Legal basis for processing

• Art. 6(1)(b): Contract performance (SaaS service delivery)
• Art. 6(1)(c): Legal obligation (fiscal retention)
• Art. 6(1)(f): Legitimate interest (security, fraud prevention)
• Art. 6(1)(a): Consent (marketing)

Sub-processors

We work with the following sub-processors:

• Stripe Inc. — Payment processing (USA, Standard Contractual Clauses)
• Anthropic (Claude AI) — AI risk analysis (USA, your data is not used for model training)
• EU Cloud Hosting — Server infrastructure (Netherlands/EU)

Data transfers outside the EU

Where data is processed outside the EU (Stripe, Anthropic), Standard Contractual Clauses (SCCs) apply per Article 46 GDPR.

Exercising your rights

You can exercise your GDPR rights (access, rectification, erasure, portability, objection) by emailing info@ppmos.com. We respond within 30 days. You can also lodge a complaint with the Dutch DPA at autoriteitpersoonsgegevens.nl.