Data processing agreement

This agreement is made under Art. 28 of the General Data Protection Regulation (GDPR). It is concluded when a company creates an account in Fakturist or takes over an account by invitation, and applies to the company on whose behalf it was accepted and to client companies added by an accounting firm under section 1a. It is part of the terms of service; in a conflict on personal data protection this agreement prevails. The Bulgarian text prevails.

1. Parties

• Controller — the client company on whose behalf the agreement was accepted.
• Processor — Carbon Stealth VCC (Карбон Стелт ЕДПК), EIK 208725180, ul. Samuil 3, 2670 Bobov Dol, Bulgaria, privacy@carbonstealth.eu.

1a. Accounting firms

When an accounting firm creates or serves a client company in Fakturist, the controller of the personal data in the client's documents is the client company, the accounting firm is a processor, and the processor under this agreement is the accounting firm's sub-processor. The accounting firm declares — with a checkbox, recorded each time it adds a client — that the client has authorised it in writing to use Fakturist (Art. 28(2) GDPR) and that its contract with the client imposes the obligations of Art. 28(3) GDPR. Between the accounting firm and the processor this agreement applies under Art. 28(4) GDPR. When the owner of the client company accepts an invitation and takes over its account, the agreement is concluded directly with the client company.

2. Subject matter, nature and purpose

The processor processes personal data on behalf of the controller to provide Fakturist: storing counterparties and documents; creating the documents as XML and PDF; delivering them to the recipient's inbox and by email; automatically issuing recurring invoices from the controller's template and emailing them to the address the controller specifies; pro forma invoices and emailing them to the address the controller specifies; recording payments against documents and — if the controller enables them — reminders of overdue payment to the recipient's email address in the document; matching incoming payments from bank statements the controller uploads with its invoices; receiving, validating and registering incoming electronic invoices the controller uploads; access to these functions through an API with the controller's key; backups. The purpose is issuing, receiving, keeping and sending the controller's invoices and notes and tracking payments against them.

3. Types of data and data subjects

• Data subjects: the controller's counterparties (customers and suppliers) — natural persons (traders, freelancers, customers), representatives and contact persons of counterparties; recipients of emails the controller sends through the service; payers of incoming payments to the controller's account in uploaded statements, including persons who are not its counterparties; the controller's employees and users.
• Data: names, addresses, EIK or VAT number, email, bank account (IBAN), the content of documents (goods and services, quantities, amounts, dates, grounds); from statements — incoming payments only: date, amount, currency, payer's name and IBAN, remittance information and bank reference; from incoming electronic invoices — the XML file as received. A personal identification number (EGN) — only if the controller enters it where the law requires.
• Special categories of data (Art. 9 GDPR) and data on convictions are not knowingly processed: the controller does not enter them and does not upload files it knows contain them. If an incoming document contains them, it is kept only as part of the file and is not read or processed separately.

4. Term

The agreement applies while the controller uses Fakturist and afterwards — until the data is deleted under section 11.

5. Instructions

The processor processes the data only on documented instructions of the controller — these are the controller's actions in the service (entering, uploading, issuing, matching, sending, downloading), the tasks the controller has enabled (recurring invoices, reminders), API requests made with the controller's key, and this agreement. If an instruction, in the processor's view, infringes the GDPR or other law, it informs the controller immediately. The instructions also cover transfers to a third country. If the law requires the processor to process the data, it informs the controller of that requirement before processing, unless the law prohibits it. The processor does not use the data for its own purposes, does not sell it and does not provide it for advertising.

6. Confidentiality

Only people who maintain the service have access to the data, under a duty of confidentiality, and only as far as needed for its operation, for support at the controller's request or by law.

7. Security (Art. 32 GDPR)

• HTTPS only with HSTS; the application keeps no IP addresses, and the web server records them only in its log of critical errors.
• Passwords — Argon2id hashes; two-factor sign-in (mandatory for the processor's team); secret keys and integration keys — encrypted with AES-256-GCM.
• Access by roles and mandates, checked on the server on every request; an accounting firm sees a company only with an active mandate.
• API keys are stored only as SHA-256 hashes, shown once, and work only while their creator is a member of the controller; request limits per key and per address.
• The chain of document fingerprints and the audit log reveal any change; an issued document is never altered.
• A strict content security policy (CSP), with no external scripts, fonts or analytics.
• A database backup every day and before every update, with a verified restore; backups are kept for at most 90 days; server secrets are readable only by their owner and never enter copies of the code.
• The server and the copies are in a data centre in the European Union.

8. Sub-processors

The controller gives general authorisation for the following sub-processors:

The processor notifies the controller by email at least 30 days before adding or replacing a sub-processor. The controller may object within that period; if the parties cannot agree, the controller may stop using the service without penalty. The processor has a contract with each sub-processor imposing the same data protection obligations and remains liable to the controller for it.

9. Transfers

The data is not transferred outside the European Union. If a subcontractor of a sub-processor processes it outside the EU, the transfer is protected by the European Commission's standard contractual clauses (Art. 46 GDPR).

10. Assistance

• Data subject rights: the processor helps the controller answer requests under Art. 12–23 GDPR — through the service's functions (viewing, downloading documents as PDF and XML) and, where needed, by email. A request received directly from a data subject is forwarded to the controller without a substantive reply.
• Personal data breaches: the processor notifies the controller without undue delay and no later than 48 hours after becoming aware of a breach affecting its data, with the information available under Art. 33(3) GDPR, and supplements it as it learns more.
• The processor assists with impact assessments and consultations with the supervisory authority (Art. 35–36 GDPR) as far as they concern the service.

11. After the end of the agreement

After the controller stops using the service, it has 30 days to download its documents. At its request within that period, the processor provides an archive of all documents as PDF and XML and a machine-readable list of counterparties within 10 working days. The processor then deletes its data, unless the law requires the processor to keep it. Database backups are made every day and before every update of the service and kept for at most 90 days; deleted data disappears from them at the latest then. On request the processor confirms the deletion in writing.

While the agreement is in force, data from uploaded statements is kept only for matching: 90 days after a line is matched to a document or skipped, the payer's name and IBAN and the remittance information are erased — the date, amount and bank reference of the document payment remain; an unmatched line is deleted 12 months after the booking date, and a statement with older payments is not accepted. The controller may delete an uploaded statement at any time; lines matched to documents remain without the payer's name, IBAN and remittance information, so that the same payment is not imported twice. Keeping its bank statements under the Accountancy Act is the controller's obligation.

Documents delivered to a recipient's inbox (section 7 of the terms) remain with the recipient as its own copy — for them the recipient is an independent controller.

12. Information and audits

The processor provides the information needed to demonstrate compliance with this agreement. The controller may request an audit — in writing, with reasonable notice, at most once a year (except after a breach), at its own cost and without access to other clients' data.

13. Obligations of the controller

The controller is responsible for the legal basis of the processing, for informing data subjects and for the accuracy of the data it enters, and does not enter data not needed for the documents. When it enables emails to recipients outside Fakturist or payment reminders, the controller is responsible for having a lawful basis for them and for informing recipients that it sends them through Fakturist; replies go to its email address. It uploads only statements of its own accounts.

14. Liability

Each party is liable under Art. 82 GDPR for damage caused by its breach. Otherwise section 13 of the terms of service applies.