1. Controller
Joffers BV, [address], company number [number], is the controller for personal data relating to your account and use of joffers.eu. For the content you upload into projects, you are the controller and we act as your processor. Contact: privacy@joffers.eu.
2. What we collect
Account data: name, work email, company name, role, password hash. Billing data: company address, VAT number, and payment metadata (card details are handled by our payment provider, never by us). Usage data: pages viewed, features used, extraction runs, error logs, IP address and browser type.
Project content: the documents you upload and everything derived from them — line items, quantities, rates, offers and client details you enter. This may contain personal data about your clients; you decide what goes in.
3. Why, and on what basis
We process account and project data to perform our contract with you (Art. 6(1)(b)); usage and log data for our legitimate interest in keeping the service secure, reliable and improving (Art. 6(1)(f)); billing data to meet legal and accounting obligations (Art. 6(1)(c)); and marketing email only with your consent (Art. 6(1)(a)), withdrawable at any time.
4. Project documents and AI
To extract a scope, each page of an uploaded document is converted to an image and sent to our AI processing provider, which returns structured line items. Our providers act as processors under contracts that prohibit using your content to train their models, and content is not retained by them beyond what is needed to return a result. Extraction happens only when you start it.
5. Processors we use
Hosting and database, object storage for documents, AI model providers for extraction, background job processing, payment processing, transactional email, and product analytics and error monitoring. A current list with each processor's name, purpose and location is available on request and in our data processing agreement.
We do not sell personal data and do not share it for advertising.
6. Where data is stored
Account and project data is stored in the European Union. Where a processor operates outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses together with supplementary measures, and we will name that processor and country on request.
7. How long we keep it
Project content is kept while your account is active and for 30 days after termination, so you can export it, and is then deleted from live systems within 30 days and from backups within 90. Invoices are kept for the statutory retention period. Security and error logs are kept for 12 months. Analytics data is aggregated after 14 months.
8. Your rights
You can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interest. Write to privacy@joffers.eu and we will respond within one month. You also have the right to complain to your national data protection authority.
9. Security
Data is encrypted in transit and at rest. Access to production systems is limited to staff who need it, protected by multi-factor authentication and logged. Documents are stored in private object storage reachable only through short-lived signed links. Workspaces are logically separated so one company cannot reach another’s projects. We will notify you and the supervisory authority of a qualifying breach without undue delay.
10. Cookies
We use strictly necessary cookies for sign-in and security, and — only with your consent — analytics cookies that help us see which parts of the application are used. You can change your choice at any time from the cookie settings link in the footer of the application.
11. Changes and contact
We will post any update here and, for material changes, notify you by email at least 30 days in advance. Questions about this policy or a data processing agreement: privacy@joffers.eu.