MakClick Privacy Policy and Data Processing Agreement

Last updated: September 2026

This document explains how Tech Click ("MakClick", "we", "us", or "the Platform"), registered with the Dutch Chamber of Commerce under KVK number 97577243, established at Huslystraat 62, 3066 EK Rotterdam, Nederland, processes personal data in connection with the MakClick SaaS platform.

We process personal data in accordance with the GDPR / AVG and other applicable Dutch and European laws. This document forms part of our Terms and Conditions. It contains: Part A — Privacy Policy and Part B — Data Processing Agreement (Verwerkersovereenkomst / DPA).

Part A — Privacy Policy

A1. Controller and roles

For account, billing, support, communication, and security data related to MakClick, Tech Click is in principle the data controller.

Where a business owner or accounting firm enters company, customer, invoice, or document data into MakClick, that party is the controller for that content. MakClick then processes such data as a processor for the purpose of providing the Service, as set out in Part B below.

Exact Online acts as an independent party for data that you or your accountant export or sync to Exact; that processing is governed by Exact’s own terms and privacy policy.

A2. What data we collect and store

Depending on your role and use of the Service, we may process among others:

• Account and identity data: name, email, password (hashed), language preference, account type, and profile settings.
• Company data: company name, address, registration/VAT numbers, and other company details you record.
• Relation data: customer and supplier details entered by you or your accountant.
• Financial and administrative data: invoices, quotes, amounts, VAT data, statuses, and related metadata.
• Time tracking: hours worked and related descriptions/projects.
• Uploaded documents: files (e.g. PDF/images) stored on S3-compatible object storage.
• OCR and AI data: text and results extracted from uploaded documents.
• Exact Online data: OAuth tokens, division identifiers, sync references, and connection status.
• Subscription and payment data: subscription status and payment references via our payment provider (e.g. Stripe). MakClick does not store full payment card numbers.
• Communications: messages via contact forms or support.
• Technical and security data: IP address, session data, logs, device/browser information, as needed for security and abuse prevention.

A3. How we collect data

• Registration and account management.
• Manual entry by you or authorised users.
• File uploads.
• OCR and AI: files may be processed by Microsoft Azure Document Intelligence, and extracted text or data may be processed by Google Gemini, depending on the feature used and solely for extraction and analysis.
• Exact Online OAuth and API synchronisation when the connection is activated.
• Automatic technical logs and security data.
• Limited status updates from payment or email providers.

A4. Purposes and legal bases

• Providing the Service (performance of contract).
• Business–accountant collaboration (performance of contract / legitimate interest).
• OCR and AI data extraction (performance of contract).
• Connection and export to Exact Online (performance of contract; consent via the connection action where needed).
• Subscriptions and payments (performance of contract / legal obligation).
• Support and communication (legitimate interest / performance of contract).
• Security and abuse prevention (legitimate interest / legal obligation).
• Legal obligations where we are required to process data.

We do not sell your personal data.

A5. Retention and deletion

• Active accounts: data is retained while your account is active and needed for the Service.
• End of subscription: data is generally retained for 14 days for export and then deleted from operational systems, unless a longer legal retention period applies.
• Account deletion: you may delete your account via settings. Related data is then deleted or anonymised, except data we must briefly retain by law or for disputes.
• Disconnecting Exact: tokens and active sync links are terminated; data already exported to Exact remains under Exact.
• Backups: encrypted or protected copies may remain within the ordinary backup cycle until that cycle ends.
• Logs: technical logs are kept for a limited period for security and troubleshooting.

A6. Withdrawing consent and requesting deletion

You may exercise your rights via account settings, disconnecting Exact, the contact form, or email to info@makclick.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

A7. Sharing with third parties and service providers

We share data only as needed for the Service or as required by law, including for example:

• Microsoft Azure Document Intelligence: for document processing and OCR.
• Google Gemini: for analysis of extracted text or data.
• Exact Online: when you activate the connection and export or sync data.
• Hosting / VPS and object storage providers: for hosting the application, databases, and documents.
• Email providers (e.g. Resend or SMTP) and payment providers (e.g. Stripe).
• Accountant / accounting firm: under permissions set by you or the firm.

We may engage service providers and sub-processors for hosting, storage, backups, OCR, AI, integrations, and support. We take reasonable steps to select reliable providers and to enter into the available and appropriate arrangements with them, without giving an absolute guarantee that any external provider complies at all times. Provider lists may be updated via the website, email, or within the Platform.

A8. Security

We apply appropriate, reasonable technical and organisational measures proportionate to the risks, including for example: HTTPS encryption; role-based access; private document storage; session and CSRF protection; hashed passwords and OAuth tokens used only for the Exact integration. No system is 100% secure, and we do not represent that data will be absolutely protected against all incidents.

In the event of a personal data breach posing a risk to individuals, we will notify the Autoriteit Persoonsgegevens and, where required, data subjects, in accordance with the GDPR, to the extent legally required for data for which we are the controller.

A9. Your rights (GDPR/AVG)

Where applicable, you have the right to access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent. You may lodge a complaint with the Autoriteit Persoonsgegevens. We appreciate if you contact us first at info@makclick.com. We are not appointed as a DPO; privacy requests go to info@makclick.com.

A10. Cookies

We use cookies and similar technologies needed for sessions, authentication, security, and language preferences. We do not place non-essential marketing tracking cookies without an appropriate legal basis/consent.

A11. Minors

The Service is intended for business use and is not directed at persons under 16.

A12. Changes

We may update this document from time to time. The current version is published on the Platform. For material changes, we will inform you where reasonably possible. Continued use after publication may constitute acceptance of the updated version, to the extent permitted by law.

A13. Contact

Tech Click
Huslystraat 62, 3066 EK Rotterdam, Nederland
KVK: 97577243
Privacy email: info@makclick.com

Part B — Data Processing Agreement (Verwerkersovereenkomst / DPA)

This Part forms an integral part of the agreement between the subscriber ("Data Controller") and Tech Click / MakClick ("Data Processor") pursuant to Article 28 GDPR / AVG, for data and documents uploaded or entered by the subscriber into the Platform.

B1. Roles and subject matter

For documents and data uploaded or entered by the customer (clients, suppliers, invoices, receipts, transactions, working hours, and similar), the customer is the controller and MakClick is the processor. MakClick processes such data solely to provide the Service and follow the customer's documented instructions, including storage, organisation, OCR, data extraction, invoicing, entries, time and expense management, Exact Online synchronisation, support, security, and backups.

B2. Categories of data and data subjects

Data may include identity and contact data; financial and tax data; invoices and receipts; account numbers; customer, supplier, and employee data; and usage logs. It may concern the customer's clients, suppliers, employees, accountants, and counterparties. Special categories of personal data must not be uploaded unless necessary and lawful.

B3. Instructions and confidentiality

MakClick processes data only under the customer's documented instructions, to provide the Service, or to comply with a legal obligation. MakClick ensures that persons authorised to process the data are bound by confidentiality.

B4. Security measures

MakClick applies reasonable technical and organisational measures proportionate to the risks and available means, in line with Article 32 GDPR. These measures do not constitute a guarantee that the Service or data will be absolutely protected against all incidents.

B5. Sub-processors

The customer grants MakClick a general authorisation to use sub-processors needed to provide the Service, which may include Microsoft Azure, Google Gemini, hosting and storage providers, email and payment providers, and Exact Online depending on activated features. MakClick takes reasonable steps to select reliable providers and enter into available and appropriate arrangements with them, without an absolute guarantee of their performance or compliance in all circumstances, especially outside MakClick's reasonable control. The list may be updated via the website, email, or within the Platform.

B6. Data subject rights and DPIA

MakClick assists the customer, to a reasonable extent, with data subject requests and DPIAs. If MakClick receives a request relating to data for which the customer is controller, it will forward the request to the customer and will not respond on the customer's behalf except on instructions or as required by law. Reasonable fees may apply for work outside the ordinary Service.

B7. Personal data breach

Upon becoming aware of a confirmed personal data breach affecting the customer's data, MakClick will notify the customer without undue delay, aiming to notify within 48 hours of confirmed awareness, with such information as is then available. The customer remains responsible for deciding whether to notify the Autoriteit Persoonsgegevens within 72 hours when required.

B8. Audit

MakClick will provide the customer with reasonable information to demonstrate compliance. An audit may take place after reasonable notice, once per year unless a material incident occurs, during business hours, without disclosing other customers' data, and at the customer's expense unless the audit reveals a material breach by MakClick.

B9. Return and deletion

Upon termination, and at the customer's choice, MakClick will return or delete the data after the 14-day export window, unless the law requires retention. Remaining copies are handled within the ordinary backup cycle and remain protected until deletion.

B10. Liability and duration

Liability under this Part is subject to the liability limitations in the Terms and Conditions, to the extent permitted by the GDPR and Dutch law. Nothing excludes liability that may not be excluded by law. This Part applies for as long as MakClick processes data on behalf of the customer; confidentiality and deletion obligations continue after subscription end as needed.