Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the Customer (controller) and Individual Entrepreneur KULIKOVA DARIA IGORI, Komitas Avenue 16, apt. 88, Arabkir, Yerevan 0012, Republic of Armenia(processor), the operator of Fakturia. It applies to personal data contained in the documents and contacts the Customer processes through the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

• Purpose: creating, validating, sending, receiving and storing structured electronic invoices and related documents over Peppol, and reporting them to the Slovak Financial Administration through the certified delivery provider.
• Data subjects: the Customer’s business contacts, their representatives and the Customer’s own staff named in documents.
• Categories of data: names, business addresses, identification and tax numbers, email addresses, Peppol identifiers, bank details and other data the Customer includes in documents.
• Duration: for the term of the Customer’s account plus the export period described in the Privacy Policy.

• Process the data only on the Customer’s documented instructions, which are the use of the Service as configured by the Customer.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (encryption in transit, hashed credentials, access limited to what is necessary, backups).
• Assist the Customer, as far as possible, in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR.
• Notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data.
• At the end of the service, delete or return the data at the Customer’s choice, unless the law requires storage.
• Make available the information necessary to demonstrate compliance and allow for audits on reasonable notice, at the Customer’s cost.

The Customer gives general authorisation to engage the sub-processors listed on the Sub-processors page, including the certified delivery provider eFaktura s. r. o.. We notify changes by email at least 30 days in advance. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may terminate the affected Service. We impose data protection obligations on each sub-processor that are no less protective than this DPA.

The Service is hosted in the EU. The processor is established in the Republic of Armenia, which has no EU adequacy decision; access to the data from Armenia for operation and support is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 — controller to processor), which are incorporated into this DPA by reference.

The Customer is responsible for the lawfulness of the data it enters into the Service and for informing its data subjects as required by law.

Data protection questions and breach notifications: support@fakturia.cloud.