Data Processing Agreement

Parties

1. Subject matter

This Agreement governs the parties’ rights and obligations concerning the processing of personal data by the Processor on behalf of the Controller in connection with the Zettl platform services.

The Processor processes personal data solely on documented instructions from the Controller, including with regard to transfers to third countries (Section 6).

2. Subject matter and duration of processing

• Subject matter: provision of SaaS services for invoicing, receipt management, bank synchronisation, budgeting, AI document processing, client management, and team access.
• Duration: for the duration of the contract for the Service and then for the data retention period under Article 10 of the Terms of Service (12 months in read-only mode after the subscription ends; at most 30 days after account deletion, and from backups within a further 30 days). Files no longer linked to any record are removed within 30 days of the Controller's request sent to info@idex-corp.com.
• Nature of processing: automated and manual processing, storage, encryption, backup, and deletion.

3. Categories of data subjects and personal data

3.1 Categories of data subjects

• Platform users (employees, sole traders, members of the Controller’s organisation)
• Controller’s clients (contact persons of companies in the client database)

3.2 Categories of personal data

• Identification data (name, email, company name, company ID, VAT ID)
• Contact data (address, phone)
• Financial data (transactions, invoices, receipts, budgets)
• Technical data (IP addresses, user agent)
• Credentials for external services (encrypted tokens)

4. Processor obligations

The Processor undertakes to:

• Process personal data only on documented instructions from the Controller
• Ensure that persons authorised to process personal data are bound by confidentiality
• Implement all technical and organisational measures required under Art. 32 GDPR:
  • AES-GCM field-level encryption (PBKDF2 key derivation)
  • HTTPS/TLS in transit
  • PostgreSQL Row Level Security
  • CAPTCHA on sign-in and rate limiting
  • daily encrypted backups kept for 30 days
  • full audit logging
• Not engage another processor without prior written consent of the Controller (general consent is granted for subprocessors listed in clause 5)
• Assist the Controller in fulfilling obligations towards data subjects (rights under Arts. 15–22 GDPR)
• After processing ends, delete the personal data in the database and the document and logo files the Service holds for the Controller, or return them to the Controller (at the Controller’s choice); remove files no longer linked to any record (for example of documents deleted earlier) within 30 days of the Controller's request sent to info@idex-corp.com
• Provide the Controller with all information necessary to demonstrate compliance with Art. 28 GDPR and permit audits

5. Sub-processors

The Controller grants general authorisation to engage the following sub-processors:

The Controller will be informed by email of intended changes to sub-processors at least 14 days in advance. The Controller may object within 14 days of notification.

6. Transfers outside the EU

The database and uploaded files are stored in the EU (Ireland), error reports in the EU (Germany). Sub-processors marked “EU/USA” or “USA” in Section 5, and US-based sub-processors even where data is stored in the EU, may, however, transfer personal data to third countries outside the European Economic Area. The Controller instructs the Processor to make these transfers.

The Processor bases these transfers on the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified recipients and otherwise on standard contractual clauses (Art. 46 GDPR).

7. Security breach notification

The Processor will notify the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware.

The notification will include:

• A description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences and measures taken

8. Audit

Upon request, the Processor will provide the Controller with all information necessary to demonstrate compliance with obligations under Art. 28 GDPR.

The Controller or an auditor appointed by the Controller may conduct an audit provided the Processor is informed at least 30 days in advance and the audit does not unreasonably disrupt the Processor’s operations.

9. Term and termination

This Agreement remains in effect for as long as the Processor processes personal data for the Controller, i.e. for the duration of the contract for the Service and the data retention period under Article 10 of the Terms of Service.

When processing ends, the Processor deletes the personal data within the periods under Article 10 of the Terms of Service, unless the law requires longer retention. The Controller may export the data at any time before then.

10. Governing law

This Agreement is governed by the laws of the Czech Republic and the GDPR. Disputes shall be resolved by the competent courts in Prague.

11. Final provisions

This Agreement forms an integral part of the Zettl Terms of Service.

In case of conflict between this Agreement and the Terms of Service, this Agreement prevails on matters of personal data protection. This version applies to contracts concluded after its publication on 23 October 2026 from their conclusion, and to earlier contracts from 15 November 2026; until then the Data Processing Agreement effective from 21 March 2026 applies to them.