Fakturo.app

Data processing agreement

  1. This Data Processing Agreement (hereinafter as “DPA”) is subject to Terms of Use. Unless specified otherwise in this DPA the terms used in this DPA shall have the same meaning as in the TOU.
  2. This DPA forms the basis for the relationship between you, the User as Controller, and Fakturo the provider and operator of the Service as Processor under Data Protection Laws, specifically the General Data Protection Regulation (GDPR).
  3. This DPA applies for the processing of User Data through mobile apps, website fakturo.app as well as the other available services.
  4. You agree to and accept the terms of this DPA as outlined below. You agree that you have read and understood the DPA upon acceptance. This DPA assures you that we, as your Processor, comply with the requirements arising from the GDPR.
  5. GDPR is a set of laws and regulations the EU has taken to protect the persons rights for privacy and it becomes effective on May 25, 2018. The aim of the new regulation is to standardise and update how businesses handle the collection of personal data and to clarify how the EU Personal Data laws apply.

1. Definitions

  1. ‘User Data‘ means any Personal Data that Fakturo processes on behalf of You as a Processor in the course of providing Service, as more particularly described in this DPA.
  2. ‘Data Protection Law/s’ means applicable and binding laws to which Fakturo and User is a subject to in the field of personal data protection and privacy especially GDPR.
  3. ‘GDPR’ means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  4. ‘Personal Data’ has the meaning given to that term in Data Protection Laws. It’s any information relating to a data subject by which it can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person or legal entity (where applicable).
  5. ‘Supervisory Authority‘ means any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering Data Protection Laws.
  6. ‘Subprocessor’ means another Processor engaged by Fakturo, which Fakturo has an agreement with, for carrying out processing activities on behalf of the User and in respect of this DPA.
  7. All other definitions referred to herein, including the terms Controller and Processor, are as determined by the relevant Data Protection Laws and GDPR.

2. Introduction

  1. This agreement applies to Fakturo’s processing of User Data on behalf of the User as a Processor in the context of the Service provided by Fakturo under TOU.
  2. For purposes of this DPA, You and Fakturo agree that You are the Controller and Fakturo is the Processor and when You act as a Processor of User Data then You are the Processor and Fakturo is another Processor. This Agreement forms the contractual basis to process User Data on Your behalf. It explains how User Data may be processed and the purpose of processing. We process User Data only as required and based on Your instructions, as outlined in this DPA and TOU.
  3. We are in no case is responsible for any direct or indirect damage (including loss of profit), the damage of the good name or data by breach of the provisions of this DPA by the User or its authorized Users even in case that the User has notified Fakturo about such fact. Liability for actions arising from breach of the provisions of this DPA is governed by liability and compensation provisions of the TOU.

3. Data processing provisions

  1. By agreeing to this DPA You authorize Fakturo to process, as a Controller, User Data for the purposes listed in this DPA, including internal research, fraud, security and risk management. Fakturo represents and warrants that it will process User Data for these purposes in compliance with Data Protection Laws and GDPR.
  2. Each Party agrees and will ensure that the terms of this DPA shall also be fully applicable to the affiliates or third parties which may be involved in the processing operations of User Data on their behalf.

4. Data Processor Responsibilities

  1. Fakturo is aware of the applicable legal responsibilities of Processors under Data Protection Laws.
  2. We, as the Processor, represents and warrant that We will:
    1. only processes User Data in accordance with Your lawful instructions and not for any other purposes than those specified in this DPA, or as otherwise agreed by both Parties in writing.
    2. cooperate with You in Your role as Controller to fulfil Your own data protection compliance obligations under Data Protection Laws, including by providing all information available to Us as necessary to demonstrate compliance with Your own obligations and where applicable to help you conduct data protection impact assessments or prior consultation with Supervisory Authorities.
    3. keep internal records of processing of User Data carried out as a Processor on behalf of You.
    4. assist You in fulfilling Your obligation to respond to data subjects’ requests to exercise their rights as provided under Data Protection Laws and notify You about such requests if Fakturo receives it directly from the data subject.
    5. notify You when local Applicable Law prevent Fakturo from fulfilling its obligations under this DPA and have a substantial adverse effect on the guarantees provided by this DPA, and from complying with the instructions received from You via this DPA, except if such disclosure is prohibited by Applicable Law, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation.
    6. When the DPA expires or upon termination of the DPA or upon a request to delete or return User Data by You, except for any Personal Data which we process as a Controller, Fakturo will, at Your choice, delete, anonymize, or return such User Data to You, and delete or anonymize existing copies unless Applicable Law prevents it from returning or destroying all or part of the User Data or requires storage of the User Data (in which case We will protect the confidentiality of the User Data and will not actively process the User Data anymore).
  3. In addition, We shall, as far as legally possible, inform You if a request for information on User Data processed is requested. We will respond to such requests once authorized by You to do so. We will not disclose any information unless We are required by Applicable Law to do so, such as by court order.
  4. If you require information or assistance regarding the security of User Data, documentation or information about how We process User Data generally, you can request this information from Us.
  5. We, Our employees and any Subprocessors, shall ensure confidentiality in relation to User Data processed under this DPA. This provision continues to apply after termination of this DPA, regardless of the cause of termination.

5. Controller Responsibilities

  1. You, as the Controller, represents and warrants that You:
    • comply with Data Protection Laws in respect of processing of User Data, and only gives lawful instructions to Fakturo (lawfulness of processing).
    • rely on a valid legal ground under Data Protection Laws for each purpose of processing, including obtaining data subjects’ appropriate consent if required or appropriate under Data Protection Laws (legal ground).
    • provide appropriate notice to the data subjects regarding the processing of User Data for the purposes, in a timely manner and at the minimum with the elements required under Data Protection Laws (notice).
    • take reasonable steps to ensure that User Data is accurate, complete and current; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; and kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data are processed unless a longer retention is required or allowed under applicable law (accuracy, data minimization and data retention).
    • implement appropriate technical and organizational measures to ensure, and to be able to demonstrate, that the processing of Personal Data is performed in accordance with Data Protection Laws (accountability).
    • respond to data subject requests to exercise their rights of (a) access, (b) rectification, (c) erasure, (d) data portability, (e) restriction of processing, and (f) objection to the processing in accordance with Data Protection Laws (data subjects’ rights).
    • will cooperate with Us to fulfil our respective data protection compliance obligations in accordance with Data Protection Laws (cooperation).

6. Details of processing

  1. Subject-matter:
    • The subject matter of the data processing under this DPA is the User Data.
  2. Duration:
    • The duration of the data processing under this DPA is until the termination of the Agreement in accordance with TOU.
  3. Purpose:
    • The purpose of the data processing under this DPA is the provision of the Service to the User and the performance of Fakturo's obligations under the Agreement (including this DPA) or as otherwise agreed by the Parties.
  4. Nature of processing:
    • Fakturo provides a services of professional invoice maker with all necessary features for a small business and other related services, as described in the Agreement.
  5. Categories of data subjects:
    • Any individual accessing and/or using the Service through Your User account (authorized user) and any individual whose personal information or contact information is stored on or collected via the Services (i.e. Your clients and customers information or their representatives information).
  6. Type of User Data:
    • User and authorized Users: identification and contact data (name, title, job, contact details, username);
    • Clients and Customers: identification and contact data (name, title, job, contact details).

7. Subprocessors

  1. Some features of Service require the use of Subprocessors. Subprocessors provide services that are necessary to enable Us to fulfil the Agreement made with you when signing up to use the Service. We maintain agreements with all Subprocessors to process your User data in line with this DPA and Data Protection Laws. User agrees that We may engage Subprocessors to process User Data on User`s behalf.
  2. The following Subprocessors are engaged by Us to process User Data:
    1. MailChimp, USA – E-mails, Newsletters and Infomails
    2. Intercom, USA – live chat and support systems
    3. Amazon AWS, Germany - hosting, emailing
    4. Braintree, USA – Payment processes
    5. Fortax, UK – Accounting
    6. Danubiatel, Slovakia - Accounting
    7. JUMP soft, Slovakia – Analytics and HR
    8. Getstream, USA
    9. Iterable, USA – Cross-channel marketing
    10. Develer, Slovakia – Research and Development
    11. IInvoices, Slovakia – Support
    12. Intecs Data, Czech Republic – Data processing
  3. We shall always choose the Subprocessor by specifically considering the suitability of the technical and organisational measures taken by the Subprocessor. A specific agreement between Us and Subprocessor will assure that they will maintain all User Data in line with the requirements under this DPA and current Data Protection Laws. We ensure that Subprocessors satisfy all obligations and requirements within this DPA, specifically that their level of data protection meets all standards required under present Data Protection Laws. We review the Subprocessor’s compliance with obligations on a regular basis.
  4. Subprocessing, in terms of this DPA, only refers to those services that are directly associated with processing of User Data.

8. Data storage and security

  1. We shall implement and maintain, at our cost and expense, appropriate and adequate technical and organizational measures in relation to the processing of User Data taking into account the nature of the processing, to assist the User insofar as possible in the fulfilment of the User’s obligations to respond to data subject requests relating to User Data.
  2. Our servers are operated by Amazon AWS, Germany. All the User Data You provide to the Fakturo website with is encrypted according to the security standard TLS (Transport Layer Security). You can recognize the secure TLS connection from the “s” after the “http” in the URL shown in Your browser (i.e. https://..), or from the lock symbol depicted in the browser tab. All of Your User Data, including their transmission between Your device and the Our servers, will be protected by standard security measures with the use of 256-bit SSL encryption.
  3. We also take technical and organizational suitable security measures, in order to protect Your User Data against random or deliberate manipulations, partial or complete losses, destruction and/or against unauthorized access. In order to avoid loss of data, We run a mirrored database setup which means that Your User Data is always stored in two separate locations.
  4. User Data that We process is stored in a secure environment within the EEA or outside of EEA in compliance with Privacy Shield rules and treated confidentially. Access to this data is limited to selected Fakturo employees and partially to our Subprocessors. We adhere to Data Protection Laws at all times.
  5. We do Our utmost to secure Your User Data in the best possible way, but we cannot guarantee the safety of your User Data when transferred over the Internet. When User Data is transferred over the Internet, there is a certain risk that others can access the User Data illicitly. In other words, the safety of your User Data transfer is Your own responsibility as the Controller.
  6. Not with standing the above, User agrees that except as provided by this DPA, User is responsible for its secure use of the Service, including securing its account authentication credentials, protecting the security of User Data when in transit to and from the Service and taking any appropriate steps to securely encrypt or backup any User Data uploaded to the Service.

9. Confidentiality

  1. The Parties must take steps to ensure that any person acting under their authority who has access to User Data is subject to a duly enforceable contractual or statutory confidentiality obligation, and if applicable process User Data in accordance with the User’s instructions.

10. Notification obligations

  1. We shall notify the You of any data breaches concerning User Data immediately. Any justifiably suspected incidents shall be reported. Notice shall be sent to Your email address which is associated with your User account within 24 hours from the moment We discover the respective incident has occurred. This notification must contain at least the following information:
    1. A description of the type of the User Data affected including, if possible, the categories and approximate number of affected persons as well as the respective categories and approximate number of the User Data sets.
    2. The name and contact details of the Data Protection Officer (if appointed) or another point of contact for further information.
    3. A description of the probable consequences of the User Data protection infringement.
    4. A description of the measures taken or proposed by Us to rectify the User Data infringement and, where applicable, measures to mitigate their possible adverse effects.
    5. You shall also be notified immediately of any significant disruptions when carrying out the task as well as violations against the Data Protection Laws or the stipulations in this DPA carried out by Us. We shall inform the You of any inspections or measures carried out by Supervisory Authorities or other third parties if they relate to the User Data processing. We shall ensure that the User is supported in these obligations, in accordance with Art. 33 and Art. 34 of the GDPR, to the extent required.

11. Data retrieval

  1. You have the right to retrieve all of User Data within the Service by means of the Service. If you requests retrieval assistance regarding User Data retrieval, the associated costs shall be determined later in an agreement between the Parties and shall be based on the complexity of the requested process and the time to fulfil it in the chosen format.