Data processing agreement

Version 1.0 · 15 October 2026

What is this agreement about?

Whoever uses Hopfact puts other people's personal data into it: the contact persons of their clients, whoever signs a timesheet, whoever receives a timesheet or invoice. For that data, your business is the controller, and LOOTVOET BV the processor. Article 28 of the General Data Protection Regulation (GDPR) then requires an agreement between the two. This is that agreement.

Words such as personal data, processing, data subject and sub-processor have the meaning the GDPR gives them. A data breach is a personal data breach within the meaning of the GDPR.

Parties

You: the business that uses Hopfact, as controller.
We: LOOTVOET BV, Groenestraat 37/C, 8691 Alveringem, company and VAT number BE 0800.934.047, RLE Ghent, Veurne division, as processor. You can reach us at info@hopfact.be.

You accept this agreement in the app: when you create your organisation, and again with every new version. We record with which account, which version and when you agreed. That agreement counts as a written agreement in electronic form, as Article 28 GDPR allows. Whoever agrees declares that they may do so on behalf of the business.

For your own account, your sign-in and the waitlist, we are responsible ourselves. Those fall outside this agreement. For them, the privacy statement applies.

Subject matter, duration, nature and purpose

Subject matter: the personal data you enter in Hopfact, and the personal data that arises when you use Hopfact.
Duration: from your agreement until we have erased all data (see "After the end").
Nature: storing, organising, looking up and displaying, combining into documents (timesheets, invoices and audit trails), sending by email and through Peppol, recording events, and erasing.
Purpose: only providing Hopfact to you: keeping track of your work, creating timesheets and having them signed, creating and sending invoices, sending you your notifications and keeping your documents. We also keep Hopfact secure and working. We never use your data for our own purposes, we do not sell it and we do not use it for advertising.

Which data, about whom

Data subjects	Data
Contact persons at your clients	Name, email address, job title and language
Signers	Name, email address and language. The typed name or the drawn signature (as strokes, not as an image), and the reason for a decline. The time of every step: request, reminder, opening, downloading, approving or declining. For every action on the signing page, also the IP address and the browser
Clients and agencies that are a natural person, such as a freelancer	Name, address, VAT and company number, logo, email addresses for invoices and timesheets, and what is on their invoices
Recipients of timesheets and invoices	Email address, and whether the email arrived
Consultants and other people at your business without an account of their own	Name on assignments, timesheets and invoices, and the days, hours and notes on their timesheets
Anyone you name in free text	What you write in day notes, descriptions of time blocks or invoice lines

You do not put special categories of personal data into Hopfact, such as data about health or religion, no data about criminal convictions and no national register numbers. Hopfact never asks for them.

Your instructions

We only process your data on your instructions. Your instructions are this agreement and what you do in the app. With "Sign and send", for example, you ask us to email the timesheet to the signer, and with "Send over Peppol" to send the invoice through Recommand.

If the law obliges us to process it otherwise, we tell you in advance, unless the law forbids that. If we think an instruction infringes the GDPR, we tell you.

What we do

Confidentiality

Whoever can access your data on our side is bound to confidentiality. Today that is one person: whoever runs Hopfact. They only look at your data when that is needed: to fix an error or outage, for support you asked for, or because the law requires it.

Security

We take appropriate technical and organisational measures, as Article 32 GDPR requires. Today they are these:

The app and its data are in the European Union, at Microsoft Azure in Sweden.
All traffic is encrypted (TLS 1.2 or higher), and the database and document storage are stored encrypted.
Each organisation only sees its own data. A filter in the app enforces that on every lookup, and automated tests check it.
Hopfact has no passwords. You sign in through Microsoft Entra External ID, with a one-time code, with Google or with a personal Microsoft account. The app itself reaches the database, the storage and the key vault with an Azure managed identity, without a password.
Secret keys are in Azure Key Vault, not in the code.
Documents are in private storage. You only download them through the app, after it has checked who you are.
Issued invoices, sent timesheets and their audit trail are in immutable storage: for 10 years no one can change or delete them.
A signing link contains 32 random bytes. We only keep a fingerprint (hash) of it, and the link never appears in a log.
Logs never contain an email address, IBAN or token, and are deleted after 30 days.
Public pages, such as the signing page, slow down too many attempts per IP address.
Azure automatically backs up the database.
Only whoever runs Hopfact can access the production environment, with their own Microsoft account.

We adapt these measures when the risks or the technology change.

Sub-processors

You give us general authorisation to engage these sub-processors:

Sub-processor	What	Where
Microsoft Ireland Operations Ltd, Ireland	Hosting (App Service), database (Azure SQL), document storage (Blob Storage), key vault (Key Vault), email and delivery reports (Azure Communication Services and Event Grid), logs (Application Insights) and sign-in (Entra External ID)	Sweden (Sweden Central). Email: Europe
Recommand: BRBX BV, Nieuwdorp 5, 3990 Peer, Belgium, company number 1012.081.766	Peppol access point: registering your business as a sender, checking whether a client can receive through Peppol, and sending invoices through Peppol	European Union
Plausible Insights OÜ, Estonia	Visitor statistics for the website. Receives no data from the app	Germany

We impose on every sub-processor, in a written agreement, the same obligations as this agreement. For Microsoft, that is its Data Protection Addendum. If a sub-processor fails to meet its obligations, we remain responsible for that towards you.

If we want to add or replace a sub-processor, we tell you at least 30 days in advance, by email to your organisation's contact address. The app then asks you to accept a new version of this agreement. You can object. If we find no solution together, you can stop using Hopfact before the change takes effect.

Not sub-processors are the recipients you choose (your client, the signer, your client's Peppol access point and your accounting tool), and VIES, the European Commission's service where we check a VAT number.

Transfers outside the European Economic Area

Your data is in the European Union. During support or maintenance by Microsoft, access from a country outside the European Economic Area is possible. The European Commission's standard contractual clauses apply to that, in the agreement with Microsoft. For a few services, Recommand relies on sub-processors of its own outside the European Economic Area, also under those standard contractual clauses. We make any other transfer only with the safeguards of Chapter V of the GDPR, and after informing you.

Help with data subjects' rights

You can do a lot yourself in the app: view and correct data, delete contact persons and companies, and download documents. If something isn't possible in the app, we help you within a reasonable time.

If we receive a request from a data subject about data you put into Hopfact, we forward it to you without undue delay. We do not answer it ourselves, unless you ask us to.

Help with security and impact assessments

We help you meet your obligations under Articles 32 to 36 GDPR, with the information we have: about security, in case of a data breach, and if you carry out a data protection impact assessment or must consult the Data Protection Authority.

Data breaches

If we notice a data breach that affects your data, we notify you without undue delay, as Article 33 GDPR requires. We email your organisation's contact address for that.

We give you what we know at that moment: what happened, which data and how many data subjects it affects, the likely consequences, and what we do to resolve it and limit the consequences. What we learn later, we send on. You decide whether to report the data breach to the Data Protection Authority and to the data subjects. We help you with that.

After the end

Processing ends when you delete your account, or when Hopfact or your participation stops as the beta terms describe.

Returning data. As long as your account exists, you can download every document: invoices as PDF and UBL, timesheets and audit trails as PDF. That is how you get your data back. So best download them before you delete your account.
Deleting your account. You do that yourself, with a button in the app. 30 days after your click, we erase your organisation's data and your sign-in. Within those 30 days you can still cancel.
Documents with a retention obligation. Issued invoices, sent timesheets and their audit trail stay in the immutable storage until their 10 years have passed. No one can erase them sooner, not even us, and you are legally required to keep them for 10 years. No one opens them, we provide them to you on request, and after those 10 years we erase them.
If Hopfact or your participation stops, the same applies, after you were able to download your documents as the beta terms describe.
Backups and logs. Erased data also disappears from the automatic database backups within 7 days. Logs disappear after 30 days.

Information and audits

You can ask us to demonstrate that we comply with this agreement. We then provide you, within 30 days, with the information you need for that. For Microsoft's data centres, we refer to its certificates and audit reports, such as ISO 27001.

If that information is not enough, an independent auditor bound to confidentiality may carry out an audit. That can happen at most once a year (more often after a data breach), with at least 30 days' notice, and at your expense. The audit must not touch other users' data.

What you do

You have a legal basis for the data you put into Hopfact, and you inform the data subjects, such as your signers. You may refer them to our privacy statement for that, which describes what Hopfact does with their data.
You only put data into Hopfact that you need for your timesheets and invoices.
Your instructions comply with the GDPR.
You keep your sign-in and your devices secure, and you tell us immediately if you suspect misuse of your account.

Liability

Liability between you and us is governed by the beta terms, and later by the general terms that replace them. Towards data subjects, Article 82 GDPR applies.

Changes and precedence

We can change this agreement, for example for a new sub-processor. You accept a new version in the app, the next time you sign in.

If the terms and this agreement contradict each other about personal data, this agreement prevails.

Governing law and court

Belgian law applies to this agreement. In case of a dispute, only the Enterprise Court of Ghent, Veurne division, has jurisdiction.