Privacy statement
Last updated: 6 November 2026.
Who we are
PeppolKit (the app for Shopify and Lightspeed, the plugin for WooCommerce, the module for PrestaShop and the integration with bol.com) is a service of Kadeworks (KvK 42214201), postal address Torenlaan 5, 1402 AT Bussum, the Netherlands. Contact: support@peppolkit.com.
Our role
For your customers' data, you as the shop owner are the controller and Kadeworks is the processor: we process that data only on your instructions, in order to create invoices. For your own data as a shop owner (business details, account), Kadeworks is the controller.
Which data
From paid orders: the name, company name, billing and shipping address, email address and, where applicable, VAT number of your customer, plus the order number, products, amounts and VAT. From you: the business details you enter in the app and, if you connect bol.com, your API key (Client ID and Client Secret; we store the secret in encrypted form). We do not process payment data such as card numbers.
What for
Solely to create invoices and Peppol files (UBL), to check them against the e-invoicing rules, to email them to your customer and to store them, and to verify VAT numbers in the VIES database of the European Commission. No marketing, no profiling, no sale of data.
Who we share data with
- Google Cloud (the Netherlands, EU): hosting and storage, encrypted, with daily encrypted backups in the EU.
- Brevo (France, EU): sending the invoice email to your customer.
- Mollie (the Netherlands, EU): payment of subscriptions for WooCommerce, PrestaShop, Lightspeed and bol.com.
- Recommand (Belgium, EU): sending your invoice over the Peppol network, only if you switch on Peppol and your customer is on Peppol. For this purpose they receive the invoice file (UBL) containing your customer's data.
- Peppyrus (Belgium, EU): the same, but through your own Peppyrus account, only if you connect that yourself.
- bol.com (the Netherlands, EU): only if you connect bol.com. We retrieve your orders through the Retailer API and place the invoice PDF back in your bol.com account, so that your customer can download it there.
- Google Analytics (Google Ireland, EU): only if you give consent on peppolkit.com, we use analytics cookies to measure how the website is used (pages visited, roughly where visitors come from). Your IP address is not stored and we do not share data for advertising. You can change your choice at any time via "Cookie settings" at the bottom of every page.
- European Commission (VIES): only the VAT number, for the check.
- Cloudflare: secure connection (TLS) to the app and the website.
Online shops we approach
We sometimes email online shops that sell to businesses, to introduce PeppolKit. For this we use only the general address that the shop itself publishes on its website (such as info@), never a personal address. We store the name of the shop, the domain, that address and when we emailed, on the basis of our legitimate interest. Every email contains an unsubscribe link; if you unsubscribe, we will never email you again and we keep only the address and domain, so that this remains the case. Shops that do not respond or do not become customers are deleted after 12 months.
How long
We keep invoices for as long as you use the app. If you delete the app, we erase all data of your shop 48 hours later (Shopify request "shop/redact"). If you use WooCommerce, PrestaShop, Lightspeed or bol.com, we erase all data of your shop 30 days after you disconnect the integration or remove the plugin. You will immediately receive an email with the date, so that you can download your invoices in time. If you reconnect within those 30 days, everything is kept. Earlier erasure is possible on request via support@peppolkit.com. So export your invoices before you delete the app: you are legally required to keep them for 7 years (10 years for sales via the OSS). If a customer requests deletion via Shopify, we erase whatever is not covered by the statutory retention obligation for invoices.
Security
All connections are encrypted (TLS). Data is stored on encrypted storage in the EU. Access to the production environment is limited to authorised administrators using two-step verification. In the event of a data breach, we inform the affected shop owners and, where necessary, the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) within 72 hours.
Your rights
For access, rectification or erasure: email support@peppolkit.com. If you are a customer of a shop, please contact that shop first. You can also lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).