords, export data, or extend the access itself. Each session lasts 8 hours at the most, starts only from Qyveno's admin area with two-step verification, and is logged: who gave access and until when, each session from when until when, and each change in the name of "Qyveno support". The administrators receive a notification at the start and at the end. Support access is only used by a person at Qyveno, not by automated systems or AI.
7. Rights of data subjects
If someone asks the customer for access to, correction of, deletion of or transfer of their data, the customer can usually do that itself in Qyveno. Where that is not possible, Qyveno helps within a reasonable time. If Qyveno receives such a request directly, Qyveno forwards it to the customer and does not handle it itself.
8. Data breaches
If Qyveno discovers a breach of security in which the customer's data is (possibly) lost or ends up with unauthorized people, Qyveno reports this to the customer's administrators without undue delay and at the latest within 48 hours of discovery. Qyveno then tells what happened, which data and how many people it (probably) affects, what the consequences may be and what Qyveno is doing to fix it. Whether the breach has to be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the data subjects is for the customer to decide; Qyveno helps with that.
9. Assistance and audit
Qyveno helps the customer with a data protection impact assessment (DPIA) and with questions from the Autoriteit Persoonsgegevens, as far as the processing by Qyveno is concerned. On request, Qyveno gives the customer the information needed to show that this agreement is being complied with. An audit by an independent expert is allowed once a year, with at least four weeks' notice, during office hours, and at the customer's expense, unless the audit shows that Qyveno does not comply with this agreement.
10. End of the agreement
If the use of Qyveno ends, the customer can still export its data for 30 days. After that Qyveno deletes the customer's environment. Copies in the encrypted backups disappear on their own with the backup cleanup schedule, six months later at the latest, and are not used until then, except to recover from an outage. Data that Qyveno is legally required to keep (such as invoices) is kept for as long as the law requires.
11. Liability and term
For liability, what the terms and conditions say applies. This agreement runs as long as the customer uses Qyveno and afterwards for as long as Qyveno still holds data of the customer. In case of a conflict with the terms and conditions, this agreement prevails, as far as personal data is concerned. Dutch law applies to this agreement.
Annex A: sub-processors
- Hosting: Qyveno runs on its own server in Europe, managed by Qyveno itself. There is no external hosting party.
- STRATO AG (Germany): email (notifications, invitations and other emails from Qyveno go through STRATO's mail servers) and the external backup. That backup is encrypted before it is sent; STRATO cannot read the contents.
- Anthropic (United States), for support only: if a user sends a support question through the question mark, Claude by Anthropic writes a draft reply. For that, the subject, the message and the attached images go to Anthropic, not the name or the email address. A person at Qyveno reads every draft and sends it themselves. The user can turn this off per question with the tick box "No AI draft for this question". The data on the customer's boards never goes to Anthropic.
Services that the customer turns on itself are not sub-processors of Qyveno but a choice of the customer: GIFs through GIPHY (off by default; the user's browser then connects directly to GIPHY), a mail connection of its own (Qyveno then sends through the customer's mail account at its own provider), and webhooks or API tokens with which the customer itself sends data to other systems. The same goes for the AI service for Kompaan, the assistant in the app (off by default): an administrator of the customer then connects its own API key from Anthropic (Claude) or from Microsoft (Claude via Microsoft Foundry, in the customer's own Azure environment), and turns the assistant on itself. When a user asks the assistant a question, Qyveno sends, on the customer's instructions, the question and the data the assistant looks up for it (with that user's permissions) to the customer's own account at that service, under the agreement the customer itself has with Anthropic or Microsoft. The key is stored encrypted at Qyveno and does not leave the server; the assistant only carries out a change once the user clicks Run.
Annex B: security measures
- Separation: every organization has its own database; no table is shared with other customers.
- Connection: all traffic goes encrypted over HTTPS (TLS); unencrypted traffic is redirected to HTTPS.
- Logging in: passwords are only stored as a hash (scrypt, with its own salt per password). Two-step verification is available and an administrator can make it mandatory. There is a limit on repeated login attempts.
- Permissions: roles and permissions per organization and workspace, enforced by the server; private workspaces are only visible to their members.
- API tokens: only stored as a hash, with an expiry date, revocable, and with the permissions of their owner; the administrator can turn the API off for the organization.
- Logs: an activity log per board and an audit log per organization (Admin › Security), among other things for logins, permissions, tokens and support access.
- Backups: daily, encrypted, local (7 nights) and external at STRATO (14 daily, 8 weekly and 6 monthly). Restoring a backup has been tested.
- Qyveno's own admin: Qyveno's own admin area is only reachable from its own network or through an encrypted VPN connection, and only with two-step verification. There, only counts per organization can be seen, not the contents.
- Development and testing: new versions are tested in trial environments with made-up data, never with customer data. Every version is tested before it goes live. Before every update we make an extra local copy; we clean it up after 14 days (the last three stay until there are newer ones).
- Recycle bin: deleted items, boards and workspaces can be restored for 30 days and are then gone for good.