Privacy Policy

Last updated: 21 July 2026

Who we are, and our two roles

Kwito is an e-invoicing application for Shopify that turns Belgian B2B orders into Peppol e-invoices. Kwito is operated by:

Noctixal SARL-S (in formation), Luxembourg 36, rue du Commerce L-3616 Kayl Luxembourg RCS Luxembourg: [pending incorporation] VAT: [pending incorporation] Contact: support@kwito.eu

Until Noctixal SARL-S completes incorporation, the service is operated by its founder, Charel Lejeune, in Luxembourg. He is the responsible party for the purposes of this policy, and the identity and contact details above will be updated with the company’s registration numbers once incorporation completes.

Kwito acts in two distinct data protection roles, and it is important to keep them apart:

• Controller for merchant account data. When a merchant installs Kwito, we decide how and why we process the data needed to run the service and their account (their company details, settings, contact email, and usage records). For that data, Kwito is the controller.
• Processor for buyer data. The personal data inside the merchant’s orders and invoices (their customers’ details) is controlled by the merchant. Kwito processes it only on the merchant’s documented instructions, to produce, send, receive, and archive invoices on their behalf. For that data, the merchant is the controller and Kwito is their processor. The terms of that processing are set out in our Terms of Service and Data Processing Agreement.

What data we process and why

Kwito processes personal data only to generate, send, receive, and archive e-invoices. We do not use any of it for analytics, advertising, profiling, sale, or AI training.

• Merchant account data (company name, enterprise/VAT number, address, IBAN, contact email, plan and usage): as controller, to register the merchant on the Peppol network, issue invoices in their name, operate their account, and bill them.
• Buyer data from orders (buyer legal name, billing address, VAT number, email): as the merchant’s processor, limited to the fields an invoice legally requires under EU VAT law (Directive 2006/112/EC art. 226) and Belgian law. We store only those invoice-mandatory fields.
• Received invoices from the merchant’s suppliers: as the merchant’s processor, for the inbound inbox and forwarding to the merchant’s accountant.

Lawful basis

Because Kwito acts in two roles, the lawful basis differs by data type:

• Merchant account data (Kwito as controller): the performance of our contract with the merchant (GDPR art. 6(1)(b)) to provide the app they installed, together with our legitimate interest (art. 6(1)(f)) in securing, supporting, and billing the service.
• Buyer data (Kwito as processor): we do not set our own lawful basis for this data. We process it on the merchant’s documented instructions, and the lawful basis is the merchant’s, as controller. For a Belgian B2B merchant that basis is their own legal obligation (art. 6(1)(c)): issuing and archiving structured e-invoices has been a statutory requirement for Belgian domestic B2B transactions since 1 January 2026, and invoices must be retained for 10 years. That obligation, and the retention duty, are the merchant’s, not Kwito’s; Kwito carries them out on the merchant’s behalf.

Retention

• Invoices (the UBL XML, PDFs, and their events): retained for the merchant for 10 years, reflecting the merchant’s legal retention obligation, and therefore not subject to earlier erasure for that period.
• Buyer contact data: minimised to invoice-mandatory fields; anonymised on a Shopify customers/redact request where no legal retention applies.
• Merchant account and settings: deleted on a Shopify shop/redact request (48-hour grace), except the invoice archive, which is exported and made available to the merchant and then deleted after their confirmation or 30 days. See the “Uninstalling” section of our support page for what happens to the archive when a merchant leaves.

Sub-processors

All invoice and buyer personal data is stored in the EU (Germany and Finland). We use the following sub-processors:

We maintain a data processing agreement with each sub-processor. If we add or replace a sub-processor that handles personal data, we will update this list and, for merchants, give advance notice as described in our Data Processing Agreement so they can object.

International transfers

Invoice and buyer personal data is stored and processed in the EU. Two providers involve a country outside the EEA, and each is covered by a lawful transfer mechanism:

• Migadu (support and account mailboxes) is a Swiss company. Switzerland is covered by a European Commission adequacy decision, so no additional transfer mechanism is required. The mailbox servers themselves are located in France and Germany.
• Cloudflare, Inc. provides authoritative DNS for the kwito.eu domain only. It does not receive invoice content or buyer personal data. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which provides an adequate transfer mechanism for the limited technical data involved.

Where a sub-processor with EU data residency is part of a group established outside the EEA, we rely on that provider’s Standard Contractual Clauses or Data Privacy Framework certification, as set out in its data processing agreement.

Security

Data is encrypted in transit (TLS everywhere) and at rest (AES-256-GCM over buyer personal data, invoice XML, and PDFs). Access to decrypted buyer data is logged. Breaches are assessed and, where required, notified to affected merchants and to the CNPD within 72 hours (GDPR art. 33). Our breach notification commitments to merchants are set out in our Data Processing Agreement.

Your rights

Buyers and merchants have the GDPR rights of access, rectification, erasure (subject to the 10-year invoice retention obligation), restriction, portability, and objection. Because Kwito is the processor for buyer data, a buyer should exercise these rights with the merchant who issued their invoice (the controller); we will assist that merchant in responding. For merchant account data, where Kwito is the controller, merchants may contact us directly at support@kwito.eu.

Supervisory authority

For merchant account data, our lead supervisory authority is the Commission nationale pour la protection des données (CNPD), Luxembourg (https://cnpd.public.lu). You have the right to lodge a complaint with the CNPD or with your local data protection authority.

Changes

We will update this policy as the service and its legal registration evolve; the “Last updated” date above reflects the current version.