Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the agreement between Qbil Software B.V. (“Qbil”, “we”, “our”, or “us”) and its customers (“Customer”) regarding the processing of personal data in connection with the use of Qbil Software solutions, including Qbil-Trade and Moo Software.

Qbil Software B.V. is committed to protecting personal data and processing it in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

1. Roles and Responsibilities

For the purposes of applicable data protection laws:

• The Customer acts as the Data Controller, determining the purposes and means of processing personal data.
• Qbil Software B.V. acts as the Data Processor, processing personal data solely on behalf of the Customer and in accordance with the Customer’s documented instructions.

Qbil processes personal data only as necessary to provide and support its software services.

2. Nature and Purpose of Processing

Qbil may process personal data in order to provide the following services:

• ERP software solutions for commodity and ingredient trading
• system hosting and data storage
• software maintenance and updates
• customer support and technical assistance
• system security monitoring and incident response

Processing activities may include:

• storing data
• organising and structuring data
• retrieving and transmitting data
• securing and backing up data

3. Types of Personal Data

Depending on the Customer’s use of the software, the following categories of personal data may be processed:

• contact details (name, email address, phone number)
• business contact information
• system user credentials
• transactional and operational data entered by users
• communication records related to support requests

Qbil does not intentionally process special categories of personal data unless explicitly instructed by the Customer.

4. Security Measures

Qbil Software B.V. implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data.

These measures include safeguards relating to:

• access control and authentication
• data protection and system security
• monitoring and incident response
• backup and business continuity
• secure software development and maintenance

Qbil continuously reviews and improves its security controls as part of its information security management processes.

5. Sub-processors

Qbil Software B.V. may engage carefully selected third-party service providers (“Sub-processors”) to support the delivery and operation of its services. These may include providers of:

• cloud infrastructure
• system hosting
• communication services
• support and monitoring tools

All Sub-processors are contractually required to implement appropriate technical and organisational measures to protect personal data and comply with applicable data protection laws.

An up-to-date list of authorised Sub-processors, including their purpose, country of establishment and, where applicable, information regarding international data transfers, is available at:

https://www.qbilsoftware.com/subprocessors/ 

Qbil Software B.V. reserves the right to update its Sub-processors from time to time. The Sub-processor list referenced above will always reflect the current list of approved Sub-processors.

6. International Data Transfers

Qbil processes and stores data primarily within the European Economic Area (EEA).

Where personal data is transferred outside the EEA, Qbil ensures that appropriate safeguards are in place in accordance with applicable data protection laws, including where applicable:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy Decisions issued by the European Commission;
• Other legally recognised transfer mechanisms.

7. Data Retention and Deletion

Customer data is retained only for as long as necessary to provide the services.

Upon termination of the service agreement:

• customer data will be returned or made available for export where applicable;
• data will subsequently be securely deleted within a defined retention period, unless legal obligations require longer storage.

Secure data destruction processes are used to prevent unauthorised access or recovery.

8. Data Subject Rights

Qbil supports its customers in responding to data subject requests, including:

• access requests
• correction requests
• deletion requests
• data portability requests

As the Data Controller, the Customer remains responsible for responding to such requests.

9. Data Breach Notification

In the event of a personal data breach affecting Customer data, Qbil will:

• promptly investigate the incident;
• take appropriate mitigation measures;
• notify the Customer without undue delay;
• provide relevant information to support the Customer’s regulatory notification obligations.

10. Compliance and Certifications

Qbil Software B.V. maintains a strong commitment to security, privacy and regulatory compliance.
Our information security and privacy programme includes:

• ISO 27001 – Information Security Management
• ISO 27701 – Privacy Information Management
• NIS2 cybersecurity readiness

These frameworks help ensure that personal data is processed securely and responsibly.

11. Contact

For questions regarding this Data Processing Addendum or Qbil Software B.V.’s data protection practices, please contact:

Qbil Software B.V.
Landjuweel 16-4
3905 PG Veenendaal
The Netherlands

Email: [email protected]
Website: https://moosoftware.com

Last updated: July 2026

Dowload Data Processing Addendum (DPA) »