What the app sends, and what we never see.

This statement is about E-Invoice Platform, the Microsoft Dynamics 365 Business Central app published by Vangelder Solutions BV. It describes what the app sends outside your Business Central environment, what we receive as its publisher, and how long any of it is kept.

It does not cover this website — that is in our general privacy policy — and it does not cover how your own Business Central tenant is operated, which is a matter between you and Microsoft.

The app runs inside your Business Central environment. Your invoices, your customers and vendors, and the bank details on them stay in your tenant, under your control. We have no access to them. Installing the app does not give us a way in, and there is no route by which your documents reach us.

There are two exceptions, and they are the reason this statement exists: documents you send and receive travel through an e-invoicing platform provider, and a narrow stream of diagnostic events reaches us. Both are set out below.

The app contacts four destinations, and nothing else. This list is the same one published in the product manual.

• app.recommand.eu — the documents you send, and requests to read your inbox. This is Recommand, the platform provider that connects you to the Peppol network. Invoice data passes through it, including whatever personal data an invoice happens to contain, such as a contact name. Your account with Recommand is separate from this app and sold separately; their own terms and privacy statement govern it.
• directory.peppol.eu — the identifier or company name you are searching for, when you look a trading partner up in the public Peppol Directory. Nothing about your own documents is sent.
• ec.europa.eu — a Belgian enterprise number, and only when Look Up Official Data (VIES) is switched on. It ships switched off, and nothing reaches this host until you turn it on yourself.
• Azure Application Insights — diagnostic events. See the next section.

On a small number of failures, the app reports a diagnostic event to an Azure Application Insights resource we operate, hosted in West Europe.

Those events carry document identifiers and failure reasons. They do not carry document contents, invoice lines, or customer and vendor records. The purpose is narrow: so that we can answer “why did that import fail” without asking you to reproduce it.

They are retained for 90 days and then deleted.

• It cannot look up a bank account number. No public register maps a company to an IBAN, so a supplier’s account details can only reach you from the supplier itself or from an incoming e-invoice — which is why the app makes you approve them before they are written anywhere.
• It sends nothing to us for marketing, analytics or profiling.
• It transmits nothing on a schedule you have not switched on yourself.
• Removing it stops all of it. Uninstall Impact reports exactly what the app has written into standard tables, and changes nothing while it does, so you can see the answer before you decide.

The diagnostic events described above: 90 days.

The documents themselves are a different matter, and not ours to set. They live in your Business Central, and in your own account with the platform provider. How long they are kept in either place is decided by you, by your retention policy, and by your agreement with that provider — not by us.

Where we hold personal data about you — in practice, the diagnostic events above and anything you send us directly — you may ask for a copy, ask us to correct it, or ask us to delete it, by writing to contact@vangeldersolutions.be. We answer within 30 days.

For personal data inside your own Business Central, we are not the party who can act on such a request. You are, and the app is built so that stays true.

Vangelder Solutions BV, Pastorijstraat 27, 9100 Nieuwkerken-Waas, Belgium. VAT BE 0802.046.676.

Email contact@vangeldersolutions.be or call +32 3 502 76 18.