Privacy Notice

1. Introduction

Sabisu Consulting BV, trading as Salviminda, registered in Belgium (‘we’, ‘us’, ‘our’), is committed to protecting your personal data. This Privacy Notice explains how we collect, use and protect personal information in the context of our S-Link Peppol e-invoicing service and our general business activities.

It applies to (a) contacts who interact with us directly — prospects, clients, users of the S-Link portal and visitors to this website; and (b) individuals whose personal data appears in invoices and other business documents processed and stored through the S-Link service. For individuals in category (b), our clients act as data controllers and we act as their data processor — please refer to your own organisation’s privacy notice, and address requests about that data to them.

2. Who we are

3. Personal data we collect and why

3.1 Contact and prospect data (Salviminda as controller). When you contact us, request a demo, subscribe to communications or enter into a commercial relationship with us, we collect:

We collect this data from you directly. We do not purchase or rent contact lists, and we do not enrich your data from third-party sources or build profiles about you.

3.2 E-invoice data (Salviminda as processor). When processing business documents on behalf of our clients, we handle personal data contained in those documents — typically names and business contact details, and for sole traders, name, address, bank account details and VAT or registration number. These documents are transmitted through the S-Link connector, stored in S-Link Hub, which we operate on Microsoft Azure in the West Europe region, and where applicable transmitted onward through the Peppol network by our access-point partner. We process this data solely on our clients’ documented instructions and under the Data Processing Agreement concluded with each of them.

3.3 User account data. When individuals register to use the S-Link portal we collect a username, business email address, hashed password, assigned role, and activity logs recording actions taken in the portal. This is used solely to provide, secure and support access to the service, and to investigate incidents.

3.4 Cookies. This website uses only cookies strictly necessary for the site to function. We do not use analytics, advertising, social-media or other tracking cookies, we do not embed third-party tracking pixels, and we therefore do not ask for cookie consent. If this changes we will update this Notice and seek consent before setting any non-essential cookie.

3.5 Automated decision-making. We do not carry out automated decision-making or profiling producing legal effects concerning you or similarly significantly affecting you, within the meaning of Art. 22 GDPR.

4. Data sharing

We share personal data only as follows:

• Microsoft Ireland Operations Ltd — hosting of S-Link Hub on Microsoft Azure (West Europe) and our internal Microsoft 365 environment;
• B2Brouter Global SL (Spain) — Peppol access point and French accredited platform services, document conversion and archiving;
• Avalara Europe Ltd (United Kingdom) — optional secondary access point, used only where a client has contracted for it;
• Freelance professionals engaged by Salviminda in the Philippines — development and support work, which involves access to client environments and the data in them (see section 5);
• Our professional advisers — accountants, auditors and lawyers, bound by professional confidentiality;
• Competent authorities — where required by law;
• A successor entity — in the event of a merger, acquisition or restructuring, under equivalent data protection obligations.

Each recipient processing data on our behalf is bound by a data processing agreement. We do not sell, rent or trade personal data. The current list is published at salviminda.com/legal/sub-processors.

5. International transfers

Personal data is stored within the European Union. S-Link Hub and the documents it holds are hosted on Microsoft Azure in the West Europe region (the Netherlands), and we do not replicate data at rest outside the EU. Two categories of recipient are located outside the EU:

• United Kingdom — Avalara Europe Ltd. The European Commission renewed its adequacy decisions for the United Kingdom on 19 December 2025, valid until 27 December 2031, so no additional transfer safeguard is required.
• The Philippines — freelance professionals engaged directly by Salviminda form part of our delivery team and access our EU-hosted systems and client environments remotely. The Philippines is not covered by an adequacy decision, so these transfers are made under the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supported by a documented transfer impact assessment reviewed annually and by technical and organisational measures including named individual accounts, multi-factor authentication, least-privilege and time-limited access, logging of access, and a prohibition on storing data locally or in personal accounts.

You may obtain a copy of the applicable Standard Contractual Clauses, with commercially confidential terms redacted, by writing to privacy@salviminda.com.

6. Data retention

We retain personal data for no longer than is necessary for the purpose for which it was collected. Where we act as processor, retention is set by our client as controller. In summary:

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15) — to obtain a copy of your personal data and information about how it is processed;
• Right to rectification (Art. 16) — to have inaccurate personal data corrected;
• Right to erasure (Art. 17) — to request deletion in certain circumstances;
• Right to restriction (Art. 18) — to request restriction of processing in certain circumstances;
• Right to data portability (Art. 20) — to receive data you provided in a machine-readable format;
• Right to object (Art. 21) — to object to processing based on our legitimate interests. Where you object to direct marketing we will stop without exception;
• Right to withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact privacy@salviminda.com. We respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month. Exercising these rights is free of charge.

Where your data appears in a business document processed through S-Link, our client is the controller. We forward your request to them without undue delay and assist them in responding.

8. Complaints

If you believe your data protection rights have been infringed we would like the chance to put it right — please contact us first at privacy@salviminda.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority, and to an effective judicial remedy:

Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium
Tel: +32 2 274 48 00 · Email: contact@apd-gba.be · www.dataprotectionauthority.be

If you are resident in another EU Member State, you may also complain to the supervisory authority there.

9. Updates to this notice

We may update this Privacy Notice from time to time — for example if we add or change a sub-processor, a processing location or a purpose. Material changes will be communicated via this website or by direct notification. The current version is always available on this page.