Data processing agreement

§ 1. Parties and conclusion of the agreement

1. This agreement is concluded between the Customer using the Księguś service (the Controller) and Volt and Amaranth spółka z ograniczoną odpowiedzialnością, ul. 55 Pułku Piechoty 34, 64-100 Leszno, NIP 6972347881, KRS 0000733234 (the Processor).
2. This agreement is concluded in electronic form (Article 28(9) GDPR), upon registration in the service, together with the agreement for the provision of services on the conditions of the Terms (the Main Agreement), and remains in force for as long as the Main Agreement and until the data are deleted in accordance with § 9. Capitalised terms have the meaning given to them in the Terms.
3. This agreement implements Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). Matters not governed by it are governed by the GDPR and the Terms.

§ 2. Subject matter, nature and purpose of processing

1. The Controller entrusts the Processor with the processing of personal data contained in Customer Data solely for the purpose of providing the services described in the Terms.
2. Processing comprises: collection (including retrieval from the National e-Invoice System (KSeF) and reading from uploaded files and statements), recording, storage, organisation, viewing, matching, use for preparing invoices, transfer files and summaries, making available to the Controller’s Users, transmission to KSeF on the Controller’s instruction, making backups, and erasure. The data are processed in an IT system, continuously, for the duration of the Main Agreement.
3. Categories of data subjects:
   • the Controller’s counterparties (buyers and suppliers) who are natural persons, including persons running a business, and their representatives and contact persons;
   • persons named in transfer descriptions and bank transactions;
   • the Controller’s employees and associates (employment contract, contract of mandate, contract for specific work) and persons to whom the Controller has granted access to the service.
4. Types of data:
   • identification and contact data: first name and surname, business name, NIP, address, e-mail address, telephone number;
   • financial data: bank account numbers, amounts, payment descriptions and dates, content of invoices;
   • employee data: PESEL (national identification number), date of birth, address, account number, type and terms of contract, remuneration, working time, leave and absences, HR documents;
   • special category data (health data): employees’ sick notes and medical certificates, if the Controller enters them into the service.

§ 3. The Controller’s instructions

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers of data to a third country, unless it is required to process them by Union law or Polish law. In such a case, it informs the Controller before processing begins, unless the law prohibits this.
2. The following constitute documented instructions: this agreement, the Terms, settings and actions performed by the Controller’s Users in the service (e.g. retrieving invoices, loading a statement, adding an employee, an export) and instructions sent by e-mail from the address of the owner of the business account.
3. If, in the Processor’s opinion, an instruction infringes the GDPR or other data protection provisions, the Processor informs the Controller without delay and may suspend carrying it out until the matter is clarified.
4. The Processor does not use the entrusted data for its own purposes.

§ 4. The Processor’s obligations

1. The Processor grants access to the data only to persons who need it to provide the services and to maintain and protect the service, who are authorised by it and bound by confidentiality, including after their cooperation ends.
2. The Processor applies the technical and organisational measures required by Article 32 GDPR, described in Annex 1, and updates them in line with the risk and the state of the art. It may change them provided it does not lower the level of protection.
3. The Processor, insofar as possible, assists the Controller in fulfilling its obligation to respond to requests from data subjects (Articles 12–22 GDPR), in particular through service features that allow data to be searched for, corrected, exported and erased. It forwards a request addressed directly to the Processor to the Controller without undue delay and does not respond to it itself unless the Controller asks it to do so.
4. The Processor assists the Controller in fulfilling its obligations under Articles 32–36 GDPR (security, notification of breaches, impact assessment, prior consultation), taking into account the nature of processing and the information available to it.
5. The Processor maintains the record of categories of processing activities referred to in Article 30(2) GDPR.

§ 5. Personal data breaches

1. The Processor notifies the Controller of a detected breach of the protection of the entrusted data without undue delay, and no later than 36 hours after detecting it, by e-mail to the address of the owner of the business account.
2. The notification contains, insofar as available, the information listed in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of persons and records, the likely consequences, the measures taken and proposed, and contact details. Information that cannot be provided straight away is provided by the Processor in phases.
3. The Processor takes action without delay to mitigate the effects of the breach and documents every breach. The decision to notify the breach to the supervisory authority and to communicate it to the data subjects is taken by the Controller.

§ 6. Further entrustment (sub-processors)

1. The Controller gives the Processor general authorisation to engage other processors (sub-processors). The current list is in Annex 2.
2. The Processor informs the Controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may raise a reasoned objection during that time. If the parties do not reach agreement, the Controller may terminate the Main Agreement with immediate effect, and the Processor refunds the unused part of the fees paid.
3. The Processor imposes on the sub-processor, by way of a contract, the same data protection obligations as in this agreement, in particular the obligation to implement appropriate security measures. The Processor is liable to the Controller for the performance of the sub-processor’s obligations.
4. Transmitting data to KSeF, the white list of VAT taxpayers (wykaz podatników VAT), the REGON register (rejestr REGON) or another public administration system on the Controller’s instruction is not further entrustment. Those systems are operated by authorities acting under the law.

§ 7. Place of processing

The Processor processes the data only within the territory of the European Economic Area and does not transfer them to third countries or international organisations without the Controller’s prior consent given in writing or in electronic form.

§ 8. Audits

1. The Processor makes available to the Controller all information necessary to demonstrate that it complies with the obligations under Article 28 GDPR; in particular, it answers questions sent by e-mail within 14 days.
2. The Controller, or an auditor authorised by it who is bound by confidentiality, may carry out an audit or inspection after notifying the Processor at least 14 days in advance, on working days, in a manner that does not disrupt the operation of the service and without access to other customers’ data. An audit is in principle carried out by reviewing documents and explanations; an on-site inspection is possible where these are not sufficient to demonstrate compliance or following a personal data breach. The costs of the audit are borne by the Controller.
3. The Processor informs the Controller without delay of any inspection by the supervisory authority concerning the entrusted data.

§ 9. End of processing

1. After the Main Agreement ends, the Controller may, for 30 days, download the data using the exports available in the service or request that they be sent by e-mail in a commonly used format.
2. After that period, the Processor deletes the entrusted data from the service. Data are deleted from backups in the normal cycle of their replacement, no later than after 12 months; until then, the backups remain encrypted and are not used for any purpose other than restoring the service after a failure.
3. The obligation to delete does not apply to data that the Processor is required to retain by Union law or Polish law.
4. At the Controller’s request, the Processor confirms the deletion of the data by e-mail.

§ 10. Liability and final provisions

1. The liability of the parties towards data subjects and towards authorities is governed by Articles 82 and 83 GDPR. In relations between the parties, the rules and limitations of liability set out in the Terms apply, unless the law does not allow them to be applied.
2. The Controller declares that it has a legal basis for processing the entrusted data, including employees’ health data, and that it enters into the service only data needed for the purposes for which it uses the service.
3. Changes to this agreement are made in the manner provided for changes to the Terms. Annex 2 is changed in the manner set out in § 6(2).
4. This agreement is governed by Polish law. In the event of any conflict between this agreement and the Terms on matters of personal data protection, this agreement prevails.

Annex 1. Technical and organisational measures

• Server and database in an ISO/IEC 27001-certified data centre in the EU (Hetzner, Helsinki). The database is not accessible from the internet.
• Connections to the service are encrypted only (HTTPS, HSTS).
• Encryption in the database: KSeF tokens, bank transaction details (counterparty name, account, description), transfer files, files of invoices sent by e-mail and employee data (PESEL, address, account, documents). The encryption key is stored outside the database and its backups; it can be replaced, with the data re-encrypted.
• Daily encrypted backup with a different provider, in a different data centre in the EU (OVHcloud, Warsaw); restoring from backup is tested.
• Passwords stored as Argon2 hashes; account lockout after 5 failed login attempts; attempts also limited by IP address; two-step login (authenticator app, backup codes) available to every User.
• A session expires after 60 minutes of inactivity and after 12 hours at the latest; changing the password logs out other devices.
• Separation of customers’ data: every business page checks the User’s permissions, and access depends on the role in the given business; automated tests check that a User cannot see another business’s data.
• Application protection: database queries only with parameters (protection against SQL injection), a Content Security Policy, protection against embedding in frames, files uploaded by users opened in isolation.
• Security log (logins, failed attempts, exports, downloaded transfer files, opening of health documents, KSeF token changes), available to the owner and the accounting staff of the business, kept for 365 days.
• Automatic deletion of data no longer needed: transfer files and unaccepted files from e-mails after 90 days, security log entries after 365 days.
• Automatic checking of libraries for known vulnerabilities on every code change and weekly; security updates of the server operating system.
• Administrative access to the server only with an SSH key, for authorised persons; an incident response procedure with a division of duties for breach notification.

Annex 2. Sub-processors