Data processing agreement

Data processing agreementLast updated: 19 October 2026This data processing agreement applies to the processing of personal data by Byna (processor) on your behalf as customer (controller), in the context of your use of the Byna platform. It forms an integral part of the terms of service between you and Byna and is drawn up in accordance with article 28 of the General Data Protection Regulation (GDPR).1. Parties and rolesThe processor is Byna IT (sole proprietorship), established at Walborg 2A, 1082 AM Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 94203431, VAT ID NL003708448B92 (hereinafter: Byna). You are the controller for the personal data you enter into, store in or process through Byna (for example data about your clients, students, contacts or team members). Byna acts as processor and processes this data only on your instructions, as set out in this agreement and the terms of service.2. Nature, purpose and duration of processingByna processes personal data solely for the purpose of providing the service as described in the terms of service (including invoicing, calendar, client management, contracts, forms, sector apps and related features). Processing continues for as long as you have an active account. After termination the retention terms in article 9 below apply.3. Categories of personal data and data subjectsDepending on your use, the following data may be processed:

Identification data (name, address, email, phone number, Chamber of Commerce and VAT numbers).

Financial data (invoice line items, amounts, payment status, IBAN if entered by you).

Appointment and scheduling data (date, time, location, participants).

Data submitted by you or your clients through public forms.

For the driving-school app: data about students, lessons, exams and vehicles.

Communication content, contract documents and attachments you upload or send through Byna.

Technical data such as IP address, browser information and log files for security purposes.

Data subjects may include: your clients, students, contacts, team members and yourself.4. Controller instructionsByna only processes personal data on your documented instructions, unless required to do otherwise by law. Your use of the platform features constitutes such instruction. Byna will inform you if, in its view, an instruction infringes the GDPR or other applicable data protection law.5. Security measuresByna implements appropriate technical and organisational measures to protect personal data against loss, unauthorised access, destruction or disclosure. These include at least:

Encryption of data in transit (TLS) and, where relevant, at rest.

Role-based access control on a need-to-know basis, with access logging.

Strong authentication for administrators, including two-factor authentication.

Regular backups and recovery procedures.

Periodic review and update of security measures.

6. ConfidentialityPersons authorised on behalf of Byna to access your personal data are bound by an obligation of confidentiality, either under their employment contract or through a separate confidentiality undertaking.7. Sub-processorsByna uses carefully selected sub-processors for parts of the service. You hereby grant Byna general authorisation to engage sub-processors, provided Byna enters into a written agreement with each sub-processor containing at least the same obligations as in this agreement. The current sub-processors are:

Stripe Payments Europe, Ltd. (Ireland): payment processing for subscriptions. If you enable online invoice payments, Stripe processes those payments on your own Stripe payment account under Stripe's own terms, as your payment processor rather than as a sub-processor of Byna.

Mollie B.V. (the Netherlands): if an account owner connects their own Mollie account for online invoice payments, Mollie processes those payments on that Mollie account under Mollie's own terms, as the account owner's payment processor rather than as a sub-processor of Byna.

Email delivery service within the EU/EEA: transactional email.

Scaleway SAS (France): AI assistant, processed in data centres in the Paris region (EU). By default prompts and answers are not stored (zero data retention) and are not used to train models. Only on suspected misuse or a server error may a request be kept for up to 2 weeks. No transfer outside the EEA.

Anthropic PBC (United States): AI features such as the document scanner, and fallback for the assistant when Scaleway is unavailable. Data is not used to train models.

The application, the databases and the storage of files and attachments run on Byna's own servers within the EU/EEA, as does the document processing server (scanner and OCR). No external sub-processor is engaged for this.Changes to this list are announced at least 30 days in advance. You may object in writing; if no suitable solution is reached, you may terminate the agreement.8. International transfersByna processes personal data within the European Economic Area where possible. Where specific sub-processors (such as Anthropic) involve transfers outside the EEA, this is done on the basis of an appropriate safeguard such as the EU Commission Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures. The AI assistant is processed by Scaleway within the EU. Only when the assistant falls back to Anthropic does such a transfer take place.9. Assistance with requests and breachesByna assists you, as far as reasonably possible, in fulfilling your obligations under the GDPR, including:

Responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).

Notifying you of personal data breaches: Byna informs you without undue delay, in principle within 48 hours after becoming aware of a breach, with the information you need to fulfil your notification duty to the Dutch DPA (Autoriteit Persoonsgegevens).

Assisting with data protection impact assessments (DPIA) and prior consultations, to the extent within the nature of the processing.

10. Return and deletion of dataOn termination you can export your data yourself via Settings, privacy, or by contacting support. After a deletion request your data remains available for export or reactivation for 30 days. After that period it is permanently deleted, except where statutory retention obligations apply (such as the Dutch 7-year tax-administration retention period).11. Audit rightsYou have the right, at your own cost and at most once per year, to conduct (or have a third party conduct) audits to verify compliance with this agreement. On request Byna provides existing security documentation, certifications or audit reports from its sub-processors. Audits are announced at least 30 days in advance, take place during business hours and may not unreasonably disrupt Byna's operations.12. LiabilityByna's liability under this agreement is limited in the manner described in the terms of service. Statutory liability of Byna as processor under article 82 GDPR remains unaffected to the extent it cannot be limited by law.13. Governing law and disputesThis data processing agreement is governed by Dutch law. Disputes are submitted to the competent court in the Netherlands.14. ContactFor questions, data-subject requests or breach notifications, please contact Byna IT via info@byna.io.