Data Processing Agreement

Version 1.2.2 · published 8 October 2026 · in force for existing users from 7 November 2026

This Data Processing Agreement (“Agreement”) governs the processing of personal data by the Processor on behalf of the Controller in the context of the StatementBridge service, as referred to in Article 28 of the General Data Protection Regulation (GDPR). This Data Processing Agreement forms part of the StatementBridge Terms and Conditions and is accepted together with them.

Processor: FIDURO B.V., Stephensonweg 6, 4207 HB Gorinchem, CoC 78200695

Controller: the User (any business, legal entity or professional who uses StatementBridge)

Article 1 — Definitions

  1. Controller: the User of StatementBridge who determines the purposes and means of the processing of personal data.
  2. Processor: FIDURO B.V., which processes personal data on behalf of the Controller in the context of the StatementBridge service.
  3. Data Subject: the natural person to whom the personal data relate.
  4. Personal Data: any information relating to an identified or identifiable natural person, as referred to in Article 4(1) GDPR.
  5. Sub-processor: a third party engaged by the Processor to carry out (part of) the processing.
  6. GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).

Article 2 — Subject matter and duration

  1. This Agreement relates to the processing of personal data that takes place in the context of the StatementBridge service, an online application for the conversion of bank statements and transaction files between various file formats.
  2. The duration of this Agreement is equal to the period during which the Controller holds an active account with StatementBridge.
  3. The source file is deleted no later than 1 hour(s) after upload; if an interruption leaves it behind, automatic clean-up removes it, usually within 25 hours. Export files contain transaction data and can be downloaded for up to 24 hours; they are removed at the next clean-up after that. Conversion metadata and account details you save are retained. Files you e-mail to us yourself, for example with a support question, stay in our support mailbox until we delete them; please do not attach complete statements. Connections use HTTPS; the application and database run in Frankfurt. An AI scan sends the PDF content to the AI provider.

Article 3 — Nature and purpose of the processing

  1. The processing concerns the conversion of bank statements and transaction files between formats including MT940, CAMT.053, CAMT.054, CSV, Excel, OFX, CODA, DATEV and PDF.
  2. The purpose of the processing is to convert financial transaction data into a file format that is compatible with the accounting software of the Controller.
  3. Optionally, the Controller can start AI extraction of PDF files; it only starts after the Controller's confirmation. (a) For a credit-based AI scan, the Processor engages Mistral AI as a sub-processor (Article 7). (b) When the Controller uses its own API key (Pro), the Processor sends the PDF content on the Controller's instruction to the provider chosen by the Controller (Anthropic, OpenAI, Google, Mistral or xAI). That provider is not a sub-processor of the Processor and processes the data under the agreement between the Controller and that provider.

Article 4 — Types of personal data

On behalf of the Controller, the Processor processes:

  • transaction data in uploaded and exported files: IBANs, amounts, descriptions, dates, references and counterparty names;
  • saved account details in profiles and the address book: name, bank, IBAN (encrypted), BIC, currency, column mapping and export settings;
  • conversion metadata: formats, counts, status, error diagnostics and settings, including a masked account number, and the fingerprints of the source file and money movements that enable a free re-export;
  • PDF content sent to an AI provider during AI extraction.

FIDURO processes the User's own account, payment, consent and technical data (such as email address, IP address and Stripe data) as a controller; see the Privacy Policy.

Article 5 — Categories of Data Subjects

  1. Account holders and staff of the Controller whose data appear in the uploaded files or in saved account details.
  2. Third parties whose data appear in bank statements: counterparties and beneficiaries of transactions included in the uploaded files.

Article 6 — Obligations of the Processor

The Processor commits to the following:

  1. To process personal data only on the basis of documented instructions from the Controller, unless required to do so by a legal obligation.
  2. To ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. To take all appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as referred to in Article 32 GDPR.
  4. To comply with the conditions for engaging sub-processors as described in Article 7 of this Agreement.
  5. To assist the Controller in fulfilling requests from Data Subjects to exercise their rights under the GDPR.
  6. To assist the Controller in carrying out a Data Protection Impact Assessment (DPIA) where necessary.
  7. To delete the personal data after the end of the processing services in accordance with Article 12, unless storage is required by law. Return: the Controller can retrieve its saved account details and conversion metadata itself before termination through the export in the account settings; export files are downloadable for up to 24 hours after creation.
  8. To make available all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and to allow for and contribute to audits.

Article 7 — Sub-processors

The Controller grants the Processor general written authorisation to engage the following sub-processors:

Sub-processorPurposeLocationSafeguards
Render (Render Services, Inc., USA) Hosting of the application, database, temporary files and server logs Hosting region Frankfurt (EU) Under the provider's terms
Cloudflare (Cloudflare, Inc., USA) Network and DDoS protection of all web traffic (TLS), including uploaded and exported files; engaged through the hosting provider or directly (the contractual chain is being confirmed) Global network; processing may take place outside the EEA Under the provider's terms
Stripe Payments, subscriptions, invoices and VAT; Stripe receives your email address, name, billing and payment details EU and USA Under the provider's terms
Resend (Resend, Inc., USA) Sending service and account emails (verification, login links, password reset, notifications, tips and offers) According to the account's sending region Under the provider's terms
Mistral AI (Mistral AI SAS, France) AI extraction for a credit-based AI scan, only after your confirmation: text or page images from the PDF According to FIDURO's agreement and account settings with Mistral AI Under the provider's terms

Providers that the Controller chooses itself with its own API key are not sub-processors (Article 3.3).

  1. The Processor shall inform the Controller in advance of any intended changes concerning the addition or replacement of sub-processors, through the change log on this page and a notice in the Service.
  2. The Controller has the right to object to changes in sub-processors within 30 days of publication. If the objection cannot be resolved, the Controller has the right to terminate the Agreement.
  3. The Processor ensures that the same data protection obligations as set out in this Agreement are imposed on each sub-processor.

Article 8 — Transfers outside the EEA

  1. Personal data is transferred to countries outside the EEA only with an appropriate safeguard under Chapter V GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or standard contractual clauses, as laid down in the terms of the sub-processor concerned.
  2. For AI extraction with its own API key, the Controller chooses the provider and thereby the processing location.
  3. The Processor ensures that any transfer of personal data to a country outside the European Economic Area (EEA) complies with Chapter V of the GDPR.

Article 9 — Security measures (Art. 32 GDPR)

The Processor has implemented the following technical and organisational security measures:

  • Encrypted transport — all communication runs over HTTPS (TLS).
  • Password hashing — passwords are stored as bcrypt hashes and never in readable form.
  • Encryption at rest of secrets — API keys and IBANs in saved profiles and the address book are encrypted when stored (Fernet: AES-128 with HMAC).
  • Limited retention — source files are deleted after processing and export files are downloadable for up to 24 hours; see the retention periods in the privacy policy.
  • Cookies — the session cookie is HttpOnly, Secure and SameSite=Strict; the sign-in cookie is HttpOnly and the server checks its age itself.
  • Rate limits — on signing in, login links, password reset, uploads, exports and the API, among others, and a temporary lockout after repeated failed sign-ins.
  • Access control — downloads are bound to the account that created the conversion and to a per-file token; users can only reach their own data; administrative functions are limited to designated FIDURO administrators.
  • Content Security Policy — limits which scripts the site may load; fonts are served from our own server.
  • Updates — The Processor updates software and dependencies when security updates become available.
  • Logging — server and error logs may contain personal data such as IP address, user ID and parts of error messages; email addresses are not logged in full, and IBANs and amounts are masked in stored error diagnostics.

Article 10 — Data breach notification

  1. The Processor shall notify the Controller of any data breach (personal data breach) without undue delay and no later than 72 hours after becoming aware of it.
  2. The notification shall contain at least the following information:
    • the nature of the data breach, including where possible the categories and approximate number of Data Subjects concerned;
    • the categories and approximate number of personal data records concerned;
    • the likely consequences of the data breach;
    • the measures taken or proposed to address the data breach and mitigate its adverse effects.
  3. The Processor shall fully cooperate with the Controller in investigating and handling the data breach.

Article 11 — Assistance with Data Subject rights

  1. The Processor shall assist the Controller in responding to requests from Data Subjects with regard to the following rights:
    • Right of access (Art. 15 GDPR)
    • Right to rectification (Art. 16 GDPR)
    • Right to erasure (Art. 17 GDPR)
    • Right to restriction of processing (Art. 18 GDPR)
    • Right to data portability (Art. 20 GDPR)
    • Right to object (Art. 21 GDPR)
  2. The User can delete their account themselves in the StatementBridge settings, after re-authentication (password or a fresh login link); Article 12 describes what is still retained afterwards.

Article 12 — Return and deletion

  1. Upon termination of the processing services (deletion of the account), the Processor removes the Controller's personal data from the production database, with the exceptions of paragraph 2.
  2. Deleting the account in the application removes the Controller's personal data from the production database, except:
    • (a) conversion metadata, which is unlinked from the account and kept for statistics without settings, error details or file fingerprint;
    • (b) export files that have not yet expired and are deleted at the next clean-up;
    • (c) copies in the hosting provider's backups and logs, which are overwritten according to its retention periods;
    • (d) data the Processor must retain by law, such as payment records.
  3. Uploaded source files are deleted after processing; if processing is interrupted, at the latest at the automatic clean-up. Export files are downloadable for up to 24 hours by the account that created them and are then deleted at the automatic clean-up.

Article 13 — Audit rights

  1. The Controller has the right to conduct or have conducted audits to verify compliance with this Agreement.
  2. The Processor shall cooperate with reasonable audit requests and make the necessary information available.
  3. As an alternative, the Processor may provide an independent audit report (such as SOC 2 or a comparable certification) to demonstrate compliance.

Article 14 — Governing law and disputes

  1. This Data Processing Agreement is governed by the laws of the Netherlands.
  2. Disputes arising from or in connection with this Agreement shall be submitted to the competent court in the district of Rotterdam.

Contact

FIDURO B.V.
Stephensonweg 6
4207 HB Gorinchem
The Netherlands
Email: statementbridge@fiduro.nl
CoC: 78200695
VAT: NL861300221B01