Data Processing Agreement

Controller: the Customer of the Kontevia service, a business or self-employed person that processes personal data contained in its accounting documents and other data submitted to the Service.

Processor: Eucalypt 4 s.r.o., Jicinska 226/17, Zizkov, 130 00 Praha 3, Czech Republic, Company ID 22103741, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 410771. Contact for data protection: hello@kontevia.com.

1.1. This Agreement governs the rights and obligations of the parties when the Processor processes personal data on behalf of the Controller in the course of providing the Kontevia service (the "Service").

1.2. This Agreement forms an integral part of the Terms and Conditions and takes effect when the Controller registers for the Service. It applies for as long as the Processor processes personal data for the Controller.

2.1. The Processor processes personal data solely for the purpose of providing the Service, namely:

• receipt and digitisation of accounting documents submitted by chat, e-mail or upload;
• extraction of data from documents using optical character recognition and automated extraction models;
• categorisation, duplicate detection and VAT treatment proposals;
• issuing invoices and other documents on the Controller's instruction;
• import of bank transactions the Controller connects and their matching to documents;
• preparation of summaries, reports and exports to the Controller's accounting system or adviser;
• storage of documents and data within the Service for the duration of the contract and the export period.

2.2. The Processor processes personal data only on documented instructions from the Controller, including instructions regarding transfers to third countries, unless required to do so by Union or member state law; in that case the Processor informs the Controller before processing, unless the law prohibits it.

3.1. Data subjects: the Controller's business partners (suppliers, customers, contact persons), the Controller's employees and contractors where payroll or expense documents are processed, and the Controller's own users of the Service.

3.2. Categories of personal data: identification data (name, company, company and VAT identification numbers); contact data (address, e-mail, phone); financial data (invoiced amounts, bank account numbers, payment references); employment data where payroll documents are submitted (job title, salary, insurance identifiers); usage data of the Controller's users.

3.3. The Processor does not require special categories of data within the meaning of Article 9 GDPR. The Controller undertakes not to submit such data through the Service unless it is contained in a document that the Controller is legally obliged to keep, in which case the Controller is responsible for the lawful basis.

The Processor undertakes to:

• process personal data only on documented instructions from the Controller and only to the extent necessary for the Service;
• ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement the technical and organisational measures required by Article 32 GDPR, in particular those listed in the Annex to this Agreement;
• not engage another processor without the Controller's prior general written authorisation, which the Controller grants under Article 6 of this Agreement;
• taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures in responding to requests of data subjects exercising their rights;
• assist the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to the Processor;
• at the Controller's choice, delete or return all personal data after the end of the provision of the Service and delete existing copies, unless Union or member state law requires storage;
• make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller;
• immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or member state data protection provisions.

5.1. The Processor notifies the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware of it.

5.2. The notification contains at least: a description of the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; the name and contact details of the person responsible; a description of the likely consequences; and a description of the measures taken or proposed to address the breach and mitigate its effects.

5.3. The Processor cooperates with the Controller in meeting the Controller's notification obligations towards the competent supervisory authority and the data subjects.

6.1. The Controller grants a general authorisation for the Processor to engage sub-processors for the processing of personal data.

6.2. The current list of sub-processors, with the purpose and location of each, is published on the Sub-processors page of the Processor's website and forms an annex to this Agreement.

6.3. The Processor informs the Controller of any intended addition or replacement of sub-processors at least 14 days in advance, by e-mail to the Controller's contact address or by notice in the Service, giving the Controller the opportunity to object.

6.4. If the Controller raises a justified objection within 14 days of the notice, the Processor either refrains from the intended change or offers the Controller the possibility to terminate the contract without penalty and with a refund of prepaid fees for the unused period.

6.5. The Processor imposes on each sub-processor, by contract, the same data protection obligations as set out in this Agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to fulfil its obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor's obligations.

7.1. Personal data is stored on servers located in the European Union. The Processor does not transfer personal data outside the European Economic Area except to sub-processors listed on the Sub-processors page and only with appropriate safeguards under Chapter V GDPR.

7.2. Such transfers are based on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified recipients), the standard contractual clauses adopted by the Commission under Article 46(2)(c) GDPR, or other appropriate safeguards, supplemented by additional measures where a transfer impact assessment requires them.

8.1. The Processor provides the Controller with reasonable assistance in handling requests of data subjects to exercise their rights under Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability, objection). The Service includes search, export and deletion functions that allow the Controller to handle most requests directly.

8.2. If a data subject contacts the Processor directly, the Processor refers the data subject to the Controller without undue delay and informs the Controller, unless the request concerns data for which the Processor itself is the controller.

9.1. The Processor allows the Controller or an auditor mandated by the Controller to conduct audits and inspections to verify compliance with this Agreement and with the GDPR.

9.2. Audits are conducted at the Controller's expense, with reasonable prior notice of at least 14 business days, during business hours and in a manner that does not disrupt the Processor's operations or compromise the security of other customers' data. The auditor must be bound by confidentiality.

9.3. Instead of an on-site audit, the Processor may provide current certificates, reports of independent auditors or other documentation demonstrating compliance with the security measures, where these are sufficient to answer the Controller's questions.

10.1. This Agreement is effective for the duration of the contractual relationship between the Controller and the Processor, that is, for as long as the Controller uses the Service.

10.2. After the end of the contractual relationship the Processor: allows the Controller to export its data for 90 days; after the 90-day period irreversibly deletes all personal data of the Controller; deletes backup copies no later than 45 days after the deletion of the primary data; and confirms the deletion at the Controller's request. Data the Processor must retain under Union or member state law (in particular billing records) is excluded.

10.3. The obligations of this Agreement, in particular confidentiality and security, survive the end of the contractual relationship for as long as the Processor holds any personal data of the Controller.

11.1. The Processor is liable for damage caused by processing in breach of this Agreement or the GDPR in accordance with Article 82 GDPR, in particular where it has not complied with obligations of the GDPR specifically directed to processors or has acted outside or contrary to lawful instructions of the Controller.

11.2. The limitations of liability in the Terms and Conditions apply to this Agreement to the extent permitted by law; they do not limit the rights of data subjects.

12.1. This Agreement is governed by the law of the Czech Republic and the directly applicable law of the European Union, in particular the GDPR.

12.2. In case of conflict between this Agreement and the Terms and Conditions, this Agreement prevails in matters of personal data protection.

12.3. Amendments to this Agreement require written form, which includes an updated version published on the website and notified to the Controller in accordance with the Terms and Conditions.

12.4. Disputes arising from this Agreement are decided by the courts of the Czech Republic competent according to the seat of the Processor, without prejudice to the rights of data subjects and supervisory authorities.

Encryption

• AES-256 encryption of data at rest, including backups.
• TLS 1.2 or higher for all data in transit, including connections to sub-processors.

Access control

• Access on the principle of least privilege; each employee and system has only the permissions needed for its role.
• Multi-factor authentication for administrative and infrastructure access.
• Separation of customer workspaces in the application and database layer.
• Regular review and prompt revocation of access rights.

Availability and resilience

• Regular automated backups with tested restoration procedures.
• Redundant hosting infrastructure within the European Union.
• Monitoring of availability and performance with alerting.

Integrity and logging

• Logging of access to personal data and of administrative actions.
• Audit trail for documents: who submitted, changed, approved or exported them and when.
• Detection of anomalies and security incidents.

Organisational measures

• Confidentiality obligations of all staff and contractors with access to personal data.
• Training of staff in data protection and security.
• Documented internal procedures for processing personal data and handling data subject requests.
• Incident response plan with defined roles and notification deadlines.
• Data protection review of new sub-processors before engagement.