GDPR & data protection
Paxbase is software you use to manage the data of your own clients, travellers and participants. Under the General Data Protection Regulation you are the controller for that data and Exsited BV, the company behind Paxbase, is your processor. This page explains what that division of roles involves. The binding commitments are in article 8 of the terms and conditions.
Version 1.0 · last updated on 30 September 2026
The division of roles
The personal data you process in the platform — including the data of your clients, travellers and participants — we process solely for you and on your instructions. You are the controller for that data; we are your processor. Article 8 of the terms and conditions serves as the written agreement required by article 28 of the regulation. You do not need to sign a separate document for this.
For the data we process about you as a customer — your contact details, your billing details, the sign-in details of your administrators and our administration around your subscription — we are the controller ourselves. This is set out in our privacy statement.
What we do with the data in your environment
We store, organise, display, amend, export and delete the data within the platform, for the sole purpose of delivering the service to you. We do not process it for our own purposes and we do not sell it.
We process the data only on your documented instructions, including these terms and conditions and your use of the platform's features. Where European Union or Member State law requires us to carry out processing that falls outside those instructions, we will inform you beforehand, unless that law prohibits such notification.
Security
We take appropriate technical and organisational measures to secure the data, taking into account the state of the art, the costs, and the nature and risks of the processing. Our staff and subcontractors who have access to the data are bound to confidentiality.
Every environment has its own database with its own access credentials, so that the data of our customers stays separated.
Sub-processors
To deliver the service we use sub-processors, including for hosting and for supporting technical services. You give us a general authorisation for this. We impose on every sub-processor the same obligations as those in article 8 of the terms and conditions, and we remain liable to you for what they do.
The current list of sub-processors we use is set out below. If we replace a sub-processor or add one, we will notify you beforehand; if you have legitimate grounds to object, you tell us within fourteen days and we will look for a solution together. If we cannot find one, you may terminate the subscription as of the date on which the change takes effect, without compensation.
| Sub-processor | Role | Country | Transfer outside EEA |
|---|---|---|---|
| TransIP B.V. | Hosting and server infrastructure | Netherlands | — |
| MailerSend, Inc. | Sending transactional emails | USA (primary storage EU) | SCCs + DPF |
| Mollie B.V. | Processing online payments | Netherlands | — |
| Google Ireland Limited | Sign-in via Google and map display | Ireland | SCCs + DPF |
| Anthropic (AI services) | AI functionality (document analysis) | USA | SCCs |
| Exact Holding B.V. (ExactOnline) | Accounting integration (optional module) | Netherlands | — |
| Teamleader NV | CRM integration (optional module) | Belgium | — |
Transfers outside the European Economic Area
Where personal data is processed outside the European Economic Area, this only happens using a transfer mechanism permitted by the regulation, such as an adequacy decision or the European Commission's standard contractual clauses.
Requests from your clients, travellers and participants
If a data subject asks us for access to, correction, erasure or transfer of their data held in your environment, we do not handle that request ourselves: we refer the data subject to you and we notify you. You are the controller for that data, so you decide and you reply.
We help you handle such a request using the features the platform provides for it. For each client you can compile an access file and download it as a ZIP file, view and update the overview of the consents given, and process an erasure request, with the platform showing you until when a statutory retention obligation runs.
If the request concerns your own data as a Paxbase customer, you are in the right place with us. How to exercise those rights is set out in our privacy statement.
Assistance and audit
We assist you in meeting your obligations regarding security, notification of personal data breaches and data protection impact assessments, to the extent this can reasonably be expected of us as a processor. We make available to you the information you need in order to demonstrate compliance with article 8, and we allow an audit or inspection. You request such an audit at least thirty days in advance, it does not disrupt our service delivery, and you bear the costs of it unless it reveals a shortcoming on our side.
Personal data breaches
If we detect a personal data breach in your environment, we notify you without undue delay, with the information available to us. Whether and how you inform the supervisory authority and the data subjects is your decision; that is your obligation as controller.
After your termination
After the end of your subscription you keep access to your environment for a further thirty calendar days in order to export your data using the export functions referred to in article 7 of the terms and conditions. So export what you want to keep yourself, within that period.
If you want us to delete your environment and the data in it, you request that via hello@paxbase.be. We will handle that request and tell you what we delete and what we are legally required to retain, in particular invoicing and accounting records.
Questions
Questions about this division of roles or about the processing of data in your environment? Email hello@paxbase.be.