← Back to DepoFact

Personal Data Processing

Last updated: May 2026  ·  Applies to depofact.be, my.depofact.be and the DepoFact mobile app

1. Data Controller

Una Group BV, operating under the brand DepoFact, is the data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

2. What data do we collect?

Category	Specific data	Source
Account data	Email address, display name, Firebase Authentication UID, login timestamp, language preference	Directly via login form
Business & transaction data	Company names, contact details, invoices, orders, payments, stock movements, quotations	Entered by the user or imported via Billit API
Push notification token	Firebase Cloud Messaging (FCM) device token, platform (Android/iOS), language setting, registration timestamp	Automatically upon mobile app installation
Analytics data	Session ID, page views, click events, language setting, device type, anonymised IP address (last octet removed)	Google Analytics 4 (GA4), measurement ID G-5M5S0MHMET
Log data	Email send timestamps, delivery status (open/click via SES events), Cloud Functions error logs	AWS Simple Email Service (SES) + Firebase Cloud Functions
Device & session data	User-agent, browser/OS version, screen width (for error diagnosis in Cloud Functions logs only)	Automatic

3. Purposes and legal bases

Purpose	Legal basis (GDPR art. 6)
Providing the SaaS service (invoicing, inventory management, reporting)	Performance of a contract (art. 6.1.b)
Authentication and access control	Performance of a contract (art. 6.1.b)
Sending transactional emails (invoice alerts, payment confirmations)	Performance of a contract (art. 6.1.b)
Push notifications about new invoices and payments	Legitimate interest (art. 6.1.f) – timely notification to authorised staff
Platform analytics and UX improvement	Legitimate interest (art. 6.1.f) – anonymous aggregated statistics
Security, fraud prevention and error detection	Legitimate interest (art. 6.1.f)

4. Technical infrastructure and storage location

All personal data is stored and processed on Belgian servers through the following service providers:

• Google Firebase (GCP) – storage, authentication, push notifications and serverless processing. Servers located in Belgium (EU). Data processing in accordance with the Google Cloud DPA and Standard Contractual Clauses (SCCs).
• Amazon SES – used solely for sending transactional emails. Servers located in the EU (Ireland).
• Google Analytics – anonymised website statistics (IP address is not stored in full).
• Billit NV – accounting data synchronisation, only upon explicit request by the tenant administrator.

5. Retention periods

Data category	Retention period
Account data and transaction data	For the duration of the tenant agreement + 7 years (statutory accounting obligation)
FCM push tokens	Automatically deleted on logout; invalid tokens deleted after failed delivery
Email logs (SES events)	90 days
Cloud Functions logs (Google Cloud Logging)	30 days (default GCP retention)
GA4 analytics data	14 months (configured in GA4 property settings)

6. Cookies and local storage

The web application (my.depofact.be) uses the following storage mechanisms:

• IndexedDB – Firestore offline cache: local copy of business data for offline use. Does not contain sensitive authentication data.
• localStorage – language preference, active tenant ID, FCM device token (for removal on logout), session markers.
• Service Worker Cache (Cache Storage API) – static PWA assets for offline availability.
• Google Analytics cookies – _ga, _ga_*: anonymous session tracking (2-year validity).

We do not place third-party tracking cookies other than Google Analytics.

7. Sharing with third parties

DepoFact shares personal data exclusively with the following parties, and only to the extent strictly necessary for service delivery:

• Google LLC – cloud infrastructure and analytics (data processing agreement in place).
• Amazon Web Services EMEA SARL – email delivery via Amazon SES (data processing agreement in place).
• Billit NV – accounting synchronisation only upon explicit activation by the tenant administrator.

Data is never sold, rented or transferred to marketing parties.

8. Security

• All communication is encrypted via TLS 1.2+.
• Firestore access is protected via Firebase Security Rules at document level (multi-tenancy isolation per tenantId).
• Cloud Functions are secured via Firebase App Check and Google reCAPTCHA Enterprise.
• Email delivery via SES uses DKIM and SPF authentication on the notify.depofact.be domain.
• FCM push tokens are immediately removed from Firestore upon user logout.
• Access to Google Cloud Console and Firebase Console is restricted to authorised personnel via two-factor authentication.

9. Your rights as a data subject

• Right of access (art. 15) – you may request what data we process about you.
• Right to rectification (art. 16) – you may have incorrect data corrected.
• Right to erasure (art. 17) – you may request deletion of your personal data.
• Right to restriction of processing (art. 18).
• Right to data portability (art. 20) – export of your data in machine-readable format.
• Right to object (art. 21) – in particular against processing based on legitimate interest.

To submit a request, send an email to privacy@depofact.be. We respond within 30 days.

You also have the right to lodge a complaint with the Data Protection Authority (GBA):
Drukpersstraat 35, 1000 Brussels – dataprotectionauthority.be

10. Changes to this policy

We reserve the right to amend this privacy policy. For material changes, active users will be informed via the application or by email. The date of the last update is shown at the top of this page.

11. Contact