Skip to content
Start free VAT check

Privacy statement

Here you can read which data plays a role when you use BTW Kwartier and where to go with questions.

Last updated: 27 Oct 2026 · version 2026-10-30

This statement explains which personal data BTW Kwartier processes, why, for how long and what your rights are. It covers the website btwkwartier.nl, the launch waitlist and the app.

Who are we?

BTW Kwartier is a service of JRK Digital Media B.V. We are responsible for the processing described here, except where we say below that we act as a processor.

  • JRK Digital Media B.V.
  • Johan de Wittlaan 7, 2517 JR The Hague, the Netherlands
  • Chamber of Commerce (KvK) 98096591
  • info@jrkdm.com

This statement is available in Dutch, English and Chinese. If the languages differ, the Dutch text prevails.

Two roles: controller and processor

We are the controller for the data we need for the waitlist, your account, your subscription, the security of the service, our contact with you and a referral to a partner accountant.

We are a processor for the bookkeeping data you put into the app to prepare your VAT return: bank statements, invoices, answers to questions and drafts. These contain personal data too, for example names of your customers and suppliers, or your own details if you are a sole trader. Your business is the controller of that data; we process it only on your instructions, under our data processing agreement. Below we also explain how we handle it.

Launch waitlist

When you sign up for the launch waitlist, we keep:

  • your company name, your name and your email address;
  • if you fill them in: your KvK number and the number of companies you file for;
  • the language of the website and the moment you gave consent;
  • an encoded version (hash) of your IP address, only to investigate abuse of the sign-up form.

Purpose: letting you know when BTW Kwartier goes live and contacting you about the launch. Legal basis: your consent (article 6(1)(a) GDPR). Name, company and email address are needed to sign you up; KvK number and number of companies are optional.

Your account

  • Your name, email address and language, and your password as an encrypted hash.
  • The secret for your two-step verification, stored encrypted.
  • If you sign in with Google, we receive from Google your name, your email address, whether Google has confirmed that address and a fixed ID of your Google account. No password and no other data from your Google account.
  • Your role and the companies you have access to.
  • Which version of the terms you accepted and which version of this statement you saw when you registered.

Purpose: letting you log in and giving you the right access. Legal basis: performance of the contract (article 6(1)(b) GDPR). If you are an employee or bookkeeper of a customer, the basis is our legitimate interest in performing the contract with that customer (article 6(1)(f) GDPR).

Your company, subscription and payments

  • Company name, KvK number, address, VAT ID and legal form, and your answers to the admission questions.
  • Your subscription, our invoices and the status of your payments.
  • For payment: name and email address of the payer and the type of payment method. You give your account or card details directly to Stripe; we do not store them.

A JRK Digital Media employee compares your company name, KvK number, legal form and address with the public KVK Business Register (Handelsregister). You see the result with your company details, and it is recorded in your log.

Purpose: providing the service, invoicing and collecting payments. Legal basis: performance of the contract, and for our invoices the statutory retention duty (article 6(1)(c) GDPR).

We do not ask for your citizen service number (BSN) or for a sole trader's omzetbelastingnummer, which contains the BSN. If a document you upload does contain a BSN, we mask it automatically before AI reads the document.

Your bookkeeping data

Bank statements (counterparty, description, amount), invoices and receipts, your answers to questions, the drafts and your confirmations. We store counterparties' account numbers encrypted.

We use this data only to prepare your return and to show your records to you and let you export them. Here we are a processor; the legal basis is your company's, usually the legal duty to file returns and keep records.

AI

We use AI models to read invoices, match payments to invoices and suggest questions, and a second model to check the draft independently. Amounts and boxes are never calculated by AI, but by fixed calculation rules.

  • We use AI models from Google (Gemini) through Google Cloud Vertex AI, processed in the EU (the Netherlands or Belgium, or Google's EU region).
  • We send only what is needed; we mask BSNs and full account numbers first.
  • The models are not trained on your data. For each AI request we keep only technical data such as time, model and cost, not the content.

We do not take decisions about you made solely by a computer (article 22 GDPR). An AI suggestion is only applied when you or a fixed calculation rule confirms it, and you confirm the draft before you file the return yourself.

Security and log

  • A log of who did what in the app, such as answers, confirmations, exports and changes.
  • Technical server logs with IP address, time and requested page, without what you type.
  • To limit excessive requests we keep your IP address in memory for at most one hour.

Purpose: securing the service, preventing and investigating abuse, and being able to show who confirmed a draft. Legal basis: our legitimate interest in a secure and verifiable service (article 6(1)(f) GDPR).

Referral to a partner accountant

If your situation does not fit BTW Kwartier, or you want help, you can ask to be put in touch with an accounting or bookkeeping firm we work with. Only with your explicit consent do we give that firm:

  • the name of your company;
  • your name as contact person;
  • your email address;
  • your phone number, if you fill it in;
  • your open questions or a short note, if you add them.

Legal basis: your consent (article 6(1)(a) GDPR). You can withdraw it at any time via info@jrkdm.com; from then on we share nothing more. What the firm has already received is the firm's responsibility; you can ask the firm to delete it. The firm is itself responsible for what it does with your data afterwards, including the customer due diligence it must perform under the Dutch anti-money-laundering act (Wwft).

A limited number of JRK Digital Media staff see your contact details in the list of referrals. They use them only to arrange and follow up the referral, for example to check whether the firm has contacted you. We record which consent text you saw, when you gave consent and with which firm we shared your data. The firm pays us a fee for the referral; that does not change which data we share.

Contact and email

Your messages to us and our replies: the basis is performance of the contract, or our legitimate interest in answering your questions. We send emails that belong to the service, such as the message that BTW Kwartier is live, login links, deadline reminders, open questions, security notices and invoices. We only send newsletters or advertising if you separately consent to that.

Through the contact form on the website (a question or a demo request) we receive your name, business email address, optionally your company name and phone number, your message and your contact preference, plus a hashed version of your IP address against abuse. We only use this to respond to your request; the legal basis is our legitimate interest in answering questions, or steps at your request before a contract. The free VAT check on the website only stores your answers in your own browser (sessionStorage) and does not send them to us, unless you then create an account.

To send email we use Resend, Inc. from the United States. Our emails come from noreply@btwkwartier.nl; replies go to info@jrkdm.com. Resend receives your name and email address, the content of the email (such as login links, notifications, invoices as PDF and emails about a referral) and delivery data. We send through Resend's EU region in Ireland, but Resend may also process data in the United States, for example for support and logs. The EU-US Data Privacy Framework, for which Resend is certified, and the European Commission's standard contractual clauses apply to that.

How long do we keep your data?

  • Contact form: up to 12 months after our last contact, earlier if you ask.
  • Waitlist: until 12 months after the launch of BTW Kwartier, and in any case no longer than until 31 Dec 2027. Earlier if you ask or withdraw your consent.
  • While your account exists: we keep your account, company and bookkeeping data as long as your account exists. We automatically delete the file of an original document or bank statement 7 years after the end of the quarter it belongs to; the data we extracted from it, such as amounts and supplier, is kept as long as your account exists.
  • When your account ends: after your subscription ends, your account is read-only, and from then on you have 90 days to export everything. If you ask in Settings for your account to be deleted, your subscription stops immediately, time already paid for is forfeited without refund and the same 90-day period starts. If you never had a paid subscription (only the free check), the same period starts after 12 months without login or activity; logging in cancels it. Everyone with access to the account gets an email 14 days before we delete; we never delete earlier than 14 days after that email. If a payment is still outstanding, we wait with deleting until it is settled.
  • What we then delete: all your customer data, including original documents and bank statements, transactions, returns and drafts, questions and answers, rules, raw AI outputs, support messages and our records of referrals. We anonymise users: name, email address and login details are removed. Anyone who also has access to another account keeps their login.
  • What we keep for our own legal duties: our invoices to you, the record of your acceptance of the terms and of your confirmations of returns, a log with references only (who, what and when, without content) a record that the deletion took place, with dates and counts only, and anonymised records of partner firms' fees as our own business records, each for 7 years. These contain no documents or transactions.
  • Consent and referral: as long as the referral runs and 2 years after, as proof of your consent, but never longer than your account. We keep the firm's fee for 7 years in anonymised form, without customers' personal data.
  • Website statistics (Google Analytics): only with your consent; 14 months, after which Google deletes them automatically.
  • Technical log files: overwritten automatically, after 30 days at the latest.
  • Backups: we make a backup of the database every day and keep it for 14 days, on our server and in protected storage at Microsoft Azure in West Europe. What we delete, including waitlist data, disappears from all backups within 35 days.

Please note: as an entrepreneur you must, as a rule, keep your records for 7 years (article 52 of the Dutch General Tax Act, AWR). That duty stays with you. So export your records before your account ends.

Who do we share your data with?

We do not sell your data. We share it only:

  • with our subprocessors, who help us provide the service: Microsoft Azure (hosting, database and document storage in Azure Blob Storage), Google Cloud Vertex AI (AI models) and Resend (email);
  • with Stripe, to pay for your subscription;
  • with Google, only if you choose ‘Continue with Google’: Google then sees that you sign in to BTW Kwartier (Google’s privacy policy also applies to that);
  • with Google, as processor for the website statistics (Google Analytics), only if you consent to this in the cookie notice;
  • with a partner accountant, only with your consent;
  • with the European Commission (VIES), only your customer's VAT number, to check whether it is valid;
  • with authorities, if the law requires us to.

The full and current list is on the subprocessors page. We announce changes in advance.

Your data is stored in the European Union: the app, the database, your documents and the backups at Microsoft Azure in the West Europe region (the Netherlands), the AI models at Google Cloud in the EU (the Netherlands or Belgium, or Google's EU region). We send email through Resend's EU region (Ireland). Resend and Stripe may also process data outside the EU, in particular in the United States; the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply to that. The same applies to Google Analytics on the website, if you consent to it.

How do we secure your data?

  • Encrypted connections and encrypted storage.
  • Extra encryption of sensitive fields, such as account numbers and the secret for your two-step verification.
  • Two-step verification for every user.
  • Strict separation between customers in the database.
  • Staff access only when needed, recorded in a log.
  • A fixed procedure for data breaches.

Your rights

You may access, correct or delete your data. You can also ask us to restrict processing or to transfer your data (portability), and you can object to processing based on our legitimate interest. If you gave consent, you can withdraw it at any time. Email info@jrkdm.com for this. We reply within one month.

If your request concerns bookkeeping data for which we are a processor, we forward it to the company that is our customer and help that company handle it.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Cookies

Necessary cookies. To log in and to make the website and app work, we use a few functional cookies and data in your browser, such as your session, your language and your choice in the cookie notice. No consent is needed for these.

Website statistics, only with your consent. On the public website (not in the app behind the login) we use Google Analytics 4 to see how many visitors view which pages, so that we can improve the website. This only starts when you click ‘Accept’ in the cookie notice; if you click ‘Decline’, nothing from Google is loaded. With your consent, Google Analytics sets the cookies _ga and _ga_<id> (up to 14 months) and Google receives the address of the page you view without query parameters, information about your browser and device, a random identifier for your browser and your IP address, which Google Analytics uses to determine your country or region and does not store. Google signals and advertising features are switched off; we do not share data for advertising.

Google Ireland Ltd. processes this data as our processor. Google may also process it in the United States; the EU-US Data Privacy Framework, under which Google is certified, and the European Commission's standard contractual clauses apply to that. Legal basis: your consent (Article 6(1)(a) GDPR). You can change your choice or withdraw your consent at any time with ‘Cookie settings’ at the bottom of every page of the website; we then remove the Analytics cookies from your browser.

Changes

If we change this statement, you will see it from the date and version at the top. We announce important changes in advance in the app or by email.

See also: Terms · Subprocessors.

View the terms Contact us