Data processing agreement

1. Subject matter of the Agreement and the parties

1.1 By entering on the Platform, and processing through the Platform, the data of its clients and other third parties, the User determines the purposes and means of that processing and is therefore to be regarded as the Controller, while the Processor provides the technical infrastructure and processes that data solely on the Controller's behalf and on its instructions.

1.2 For the data of the User itself as a natural person, including its contact details and billing data, the Processor acts as an independent controller, and such processing is governed by the Privacy Policy, not by this Agreement.

2. Description of the processing

2.1 The subject matter of the processing is the personal data that the Controller enters on the Platform or processes through the Platform, while the nature and purpose of the processing are preparing, storing, sending and managing invoices and other financial documents, and providing related additional features.

2.2 The processing lasts for as long as the contract for use of the Service is in force and thereafter to the extent and for the period set out in this Agreement and in applicable legislation.

2.3 The categories of data subjects include the Controller's clients, business partners, their representatives and other natural persons whose data the Controller includes on invoices or in other documents processed on the Platform.

2.4 The categories of personal data include first name and surname or name, registration and taxpayer number, address, contact details, bank account information, and invoice lines, amounts and the content of correspondence, to the extent that the Controller enters or sends them through the Platform, and the Controller undertakes not to enter special categories of personal data on the Platform unless this is genuinely necessary and lawful.

3. The Controller's obligations

The Controller ensures that it has a legal basis for processing the personal data and passing it to the Processor, that data subjects have been informed accordingly and that the instructions it gives comply with applicable legislation; the Controller also takes responsibility for the accuracy and currency of the data under its control and for the lawfulness of its processing.

4. The Processor's obligations

The Processor undertakes to comply with the obligations under Article 28 of the Regulation listed below.

1. To process personal data only on documented instructions from the Controller, including with regard to transfers of data to a third country, unless required to do so by legislation to which the Processor is subject, in which case the Processor informs the Controller of that legal requirement before processing, unless that legislation prohibits it; use of the Platform in accordance with its functionality is deemed a documented instruction from the Controller.
2. To ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. To take all the technical and organisational security measures required by Article 32 of the Regulation, taking into account the state of the art, the nature of the processing and the level of risk.
4. To respect the conditions set out in section 5 of this Agreement for engaging another processor (sub-processor).
5. Taking into account the nature of the processing, to assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests from data subjects to exercise their rights.
6. To assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 of the Regulation, including on the security of processing, notification of personal data breaches and data protection impact assessments, taking into account the nature of the processing and the information available to the Processor.
7. At the Controller's choice, to delete or return to the Controller all personal data after the end of the provision of the processing services and to delete existing copies, except to the extent that applicable legislation requires the data to be kept.
8. To make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this Agreement, and to allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to reasonable prior notice and confidentiality requirements.

5. Sub-processors

5.1 The Controller gives the Processor general written authorisation to engage sub-processors to provide the Service, and the list of sub-processors engaged by the Processor is set out in the Privacy Policy, which the Controller can read at erekini.eu/en/privacy.

5.2 The Processor concludes a written contract with each sub-processor imposing on it the same data protection obligations as are set out in this Agreement, and the Processor remains fully liable to the Controller for the way the sub-processor performs its obligations.

5.3 The Processor informs the Controller of any intended changes concerning the addition or replacement of sub-processors by publishing updated information in the Privacy Policy or by sending a notice, giving the Controller the opportunity to object to such changes within a reasonable period; if the Controller objects on reasonable grounds and the parties cannot find a solution, the Controller may stop using the Service.

6. Transfers of data outside the EU and EEA

Where processing of personal data involves its transfer to a country outside the European Union or the European Economic Area, such a transfer takes place only if one of the grounds for transfer provided for in Chapter V of the Regulation is in place, in particular an adequacy decision of the European Commission or standard contractual clauses approved by the European Commission, and detailed information on the specific recipients and the grounds for transfer is set out in the Privacy Policy.

7. Personal data breaches

Without undue delay after becoming aware of a personal data breach affecting the data processed for the Controller, the Processor notifies the Controller, providing the information available to it that the Controller needs in order to meet its notification obligations under Articles 33 and 34 of the Regulation.

8. Liability and final provisions

8.1 The parties' liability in respect of data processing is governed by the Regulation and applicable legislation, while in all other respects, including general limitations of liability, the Erekini.eu terms of use apply.

8.2 This Agreement takes effect at the same time as the terms of use are accepted and remains in force for as long as the Processor processes personal data on the Controller's behalf.

8.3 If any provision of this Agreement is or becomes invalid, this does not affect the validity of the remaining provisions, and in the event of a conflict between this Agreement and the terms of use regarding the processing of personal data, this Agreement prevails.