GDPR

QaaS Consultancy B.V. processes personal data in line with the General Data Protection Regulation (GDPR). This page explains how.

1. Controller and processor

For your account data, we act as the controller. For the Fabric and Power BI metadata we process on your behalf, we act as the processor. A data processing agreement (DPA) is available on request via info@qaas.nl.

2. Processing principles

We process data lawfully and transparently, only for clear purposes (purpose limitation), keeping it to a minimum (data minimisation), accurate and up to date, no longer than necessary (storage limitation), and with appropriate security.

3. Your rights

• Access to your data
• Rectification of inaccurate data
• Erasure (“right to be forgotten”)
• Restriction of processing
• Data portability
• Objection to processing

You can submit a request via info@qaas.nl.

4. Data location

Your data is stored and processed within the European Union (Microsoft Azure). We do not transfer data outside the EEA without appropriate safeguards.

5. Sub-processors

We use the following sub-processors:

• Microsoft Azure - database, storage, and hosting (EU)
• Vercel - application hosting and CDN
• Clerk - authentication
• Upstash - caching
• Resend - transactional email
• Polar - payments and subscriptions
• Sentry - error monitoring
• PostHog - product analytics

6. Data breaches

In the event of a data breach that poses a risk, we notify the affected individuals and the competent supervisory authority within 72 hours, in line with the GDPR.

7. Retention period

We keep account data for as long as your account is active and delete it within 30 days of cancellation. See the privacy policy for details.

8. Contact and supervisory authority

For privacy questions, you can reach Michiel Quakernaat via info@qaas.nl (QaaS Consultancy B.V., Uitwijks Dijkje 1, Uitwijk, Chamber of Commerce no. 42057563). You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).