Data processing agreement

Annex No. 1 to the General Terms and Conditions of the efakturia.sk service concluded under Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR")

Version: 1.0Effective from: 10 October 2026Last updated: 10 October 2026

Article 1 – Parties and conclusion

1.1 Controller: the Customer under Article 2(1) of the T&C, identified by the details in the Account (the "Controller").

1.2 Processor: IT-DK s. r. o., Odbojárov 1957/8, 026 01 Dolný Kubín, Company ID (IČO): 57 626 472, Tax ID (DIČ): 2122858012, registered in the Commercial Register of the Žilina Municipal Court, Section Sro, Insert No. 91296/L. The data protection contact is gdpr@efakturia.sk (the "Processor").

1.3 This agreement is concluded together with the agreement on the provision of the Service, i.e. by accepting the T&C at sign-up or at sign-in after a change to the T&C. The Processor keeps the time of acceptance and the version of the document. The electronic form meets the requirement of written form under Article 28(9) GDPR.

1.4 In matters of personal data protection, this agreement takes precedence over the T&C. Terms not defined here have the meaning given in the T&C and in Article 4 GDPR.

Article 2 – Subject matter, nature and purpose of processing

2.1 Subject matter: the processing of personal data that the Controller enters into or uploads to the Service, or receives through it, or to which it gives the Service access. This is processing in the course of providing the Service under the T&C.

2.2 Nature of processing:

• storage, organisation, display and retrieval,
• generating documents (PDF, UBL 2.1, ISDOC) and reading uploaded documents,
• sending by e-mail and through the Peppol network, and receiving documents,
• handing data over to the delivery service for reporting to the Financial Directorate,
• payment matching, export, backup and erasure.

2.3 Purpose: solely the provision of the Service to the Controller. This includes, in particular, issuing, sending, receiving and recording its invoices, payment reminders, payment matching, the package for the accountant, the API and webhooks.

2.4 Categories of data subjects:

1. the Controller's customers and suppliers who are natural persons (in particular sole traders),
2. contact persons and representatives of customers and suppliers,
3. employees or other persons of the Controller stated on documents (e.g. "issued by"),
4. the Controller's accountant (the e-mail address for sending the package),
5. counterparties in the Controller's bank transactions (with a bank connection or a statement import),
6. other natural persons whose data the Controller states in documents or notes.

2.5 Types of personal data:

• first name and surname or business name, address, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH),
• e-mail and phone,
• bank account number (IBAN) and identifier in the Peppol network,
• data on supplies, prices and payments stated in documents,
• data from bank transactions: name and account of the counterparty, amount, date, variable symbol and message for the payee,
• other data that the Controller inserts into documents.

2.6 The processing does not cover special categories of personal data (Article 9 GDPR) or data relating to criminal offences (Article 10 GDPR). The Controller will not enter such data into the Service.

2.7 Duration of processing: for the term of the agreement on the provision of the Service and then until erasure under Article 10.

Article 3 – The Controller's instructions

3.1 The Processor processes personal data only on documented instructions from the Controller (Article 28(3)(a) GDPR). Documented instructions are:

1. the T&C and this agreement,
2. Users' actions in the Service and the Account settings, for example sending a document, entering the accountant's e-mail, creating or revoking a shared link, setting up a webhook, switching on the bank connection or requests through the API,
3. other written (including e-mail) instructions of the Account Administrator, if they are consistent with the T&C.

3.2 By sending a document through the Peppol network, the Controller instructs the Processor to hand the document over to the certified provider of the delivery service, to deliver it to the recipient designated by the Controller, and to report the data from the document to the Financial Directorate under Section 85o(9) to (11) of Act No. 222/2004 Coll. on VAT.

3.3 Without an instruction, the Processor may process data only where required to do so by Union law or the law of the Slovak Republic. It informs the Controller of this in advance, unless that law prohibits it (Article 28(3)(a) GDPR).

3.4 If, in the Processor's opinion, an instruction infringes the GDPR or other data protection provisions, it informs the Controller immediately (Article 28(3), second subparagraph, GDPR). It may suspend carrying out the instruction until the Controller confirms or changes it.

Article 4 – Obligations of the Processor

The Processor:

1. ensures that persons authorised to process personal data have committed themselves to confidentiality, unless they are under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). Only the Processor's managing director has access to the Controller's data,
2. takes the technical and organisational measures under Article 32 GDPR set out in Annex B (Article 28(3)(c) GDPR). It may change them provided the level of protection does not decrease,
3. looks into the Controller's data only to the extent necessary, in particular when handling a support request, a bug report or a security incident,
4. does not use the data for its own purposes. The exception is anonymised and aggregated statistics from which neither the Controller nor any natural person can be identified,
5. keeps records of the categories of processing activities carried out on behalf of the Controller (Article 30(2) GDPR),
6. cooperates with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) (Article 31 GDPR).

Article 5 – Sub-processors

5.1 The Controller gives the Processor general written authorisation to engage sub-processors (Article 28(2) GDPR). The list of sub-processors as at the effective date of this agreement is in Annex A and the Controller agrees to them.

5.2 The Processor imposes on each sub-processor by contract the same data protection obligations as it has under this agreement. This includes, in particular, the obligation to implement appropriate technical and organisational measures (Article 28(4) GDPR). If a sub-processor fails to fulfil its obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor's obligations (Article 28(4), last sentence, GDPR).

5.3 The Processor informs the Controller of any intended addition or replacement of a sub-processor by e-mail to the Account Administrator's address at least 14 days in advance. The current list is always in Annex A at efakturia.sk/spracuvanie-udajov.

5.4 The Controller may object to the change within 14 days of the notice, by e-mail to gdpr@efakturia.sk and on reasonable grounds relating to data protection. The parties will try to find a solution. If they do not find one, the Controller may terminate the agreement on the provision of the Service with immediate effect and the unused topped-up credit will be refunded under Article 7.9 of the T&C.

5.5 Sometimes a sub-processor has to be replaced immediately, for example because of its failure, a security incident or the removal of the certified provider from the register under Section 76a(11) of the VAT Act. In that case the Processor informs the Controller without undue delay after the change. The right under Article 5.4 is not affected.

5.6 The following are not considered sub-processors:

1. recipients' delivery service providers (other access points of the Peppol network) to which the document is delivered on the Controller's instruction. The Controller determines them by choosing the addressee,
2. the Financial Directorate of the Slovak Republic (Finančné riaditeľstvo SR), which receives data by law as an independent controller,
3. the certified provider of the delivery service and Enable Banking Oy to the extent that they fulfil their own legal obligations (Section 76a(2) of the VAT Act, or the obligations of a licensed payment service provider, respectively). To that extent they are independent controllers.

Article 6 – Transfers to third countries

6.1 The Processor and its sub-processors listed in Annex A process data exclusively in the European Union.

6.2 If the Controller sends a document to a recipient whose delivery service provider operates outside the European Economic Area, the transfer takes place on the Controller's instruction. The Controller is responsible for the compliance of such a transfer with Chapter V GDPR.

6.3 The Processor will carry out any other transfer outside the EEA only after giving notice under Article 5.3 and with safeguards under Articles 44 to 46 GDPR in place.

Article 7 – Personal data breach

7.1 The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it (Article 33(2) GDPR), within 48 hours at the latest. It sends the notification by e-mail to the Account Administrator's address.

7.2 The notification contains, insofar as this information is known (Article 33(3) GDPR):

1. the nature of the breach, the categories and approximate number of data subjects and records concerned,
2. contact details,
3. the likely consequences,
4. the measures taken or proposed to remedy the breach and mitigate its consequences.

Information not yet known will be provided by the Processor in phases without further undue delay.

7.3 Notifying the breach to the Office for Personal Data Protection of the Slovak Republic within 72 hours (Article 33(1) GDPR) and to data subjects (Article 34 GDPR) is the obligation of the Controller. The Processor assists the Controller in doing so.

7.4 If a breach affects several Controllers, the Processor may inform them collectively. Each receives the information relating to its Account.

Article 8 – Assistance with data subjects' rights and the Controller's obligations

8.1 The Processor forwards to the Controller within 5 working days any request from a data subject concerning the Controller's data. It does not respond to the substance of the request itself; it only tells the data subject to whom the request was forwarded.

8.2 The Controller can handle most data subjects' rights itself directly in the Service: view, correct, export or delete a contact or a document. Where this is not possible, the Processor provides reasonable technical assistance (Article 28(3)(e) GDPR).

8.3 The Processor also assists the Controller in fulfilling its obligations under Articles 32 to 36 GDPR, i.e. with security, breach notification, impact assessment and prior consultation. In doing so, it takes into account the nature of the processing and the information available to it (Article 28(3)(f) GDPR).

8.4 Assistance under this article is free of charge. If a request is manifestly unreasonable or repetitive, the Processor may, after prior notice, ask for reasonable reimbursement of costs. Assistance with a data breach caused by the Processor is always free of charge.

Article 9 – Demonstrating compliance and audit

9.1 On request, the Processor provides the Controller with the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular a current description of the technical and organisational measures and the list of sub-processors (Article 28(3)(h) GDPR).

9.2 If this information is not sufficient, the Controller may carry out an audit itself or through an auditor who is bound by confidentiality and is not a competitor of the Processor. Audit conditions:

1. notice at least 30 days in advance,
2. at most once every 12 months, except for an audit following a data breach or at the request of a supervisory authority,
3. the audit must not compromise security or the data of other customers,
4. the Controller bears the costs of the audit.

Article 10 – End of processing: return and erasure

10.1 Return of personal data (Article 28(3)(g) GDPR) is provided by export. At any time during the term of the agreement, the Controller can export all documents and data: ZIP and CSV export, the package for the accountant and individual documents in PDF, UBL 2.1 and ISDOC. After the Account is closed, the export is not available. The Controller therefore makes the export before closing the Account, and the Service reminds it to do so (Article 12.4 of the T&C).

10.2 Within 30 days of the end of the agreement, the Processor erases the Controller's personal data. Copies in backups expire at the latest after a further 14 days as part of the automatic backup cycle. Until then, backups are used only for disaster recovery.

10.3 The Controller's documents are not accounting documents of the Processor and the Processor does not keep them after the agreement ends. Archiving them is the Controller's obligation (Section 35 of Act No. 431/2002 Coll. on Accounting, Section 85o(15) of the VAT Act).

10.4 On request, the Processor confirms the erasure by e-mail.

Article 11 – Liability

11.1 Liability towards data subjects is governed by Article 82 GDPR. The Processor is liable for damage caused by processing only where it:

• has not complied with obligations of the GDPR specifically directed to processors, or
• has acted outside or contrary to the lawful instructions of the Controller (Article 82(2) GDPR).

11.2 As between the parties, Article 11 of the T&C applies. However, it does not limit the claims of data subjects or the rights of the parties under Article 82(4) and (5) GDPR.

Article 12 – Obligations of the Controller

The Controller:

1. is responsible for having a legal basis under Article 6 GDPR for the processing of the personal data it enters into the Service, and for having informed the data subjects under Articles 13 and 14 GDPR,
2. gives only instructions that comply with the law,
3. is responsible for the correctness of the addresses and recipients it enters (customer, accountant, webhook, shared link),
4. notifies the Processor without undue delay of any data breach in connection with the Service that it discovers (e.g. a leak of a User's password).

Article 13 – Final provisions

13.1 This agreement lasts for as long as the agreement on the provision of the Service lasts and for as long as the Processor processes the Controller's data (Article 10).

13.2 Changes to this agreement are made under the procedure in Article 15 of the T&C; changes to the list of sub-processors under the procedure in Articles 5.3 and 5.4. A change to Annex B that does not lower the level of protection does not require notice.

13.3 This agreement is governed by the GDPR, Act No. 18/2018 Coll. on Personal Data Protection and other laws of the Slovak Republic. If any of its provisions conflicts with the GDPR, the GDPR applies.

Annex A – List of sub-processors

As at 10 October 2026:

Annex B – Technical and organisational measures (Article 32 GDPR)

B.1 Encryption

• All communication with the Service (web, API, webhooks to HTTPS addresses) takes place over TLS (HTTPS).
• Users' passwords are stored only as a hash (bcrypt).
• Encryption keys and access passwords to the systems are stored outside the database and outside the backups.
• Backups are transferred to the backup server through an encrypted VPN tunnel (WireGuard).
• Webhooks are signed with HMAC-SHA256 (the "X-Webhook-Signature" header in the form "sha256=…"). The secret is shown to the Controller only when the webhook is created.

B.2 Access control

• Sign-in with a password, optionally also two-factor authentication (2FA) and passkeys (WebAuthn).
• Team roles (Administrator, Invoicer, Read only) limit what a User can see and do in the Account. API keys, webhooks and the settings for the accountant are managed only by the Administrator.
• API keys are bound to the Account and can be revoked. The limit is 10,000 requests per calendar month per key; above it, the API rejects requests.
• Administration of the Service is accessible only through a single administrator account of the Processor's managing director.
• Administration of the mail and backup server is available only through a VPN (WireGuard).
• Backup files have access permissions for the owner only.
• The Controller can revoke a shared link to a document at any time and it stops working immediately.

B.3 Data separation

• The data of individual Controllers is logically separated in the Service by Account.

B.4 Availability, backups and recovery

• The entire database is backed up daily (at 3:30), including invoice attachments stored in the database.
• Backups are kept for 14 days on the production server (Contabo, France) and a copy of them on the Processor's server on the infrastructure of Hetzner Online GmbH (Germany). After 14 days they are deleted automatically.

B.5 Records

• Operational and access records (logs) are kept for 12 months.

B.6 Application security

• Protection against CSRF attacks, server-side input validation and regular security updates.

B.7 Organisational measures

• Only the Processor's managing director, who is bound by confidentiality, has access to personal data.
• Security incidents are handled and notified under the procedure in Article 7.
• The Processor keeps records of processing activities under Article 30(2) GDPR.
• Agreements under Article 28(4) GDPR are concluded with sub-processors.

B.8 Erasure

• Export before the Account is closed (not available after closure), then erasure within 30 days of the end of the agreement and expiry in backups within a further 14 days.