Privacy Policy for Exact Apps 

Exact B.V., a company registered in The Netherlands with registered number 27225823 whose registered office is at Molengraaffsingel 33, 2629 JD Delft, The Netherlands, together with its subsidiaries (“Exact”), understands how important it is to protect your privacy and the security of your business data when you use our mobile applications (“Exact Apps”).

When we refer to Personal Data, we mean any information relating to an identified or identifiable natural person. When we refer to Data, we mean all information processed when using Exact Apps, including Personal Data. A reference to “Exact” has the meaning given in the applicable agreement with you or, in absence thereof, the Exact entity providing the Exact Apps.

This Privacy Policy distinguishes between:

• Your Personal Data – Personal Data we process as a data controller to provide, maintain, and secure the Exact Apps.
• Business Data – Personal Data processed strictly on your behalf as part of your use of the Exact Apps; for this, you act as the data controller and Exact acts as data processor.

When does this privacy policy apply?

This Privacy Policy only applies to all mobile applications provided by Exact that refer to or incorporate this Privacy Policy (“Exact Apps”).

Exact may allow you to purchase or use third-party features, integrations, or Software Development Kits (SDKs) with different privacy practices, as also made available in the Exact Online App store. Their data practices are governed by their own privacy policies.

The marketing websites of Exact are governed separately by the exact.com privacy-statement. Exact services are governed separately by the Privacy Policy for Exact Services

1. Your personal data (Controller Role)

This section applies to Personal Data processed by Exact when you download, install, register for, or use the Exact Apps.

Exact is the data controller for Your Personal Data.

1.1 Which data does Exact collect in the Apps?

Exact collects Your Personal Data through registration, usage of the Exact Apps, app interactions, device permissions, and support channels.

a) Contact data

Name, email address, phone number, business details, user ID — all used to set up your account, communicate with you, and provide essential service messages.

b) Device & App usage data

Collected when you use Exact Apps, including:

• Device identifiers (e.g., device ID, mobile OS version, app version)
• IP address and network information
• Mobile interactions (e.g., button clicks, crashes, diagnostics)
• App store identifiers where required by Apple/Google
• Push notification tokens (opt-in)

Used to ensure app functionality, security, performance analytics, and troubleshooting.

c) Metadata

Files, photos, videos, and documents uploaded through Exact Apps may include metadata (e.g., timestamps, location tags).

d) Mobile permission-based data

Depending on app features, we may request access to:

• Camera (for scanning receipts or documents)
• Photo library (for uploading files)
• Location (for location-based features)
• Microphone (only if the app uses voice input)
• Your calendar

You can manage these permissions through device settings.

e) Support data

Information you provide when contacting support, including screenshots or diagnostic logs.

f) Cookies and SDKs

Exact Apps may use mobile SDKs and tracking technologies similar to cookies, for example:

• Analytics SDKs
• Crash reporting tools
• Authentication SDKs

These are strictly necessary cookies only. If cookies are used beyond strictly necessary, you will be informed through cookie banners where applicable at the time of use.

1.2 Purposes of processing and lawful grounds

We process Your Personal Data for the following purposes and the following lawful grounds:

• Provide, maintain, and improve the Exact Apps.

  Lawful ground:

  • performance of a contract (Article 6(1)(b) GDPR)
• Authenticate you and maintain account security.

  Lawful ground:

  • Performance of a contract (Article 6(1)(b) GDPR), and
  • Legitimate interests in ensuring IT and network security (Article 6(1)(f) GDPR)
• Ensure app compatibility and performance.

  Lawful ground:

  • Legitimate interests in ensuring the proper functioning, security, and optimisation of the Exact Apps (Article 6(1)(f) GDPR)
• Provide customer and technical support.
• Lawful ground:
  • Performance of a contract (Article 6(1)(b) GDPR)
• Fulfil legal obligations (e.g., bookkeeping, tax, compliance duties).

  Lawful ground:

  • Compliance with a legal obligation (Article 6(1)(c) GDPR)
• Conduct analytics for app improvement and feature development.

  Lawful ground:

  • Legitimate interests in improving our services and user experience (Article 6(1)(f) GDPR) Where required by applicable law, analytics may be based on your consent (Article 6(1)(a) GDPR)
• Send service-related notifications (mandatory, e.g. security or functionality notices).

  Lawful ground:

  • Performance of a contract (Article 6(1)(b) GDPR), and/or
  • Legal obligation where applicable (Article 6(1)(c) GDPR)
• Send marketing communications (optional; with opt out).

  Lawful ground:

  • Consent (Article 6(1)(a) GDPR), and/or
  • Legitimate interests in promoting our services to existing customers (Article 6(1)(f) GDPR), where permitted by law

1.3 Sharing and Transfer of Personal Data

Your Personal Data may be shared with:

• Exact companies
• Technology providers (e.g., hosting, analytics, crash reporting)
• Sub-processors providing app specific services
• App store operators (only where required for transactions or compliance)

Transfers outside the European Economic Area (EEA) follow approved safeguards such as Standard Contractual Clauses or adequacy decisions.

1.4 Retention of Your Personal Data

Your Personal Data is retained:

• As long as needed for the contractual relationship
• For legally required periods (e.g., 7 years for financial records)
• For a maximum of 7 years after contract termination unless needed for legal claims

1.5 Your rights

You retain all GDPR rights, including access, rectification, deletion, restriction, portability, and objection. If you wish to exercise your rights, you can contact us using the contact details set out in this Privacy Policy.

You may withdraw permission for optional app data (e.g., push notifications, camera access) via device settings at any time.

2. Business data (Processor Role)

This applies to all customer owned Personal Data processed in the Exact Apps.

You are the data controller; Exact is your data processor.

2.1 Key points:

• Exact only processes Business Data according to your instructions
• Access by Exact personnel is zero by default and logged
• Business Data is retained only for the duration of the subscription + grace period
• After the grace period (30 days–6 months depending on the app), Business Data is permanently deleted
• You manage user roles and permissions inside the apps
• Sub-processors may process Business Data solely to deliver app functionality
• Local storage on the device
• In some of our apps, (part of) the data may be stored locally on the user’s device. This may occur, for example, when uploads cannot be processed temporarily (such as failed uploads) or when a user deliberately chooses to work in a local or offline mode. In addition, most apps may store certain settings locally, such as user preferences, filters, or notification settings. This local storage is used to support the functionality and user experience of the app. Where applicable, data is synchronized with our servers as soon as this is technically possible.

3. Security measures for all personal data

Exact adopts industry ‑standard technical and organizational measures, including:

• Physical and logical access controls
• Encryption in transit (HTTPS/TLS)
• Data segregation in multi‑tenant environments
• Continuous vulnerability scanning and patching
• Secure app architectures for iOS and Android
• Monitoring and logging of access attempts

In case of a security breach affecting Business Data, we will notify you without undue delay.

4. App specific transparency requirements

In compliance with App Store and Google Play platform rules, Exact will:

• Publish an app specific privacy notice on the app store listing
• Display the privacy policy within the app
• Disclose all data categories collected
• List third-party SDKs and their purposes
• Disclose whether data is used for tracking or advertising (Apple ATT)
• Provide data safety information (Google Play)

5. Changes

We may update this Privacy Policy from time to time. Updates become effective when posted in the app, on our website, or in the customer portal.

Your continued use of the Exact Apps constitutes acceptance of the updated Privacy Policy.

6. Enquiries and complaints

If you have any questions or complaints about how we handle the processing of Personal Data or about this Privacy Policy, you can address these through the contact details set out below. You always have the right to lodge a complaint with your local data protection authority.

Contact us

For questions regarding the app please contact:

For questions, complaints, or data subject requests please contact:
Data Protection Officer
Email: dpo@exact.com
Address: Molengraaffsingel 33, 2629 JD Delft, The Netherlands
Phone: +31 (0)15 711 51 00