Processor agreement

Effective 2 November 2026Save or print

1. Parties and roles

This processor agreement is part of the Netto terms and applies for as long as they do. For the personal data you put into Netto, or let into it, about your customers, suppliers, contact persons, team members and other people in your administration, you are the controller and GNS is the processor, as meant in the General Data Protection Regulation (GDPR). For our own processing, such as your account and billing, we are controller; our privacy policy covers that.

2. What we process

• Purpose and nature. Storing, organising, analysing (including with AI), displaying, sending and deleting data, to provide Netto as described in the terms.
• Kinds of personal data. Names, contact and address details, Chamber of Commerce and VAT numbers, bank account numbers, invoice, quote, payment and transaction data, the contents of receipts, documents, emails and messages you add, and any other data you enter.
• People concerned. Your customers, suppliers and their contact persons, you and your team members, your accountant, and other people who appear in your administration.
• Duration. For as long as the terms apply, plus the period in article 12.

3. Your instructions

• We process the data only on your documented instructions. Those are these terms, and the way you use and set up Netto. When you switch on a feature, connect a bank, a payment provider or another app, or give your accountant or a team member access, you instruct us to process and share the data that feature needs.
• We may process data without your instruction where a law requires it. We then tell you first, unless that law forbids it.
• If we think an instruction breaks data protection law, we tell you. We may then refuse to carry it out.

4. Your responsibilities

You make sure you have a lawful ground for the data you put into Netto, that you inform the people concerned, and that you only put in what your administration needs. Do not put in special categories of personal data or criminal data, and citizen service numbers (BSN) only where a law requires them.

5. Confidentiality

Everyone who processes the data on our behalf is bound to confidentiality. We give access only to people who need it for their work.

6. Security

We take appropriate technical and organisational measures to protect the data, matched to the risk. These include encryption in transit, separation of data per account, access control, logging, backups, and careful selection and monitoring of our suppliers. We may change the measures, as long as the level of protection does not go down. Considering the nature of the data and the state of the art, you agree that these measures are appropriate. You secure your own account and devices.

7. Sub-processors

• You give us general permission to engage sub-processors. We currently use sub-processors in these categories: hosting and database, AI processing, email delivery, messaging, error monitoring and customer support.
• The current list of sub-processors, with where they process data, is available on request at privacy@netto.so.
• We impose on each sub-processor the same data protection obligations as this agreement imposes on us, and we remain responsible to you for them.
• We tell you at least 30 days before we add or replace a sub-processor, by email or in the app. Within that period you may ask for its details and object on reasonable grounds. If we cannot meet your objection, you may end the agreement before the change takes effect, and we refund the unused part of a prepaid period. That is your only remedy.
• Providers you contract with yourself, such as account information and payment providers, and apps you connect yourself, are not our sub-processors. They process data under their own responsibility.

8. Transfers outside the EEA

Some sub-processors, for example for AI processing, may process data outside the European Economic Area. We allow that only with appropriate safeguards, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or the Commission's standard contractual clauses. You permit these transfers. If you connect an app whose provider is outside the EEA, sending data to it is a transfer on your instruction, and you are responsible for its lawfulness.

9. Helping you

• You can handle most requests of people concerned (access, correction, deletion, export) yourself in Netto. If a request reaches us, we forward it to you and do not answer it ourselves, unless you ask us to.
• Where reasonable, we help you with requests, data protection impact assessments and consultations with the supervisory authority. Help beyond what Netto offers itself may be charged at a reasonable rate.

10. Data breaches

If we discover a personal data breach that affects your data, we inform you without undue delay, and we aim to do so within 48 hours, with the information we have at that time. We take reasonable measures to limit the consequences. You decide whether to notify the supervisory authority and the people concerned.

11. Audits

On request we give you the information you need to check that we meet this agreement, such as a description of our measures and answers to reasonable questions. Only if that information is not enough, you may have an audit done by an independent auditor bound to confidentiality: at most once a year, with 30 days' notice, at your own cost and without disrupting our operation.

12. When the agreement ends

After the terms end, you can export your data for 90 days. After that we delete the personal data, unless a law requires us to keep it. Copies in backups disappear in the normal backup cycle.

13. Liability

Our liability under this agreement falls under article 20 of the terms; the limit there applies to this agreement and the terms together. The rights of people concerned under article 82 GDPR are not affected by this. You indemnify us against claims and fines that arise from your instructions or from your breach of data protection law.

14. Order

For the processing of personal data, this agreement takes precedence over the terms. In all other respects the terms apply.