Data processing agreement (DPA)

This is an English convenience translation. In case of any discrepancy, the Slovak version is binding.

This Data Processing Agreement (hereinafter the "DPA") forms an integral part of the Terms of Service of the eFaktúra service and governs the processing of personal data under Art. 28 of Regulation (EU) 2016/679 (GDPR), in which the customer acts as controller and eFaktura s. r. o. acts as processor.

1. Contracting parties and subject matter

Processor: eFaktura s. r. o., Klčové 94/19, 915 01 Nové Mesto nad Váhom, Slovak Republic, Company ID (IČO) 57 465 738, Tax ID (DIČ) 2122749607, VAT ID (IČ DPH) SK2122749607, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert No. 57413/R, e-mail info@efaktura.sk (hereinafter the "Provider").

Controller: the customer – an entrepreneur who uses the eFaktúra service under the Terms of Service (hereinafter the "Customer" and the "Terms of Service").

When using the service, the Customer inputs data into the platform that may contain personal data of third parties (in particular its customers, suppliers, employees and business contacts). With respect to such data, the Customer is the controller and the Provider processes it on the Customer's behalf as processor. This DPA is concluded by acceptance of the Terms of Service and lasts for the entire duration of the agreement on the use of the service.

The processing of personal data of the service's own users (accounts, billing for the service, support), in which the Provider is the controller, is governed by the Privacy Policy, not by this DPA.

2. Nature, purpose and duration of processing

Subject matter of processing: personal data contained in data that the Customer inputs into the service or that the service receives on the Customer's behalf (documents, contacts, files, bank transactions, e-mails, electronic invoices).
Nature of processing: storage, structuring, display, extraction of data from documents (OCR), generation of documents and PDFs, sending and receiving of documents (e-mail, the Peppol network), payment matching, backup, export and deletion.
Purpose of processing: provision of the eFaktúra service to the extent set out in the Terms of Service and the configuration chosen by the Customer.
Duration of processing: for the duration of the agreement under the Terms of Service and thereafter for the periods set out in Article 10 of this DPA.

3. Categories of data subjects and types of data

Categories of data subjects:

the Customer's customers and suppliers and their contact persons,
the Customer's employees and collaborators (e.g. team members, persons on travel orders, persons listed in company documents),
recipients of documents and price quotations,
payers and counterparties of bank transactions,
other individuals whose data the Customer inputs into the service.

Types of personal data:

identification and contact data (name, address, e-mail, phone, position),
business identifiers of individual entrepreneurs (Company ID, Tax ID, VAT ID),
billing and payment data (IBAN account numbers, variable symbols, amounts, subject matter of performance),
data from bank statements and transactions (counterparties, payment descriptions, masked card numbers),
content of documents and their attachments, including OCR extracts,
other data that the Customer inputs into the service.

The service is not intended for the processing of special categories of personal data (Art. 9 GDPR). The Customer undertakes not to input such data into the service, or does so solely at its own risk.

4. Controller's instructions

The Provider processes personal data only on the basis of the Customer's documented instructions. Documented instructions are deemed to include the Terms of Service, this DPA, the service configuration, and actions taken by the Customer and its users in the application and via the API (e.g. sending a document, activating an integration, requesting an export or deletion). The Provider shall promptly inform the Customer if it considers that an instruction infringes the GDPR or other legal provisions. If EU or Member State law requires processing beyond the instructions, the Provider shall inform the Customer of that requirement, unless that law prohibits doing so.

5. Confidentiality

The Provider ensures that all persons authorised to process personal data (the Provider's employees and collaborators) are bound by confidentiality, including after the end of their engagement. Access to production data is governed by the principle of least privilege and is logged.

6. Security of processing

The Provider has adopted and maintains technical and organisational measures under Art. 32 GDPR appropriate to the risk of processing. A current overview of these measures forms Annex 1 to this DPA. The Provider may continuously update and improve the measures, provided their level of protection does not decrease.

7. Sub-processors

The Customer grants the Provider general written authorisation to engage sub-processors.
The current, complete list of sub-processors, including the purpose and country of processing, is published in Article 5 of the Privacy Policy and forms part of this DPA.
The Provider shall inform the Customer of any intended addition or replacement of a sub-processor at least 14 days in advance (by updating the list and by a notice in the application or by e-mail). The Customer may object on legitimate grounds; if the objection cannot be accommodated technically or organisationally, the Customer may terminate the agreement under the Terms of Service.
The Provider imposes on each sub-processor, by contract, the same data protection obligations as arise from this DPA, and is liable to the Customer for the performance of the sub-processors' obligations.
Entities to which data is transferred at the Customer's instruction as independent controllers in their own right (e.g. the Customer's bank, the recipient of an e-invoice and the operator of its access point in the Peppol network, the Financial Administration of the Slovak Republic, an e-shop or other integration activated by the Customer) are not considered sub-processors.

8. Assistance to the controller and data subject requests

The Provider assists the Customer in fulfilling its obligations under Art. 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.
The service includes tools with which the Customer can independently handle most data subject requests (searching, correction, export and deletion of records). If a data subject addresses a request directly to the Provider, the Provider shall forward it to the Customer without undue delay and shall not respond to it on the merits without the Customer's instruction.

9. Notification of personal data breaches

The Provider shall notify the Customer of a personal data breach concerning data processed under this DPA without undue delay after becoming aware of it, to the e-mail addresses of the owners and administrators of the Customer's organisation. The notification shall contain at least the information required under Art. 33(3) GDPR (the nature of the breach, likely consequences, measures taken and proposed, and a contact point); information may be provided in phases as the investigation progresses.

10. Deletion and return of data after termination

The Customer may export its data at any time directly in the application (CSV, PDF, ISDOC, complete archive). Upon a request to delete an organisation, a complete export of documents is automatically generated so that the Customer can fulfil its own record-keeping obligations.
After termination of the agreement, or after expiry of the 30-day protective period following a deletion request, the Provider shall delete all personal data processed under this DPA. The Provider does not retain an archive of the Customer's documents for the purpose of fulfilling the Customer's own record-keeping obligation as an accounting entity — the Customer fulfils that obligation from the export referred to in the preceding item.
The only exception is retention required by EU or Slovak Republic law, and solely to the following extent and for the following periods: (a) documents that the Provider itself is required to archive as an accounting entity (in particular invoices issued to the Customer for the service) — 10 years under Section 35 of Act No. 431/2002 Coll. and Section 76 of Act No. 222/2004 Coll.; (b) security and operational logs — for the period set out in Article 7 of the Privacy Policy (typically 30–90 days); (c) data necessary to assert or defend legal claims — until expiry of the applicable limitation periods (typically no more than 4 years after termination of the agreement); (d) evidence of the sending, receipt, delivery, rejection or non-delivery of documents in the Peppol network — participant and document identifiers, timestamps, delivery status and the hash of the document, without the content of the document — 10 years from the end of the calendar year in which the event occurred. Data retained on this basis is processed by the Provider solely for the stated purpose, remains subject to the confidentiality and security obligations under Articles 5 and 6 of this DPA, and shall be deleted without undue delay upon expiry of the applicable period. None of these exceptions establishes indefinite retention.
Data contained in backups is deleted through their natural rotation: point-in-time recovery and daily backups within 7 days, weekly snapshots and the backup copy of documents within 30 days, monthly recovery points no later than 3 months; until deleted, backups are not used for any purpose other than disaster recovery.

11. Transfers to third countries

Processing takes place primarily within the European Economic Area (both the database and the document storage). If a sub-processor processes data in a third country, the transfer is based on an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses under Commission Implementing Decision 2021/914, together with supplementary measures. Details, including the reservation regarding the Gemini API fallback interface for AI features, are set out in Article 6 of the Privacy Policy.

12. Audit

The Provider shall make available to the Customer the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR – primarily in the form of this DPA, the description of measures in Annex 1, the list of sub-processors, and responses to the Customer's written questions.
If this information is reasonably insufficient, the Provider shall allow the Customer (or an auditor mandated by the Customer and bound by confidentiality) to carry out an audit, no more than once every 12 months, during normal business hours, upon written notice of at least 30 days in advance, and in a manner that does not compromise the security of other customers' data. The Customer bears the cost of the audit.

13. Liability and final provisions

The liability of the parties is governed by the liability for damages provision of the Terms of Service; this is without prejudice to the mandatory provisions of Art. 82 GDPR.
The Customer is responsible for the lawfulness of the personal data processing carried out through data it inputs into the service — in particular for the existence of a legal basis and compliance with the information obligation towards data subjects.
This DPA is governed by the law of the Slovak Republic; the courts of the Slovak Republic have jurisdiction to resolve disputes. The binding language is Slovak; any translations are for information purposes only.
Amendments to this DPA follow the amendment mechanism of the Terms of Service. The current version is always available at efaktura.sk/dpa; previous versions will be provided by the Provider on request at info@efaktura.sk.
Document version: 2026-10-17-v2. This DPA takes effect on 17 October 2026 and replaces the version effective from 6 July 2026.

Annex 1 – Technical and Organisational Measures (TOMs)

Encryption in transit: TLS for all communication between clients, applications and the API; security headers (CSP, HSTS).
Encryption at rest: encrypted database (EU, Frankfurt) and encrypted object storage for documents; banking access tokens and two-factor authentication secrets additionally encrypted at the application level.
Tenant isolation: every request is bound to a specific organisation; data separation is also enforced at the database level using Row-Level Security (fail-closed – no rows are returned without an organisation context).
Access control: role-based access model within the Customer's organisations (6 role levels); principle of least privilege for the Provider's team; mandatory two-factor authentication for the Provider's administrative team; audit logs of administrative and significant actions, including IP address.
User authentication: passwords stored exclusively as scrypt hashes; optional TOTP two-factor authentication; time-limited sessions.
Protection against misuse: rate limiting (by IP and e-mail hash), anti-bot protection of critical forms (Cloudflare Turnstile), masking of sensitive data in logs and diagnostics.
Document storage: private buckets with no public access; access solely via short-lived signed links; a separate public bucket used only for logos and branding.
Business continuity: regular automated backups with rotation under Article 10 (no longer than 3 months), a disaster recovery plan, availability and error monitoring.
Development and operations: separated production and testing environments, code review, change tracking and management, an incident response process with breach notification without undue delay.
Personnel: contractual confidentiality obligations for all persons with access to data, data protection training.