This Privacy Policy explains how Peppost collects, uses, shares, and protects personal data when you use our services. It is part of our Terms of Service.
Peppost is operated by Ingram Technologies SRL ("Peppost", "we", "us", "our"). Questions regarding this Privacy Policy should be sent to privacy@peppo.st.
For account, billing, support, and product-usage data about your own account, Peppost acts as a data controller.
When you use Peppost to transmit invoices or other documents containing personal data of third parties (for example your customers or suppliers), you generally act as the data controller and Peppost acts as your data processor for that data.
If you need a separate data processing agreement (DPA), contact legal@peppo.st.
Depending on how you use the Service, we may collect:
We do not sell your personal data and we do not use your invoice or financial data for third-party advertising.
We use personal data to:
Where GDPR applies, we rely on one or more of the following legal bases:
We may share personal data with:
Our primary infrastructure providers currently include Supabase, Vercel, Stripe, and Scrada (Peppol access point).
When personal data is transferred outside the European Economic Area (EEA), we use appropriate safeguards required by applicable law, such as adequacy decisions and/or Standard Contractual Clauses.
We keep personal data only for as long as necessary for the purposes described in this Policy, including:
When data is no longer required, we delete or anonymize it within a reasonable period, except where legal retention obligations apply.
We use strictly necessary cookies and similar technologies for authentication, session management, security, and core product functionality.
We may use privacy-respecting analytics to understand service usage and improve the product. We do not use third-party advertising cookies.
We use reasonable technical and organizational safeguards to protect personal data, including encryption in transit (TLS), access controls, and security monitoring.
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
If we identify a personal data breach, we will take appropriate mitigation steps and provide legally required notifications.
If you are in the EEA (and in other regions where similar rights apply), you may have the right to:
To exercise these rights, contact privacy@peppo.st. We may need to verify your identity before processing your request.
Where required by law, we will respond to verified requests within applicable legal timelines.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorite de protection des donnees / Gegevensbeschermingsautoriteit) or your local supervisory authority.
The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children.
If Peppost or substantially all of its assets are acquired, personal data may be transferred as part of that transaction, subject to applicable law.
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service or by email.
For privacy questions or rights requests: privacy@peppo.st
For support: support@peppo.st
For legal matters: legal@peppo.st