Data Processing Addendum

Scope and roles

This addendum forms part of the Factelo terms between the user as controller and EduWell s.r.o. as processor where Factelo processes customers’, contacts’ or other persons’ personal data on the user’s behalf.

The user is responsible for lawful instructions, legal basis, transparency and handling data-subject rights. Factelo processes data only on documented instructions contained in the terms, service settings and legitimate user requests.

Processing details

• Subject matter: hosting and operation of an online invoicing service.
• Duration: for the account term and a limited period afterwards for deletion, legal duties or claims.
• Nature: storage, organisation, retrieval, modification, document generation, transmission, backup and deletion.
• Purpose: providing the Factelo features selected by the user.
• Data subjects: customers, suppliers, contact persons, employees and others entered by the user.
• Data: identity, contact, business, tax and payment details, invoice content, communications and technical metadata. Special-category data are not intended for processing.

Factelo obligations

• Process data only on documented lawful instructions and flag an instruction that clearly infringes applicable law.
• Ensure authorised persons are bound by confidentiality and apply appropriate technical and organisational measures.
• Reasonably assist with data-subject rights, security, incident reporting, impact assessments and consultations.
• At the end of the service, delete or return data at the controller’s choice unless law requires continued storage.
• Provide information needed to demonstrate compliance and permit a reasonable audit no more than annually unless triggered by an incident or authority.

Security measures

• TLS in transit, managed encryption for databases and files, non-public storage and restricted access roles.
• Authentication through Amazon Cognito, short-lived access tokens and HttpOnly/Secure cookies.
• Logical workspace separation, API authorisation and regular dependency updates.
• Incident-response procedures and ongoing review of measures according to risk.

Subprocessors

The user gives general authorisation for the providers below. Factelo will bind them to appropriate obligations, remains responsible as required by law and will publish material changes to this list. The user may object on reasonable data-protection grounds.

• Amazon Web Services EMEA SARL / AWS — authentication, compute, database, files and email; primary region Frankfurt, Germany.
• Vercel Inc. — web hosting, server functions, network and logs; processing may occur in the US and other locations under Vercel’s contractual safeguards.
• Geoapify — address geocoding, only if this optional feature is enabled and used.

Transfers outside the EEA

Where processing requires a transfer outside the EEA to a country without an adequacy decision, Factelo or the relevant subprocessor will use a valid mechanism, in particular the European Commission’s Standard Contractual Clauses, and supplementary measures where needed.

Security incidents

After becoming aware of an incident affecting data processed for the user, Factelo will notify the user without undue delay and provide available information needed for assessment and reporting duties. Notification is not an admission of liability.

Precedence and contact

For personal-data processing matters, this DPA prevails over the general terms. The Factelo terms govern all other matters. Send DPA requests to the stated contact.