Privacy policy
Last updated: 27 October 2026
This policy explains how we process personal data when you visit sepafilechecker.com, check a SEPA file or order a repair.
In brief
- We use no cookies and no analytics or advertising services. Fonts and all other content are served from our own server.
- Your SEPA file is processed in memory only and deleted no later than 30 minutes after upload.
- For an order we only collect the data we need for the contract and the invoice.
1. Controller
The controller is Tevfik Özdemir, trading as Bedrijfsboekhouder.com, Einsteinlaan 28, 2289 CC Rijswijk, the Netherlands, phone +31 85 200 7886, email info@bedrijfsboekhouder.com. Further details are in the legal notice. Please send questions about data protection to this email address.
2. Visiting the website
When you open a page, our server processes technically necessary data: your IP address, the date and time, the page requested (URL) and information about your browser. We use this data only to deliver the website, for security and to limit misuse, for example too many checks from one connection. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. We delete logs containing IP addresses within 14 days.
Our server is located in a data centre of TransIP B.V. in the Netherlands. TransIP processes the data on our behalf.
3. Checking and repairing your SEPA file
When you upload a file, it is transmitted to our server in encrypted form. It contains personal data, mainly names, IBANs, amounts, mandate details and sometimes addresses of payers or payees. We use the file only to check it and, if you order this, to repair it.
The file is held in memory in encrypted form and not stored on disk. We delete it after you download the repaired file, and no later than 30 minutes after upload. We do not write file contents, names or IBANs to logs.
To check and complete addresses, our server can query public address registers: for Germany, Austria, Switzerland and Liechtenstein the OpenPLZ API (openplzapi.org), for the Netherlands the Basisregistratie Adressen en Gebouwen (BAG) via PDOK, for France the Base Adresse Nationale via the IGN Géoplateforme and for the United Kingdom postcodes.io. We only transmit postcodes and street names, for Dutch addresses also the building number, and no names, IBANs or amounts. postcodes.io is operated in the United Kingdom; the European Commission has adopted an adequacy decision for the United Kingdom.
If the file contains data of your members, customers or clients, we process it on your behalf (as a processor under Art. 28 GDPR). You are then the controller for this data. The terms are set out in Annex 1 to our terms and conditions.
4. Orders, payment and invoice
Depending on the payment route, the order page may be at start.bedrijfsboekhouder.com. The controller there is also the provider named above, and this policy applies.
For an order we process your name, your email address, the name of your organisation, the country and, where applicable, your VAT number. We ask for your address if the law requires it on the invoice: for a reverse-charge invoice, for customers outside the EU and for invoices above €100 including VAT, for example for the annual licence.
We check a VAT number from another EU country via VIES, the European Commission's system, and keep the result with the invoice.
Payments are processed by Mollie B.V., Amsterdam. Mollie processes your payment data as an independent controller; Mollie's privacy statement applies. From Mollie we receive the payment details, such as status and payment method and, depending on the payment method, the payer's name and IBAN, and use them only to match the payment and for our accounts.
The legal bases are Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention obligation). We keep invoices and accounting records for seven years, as required by Dutch tax law.
5. Emails
We send the invoice and the licence code by email. For email we use Google Workspace from Google Ireland Limited, Dublin. Data may also be processed in the United States. This is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Google is certified; standard contractual clauses apply in addition; you can request a copy of these clauses from us.
If you tick the box when ordering, we ask by email a few days after a repair whether your bank accepted the file. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example with a short email to us.
If you email us, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed for this, unless we are required to keep them.
6. Annual licence
A licence code is linked to your order. If you enter the code on the website or in our browser extension, our server checks whether the licence is valid. We do not link the code to your device. The legal basis is Art. 6(1)(b) GDPR.
7. Recipients
We do not sell data or pass it on for other purposes. The only recipients are the service providers we need for operation: TransIP (hosting, the Netherlands), Mollie (payment, independent controller), Google (email), the address registers named above (only postcodes, street names and, for Dutch addresses, the building number), the European Commission for the VIES check, and tax authorities where we are legally required to provide data.
8. Retention
| Data | Period |
|---|---|
| Your SEPA file and the repaired file | until download, at most 30 minutes after upload |
| Logs containing IP addresses | at most 14 days |
| Order and invoice data, VIES result | 7 years |
| Licence data | term of the licence, then 7 years as part of the invoice data |
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or place of work (Art. 77 GDPR). The authority competent for us is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
If your request concerns data in a SEPA file that an association or business has had checked by us, please contact that organisation; we will support it. The file itself is deleted within 30 minutes of upload.
10. Other
You do not have to provide personal data about yourself to use the check. For an order we need the data listed above; without it we cannot conclude the contract. We do not use automated decision-making within the meaning of Art. 22 GDPR. We update this policy when our services or the law change; the version published here applies.