Data Processing Agreement

Effective 12 September 2026

This Data Processing Agreement ("DPA") forms part of the EUFactura Terms of Service between Zarnitech Capital SL ("Processor", "EUFactura") and the organization using the Service ("Controller", "you"). It reflects Article 28 GDPR and applies automatically to every EUFactura account, without a separately signed copy, so that every customer — not only those who ask — has these protections in place from day one. If your organization requires a separately countersigned version (for example, for your own vendor-management process), contact us at the address in §10 and we will arrange it.

This is a real, complete agreement prepared to reflect the Service as built today. It has not been reviewed by an external lawyer; we recommend professional legal review before relying on it for a specific regulatory situation.

1. Subject matter and duration

EUFactura processes personal data on your behalf, and on your documented instructions, for the purpose of providing the Service described in the Terms — specifically, the personal data contained in the customers, contacts, invoices, quotes, and credit notes you create in EUFactura. This DPA applies for as long as EUFactura processes that data on your behalf, including the retention period described in §7.

2. Nature and purpose of processing

Storage, retrieval, structuring, and transmission (e.g. by email or a secure link) of the personal data described in §3, carried out automatically as part of operating the invoicing and quoting functionality of the Service — not for any independent purpose of EUFactura's own.

3. Categories of data subjects and personal data

• Data subjects: your customers and their contacts, your suppliers where you record them, and — incidentally — your own users to the extent their names appear as the issuer of a document.
• Categories of data: name, business or personal address, email address, phone number (if entered), tax/VAT identification number, and the invoice, quote, or credit note content itself (line items, amounts, notes). No special categories of data under Article 9 GDPR are intentionally processed.

4. EUFactura's obligations as processor

EUFactura will:

• Process personal data only on your documented instructions (including as set out in the Terms), unless required to do otherwise by EU or member state law, in which case we will inform you before processing, unless the law prohibits this;
• Ensure that persons authorized to process the data are bound by confidentiality;
• Implement appropriate technical and organizational measures under Article 32 GDPR, including access controls, row-level tenant isolation in our database, and encryption of data in transit;
• Not engage another processor (sub-processor) without your general authorization, as set out in §5;
• Assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their GDPR rights;
• Assist you with your obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the information available to us;
• Notify you without undue delay after becoming aware of a personal data breach affecting your data;
• At your choice, delete or return all personal data at the end of the provision of the Service, and delete existing copies, subject to §7;
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and subject to reasonable confidentiality and scheduling constraints.

5. Sub-processors

You give EUFactura general written authorization to engage the sub-processors listed on our Subprocessors page, which forms part of this DPA. We impose data protection terms on each sub-processor that are no less protective than this DPA. We will update that page when we add or replace a sub-processor and, for a new sub-processor with access to your personal data, give you at least 14 days' notice (by email to your organization's owner or an in-app notice) so you can object on reasonable data-protection grounds; if we cannot resolve your objection, either party may treat this as a material breach entitling you to terminate the affected part of the Service.

6. International transfers

Where a sub-processor processes personal data outside the EU/EEA, we ensure the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses (or another valid Chapter V GDPR transfer mechanism), as detailed for each provider on the Subprocessors page.

7. Deletion and retention

On termination of your account, we will make your data available for export for a reasonable period and then delete it, except for issued invoices, credit notes, and related records that we are legally required to retain under applicable commercial and tax law (see our Privacy Policy, §8) — this reflects the fact that, once issued, invoice records are your own legal accounting records as much as ours to safeguard, and EUFactura's own architecture treats issued invoices as immutable.

8. Your obligations as controller

You are responsible for the accuracy of personal data you enter into EUFactura, for having a lawful basis to process it (including any data about your own customers), for responding to data subject requests you receive directly, and for your own compliance with GDPR as the controller of that data.

9. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the Terms of Service.

10. Contact

Data protection questions, breach notifications, or requests relating to this DPA can be sent to hello@eufactura.eu.