Privacy Policy

bizzlink is a product and service of Vigasoft S.à r.l.-S.. The protection of your personal data is important to us. This privacy policy informs you about how we collect, use and protect your data.

Data Controller

Vigasoft S.à r.l.-S. 9, rue Marcel Schintgen 4889 Lamadelaine, Luxembourg Email: hello@bizzlink.lu

Data We Collect

When visiting our website:

  • Technical data (IP address, browser, operating system, access time)
  • This data is collected automatically when you visit the website

When contacting us:

  • Name, email address, phone number, company name
  • Your message and selected area of interest

When using the bizzlink service:

  • Company data (name, address, commercial register number, national identification number/matricule, VAT ID)
  • Invoice data processed through our platform
  • Login credentials (email, encrypted password)

Purpose of Processing

  • Providing and operating the bizzlink service
  • Sending and receiving e-invoices via the PEPPOL network
  • Responding to your enquiries
  • Fulfilling legal obligations
  • Improving our service
  • Performance of contract (Art. 6(1)(b) GDPR): Processing your data to provide our services
  • Legitimate interest (Art. 6(1)(f) GDPR): Technical data to ensure operations
  • Legal obligation (Art. 6(1)(c) GDPR): Retention of our own business records under tax and commercial law (transmitted documents are not archived by us — see Retention Period)

Retention Period

  • Contact enquiries: 12 months after completion of the enquiry
  • Our own business records (contracts, our own invoices/accounting): 10 years (statutory commercial/tax retention)
  • Transmitted invoice documents (via PEPPOL): kept operationally for 90 days, then deleted — bizzlink is a transmission service, not an archiving service; legally compliant long-term archiving is the customer’s responsibility
  • Transaction logs (sending/receiving): at least 3 months (PEPPOL requirement)
  • Identity verification records (KYC/KYB): duration of the business relationship plus statutory evidence obligations
  • Technical / access data: 1 month

Disclosure to Third Parties

We only share your data when necessary:

  • PEPPOL network: Invoice data is transmitted to the recipient via the PEPPOL network
  • Identity verification: For the KYC/KYB check at go-live, the required data is transmitted to our verification partner Didit (see the “Identity verification” section)
  • Payment processing: Bizzlink invoices are paid through our payment service provider Mollie (see the “Payment processing” section)
  • PDF invoice import: If you upload a PDF invoice, it is transmitted to Mistral AI for extraction (see the “PDF invoice import” section)
  • Hosting provider: Our servers are operated within the EU
  • Legal obligation: When we are legally required to do so

Apart from the Google services we use (Google Analytics and Google Ads — see below), no data is transferred to third countries outside the EU.

Identity Verification (KYC/KYB)

Before production activation in the PEPPOL network, the PEPPOL regulations (“End User Identification”) oblige us to establish the identity of our customers. For this purpose, the customer names an authorized signatory who undergoes an identity verification.

Data concerned: Name and e-mail address of the authorized signatory; during the verification additionally identity document data (identity card or passport), a photo/selfie including biometric comparison, and company documents (e.g. trade register extract).

Service provider: The verification is performed by our verification partner Didit (didit.me) as a processor and runs under verify.bizzlink.lu. The authorized signatory is informed about the provider before starting and consents to the transmission; explicit consent to the processing of biometric data is given separately to Didit within the verification flow.

Legal bases: Fulfilment of the identification obligations incumbent on us as a PEPPOL service provider (Art. 6(1)(c) and (f) GDPR); for biometric data, explicit consent (Art. 9(2)(a) GDPR).

Storage: We ourselves store no copies of identity documents and no biometric data — only the verification record remains with us (named person, timestamps, result, technical references). We retain it for the duration of the business relationship and the statutory evidence obligations.

PDF invoice import

PDF invoice import is an optional feature. A document is only processed if you upload a PDF invoice — without using the feature, no such transmission takes place.

Service provider: Extraction is carried out by Mistral AI, 15 rue des Halles, 75001 Paris, France, as a processor under Mistral’s Data Processing Addendum.

Data transmitted: The uploaded PDF file is transmitted in full. It typically contains the name and address of sender and recipient, contact persons, line items, amounts, tax rates and, where applicable, bank details. What we receive back is the extracted data in structured form, nothing else.

Purpose and legal basis: Converting your PDF invoice into a structured e-invoice so that it can be sent over the PEPPOL network. The processing is necessary for the performance of our contract (Art. 6(1)(b) GDPR).

Place of processing: Transmission goes to Mistral’s EU endpoint (api.mistral.ai). No transmission to US endpoints takes place.

No training on your data: Use of the transmitted data to train the models is not enabled in our Mistral account.

Retention at Mistral: The retention of the transmitted data is governed by Mistral AI’s Data Processing Addendum and privacy policy.

Payment Processing

Invoices for the use of Bizzlink are paid through the hosted checkout of our payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands — a payment institution licensed in the EU and supervised by De Nederlandsche Bank.

Data processed: Mollie receives your name, e-mail address, the invoice amount and reference, and the payment details you enter on the Mollie checkout page (card or bank data). Card and bank details are processed exclusively by Mollie and are never transmitted to or stored by Vigasoft. We receive only the payment status, the type of payment method and a transaction reference.

Role and legal basis: Mollie processes payment data as an independent controller under its own legal obligations (payment services and anti-money-laundering law); our processing is necessary for the performance of the contract (Art. 6(1)(b) GDPR). Mollie’s privacy statement: mollie.com/privacy. No transfer to countries outside the EU takes place for payment processing.

Your Rights

You have the right at any time to:

  • Access your stored data
  • Rectification of inaccurate data
  • Erasure of your data
  • Restriction of processing
  • Data portability
  • Object to processing

To exercise your rights, contact us at hello@bizzlink.lu.

Web Analytics (Google Analytics 4)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how visitors use our website.

Google Consent Mode v2 applies here as well (see the Google Ads section): without your consent, no cookies are set and no personal data is processed; Google only receives cookieless, aggregated signals. Only after your consent via the cookie banner does Google Analytics set cookies to recognise returning visitors.

Data collected (after consent): Page views, visit duration, referral page, browser type, operating system, approximate location, interactions with the website. Google Analytics 4 does not log or store IP addresses.

Legal basis: Consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie banner.

Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission under Art. 45 GDPR).

This website uses Google Ads with the Google tag (gtag.js), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use Google Ads to measure the effectiveness of our advertising (conversion tracking).

We use Google Consent Mode v2: without your consent, no cookies are set and no personal advertising data is processed; Google only receives cookieless, aggregated signals that do not identify individual visitors. Only after your consent via the cookie banner does Google set cookies for conversion measurement and ad personalisation.

Data collected (after consent): pages visited, information about clicked ads, cookie identifiers, IP address, browser information.

Legal basis: Consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie banner.

Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission under Art. 45 GDPR).

For more information, see the Google Privacy Policy.

Cookies

After your consent via the cookie banner, Google Analytics sets cookies to recognise returning visitors and Google Ads sets cookies for conversion measurement. Without consent, no tracking cookies are set. In that case, only technically necessary cookies are used that are required for the operation of the website.

Security

We employ technical and organisational measures to protect your data. Transmission is encrypted via TLS/SSL. Invoice data is stored encrypted.

Supervisory Authority

You have the right to lodge a complaint with the competent data protection authority:

Commission Nationale pour la Protection des Données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg www.cnpd.lu

Changes

We reserve the right to update this privacy policy. The current version can always be found on this page.

Last updated: August 2026

← Back to homepage