Data Processing Agreement (DPA)

Concluded pursuant to Art. 28(3) of Regulation (EU) 2016/679 (GDPR). Effective: 21 September 2026

English convenience translation — the Czech original (Smlouva o
zpracování osobních údajů) prevails in case of any discrepancy.

Parties

Controller: the user of the Invico service — a natural or legal person who, within their business activity, enters into the service the personal data of their customers, suppliers and other persons (the "controller").

Processor: the operator of the Invico service — Tomáš Dvořák, registered office Kostelany nad Moravou 108, 686 01, Czech Republic, Registration No. (IČO) 24330621, registered in the Trade Licensing Register (sole trader) (the "processor").

The agreement is concluded by accepting the Terms of Service during account registration and applies for the life of the account unless the parties agree otherwise.

1. Subject matter and scope

1.1. The processor processes for the controller the personal data entered by the controller into the service — in particular data contained in documents, contacts, expenses and attachments (the "data").

1.2. Nature of processing: storage, organisation, display, export, transfer (e-mail, public link, API, webhooks — per the controller's instructions), backup, deletion.

1.3. Purpose: providing the invoicing and record-keeping service under the Terms of Service.

1.4. Duration: for the life of the account. After the account ends, the processor deletes the data or returns it to the controller per Art. 2(g) — the duty to archive tax documents after termination belongs solely to the controller; the processor has no independent legal title to retain the data.

1.5. Categories of data subjects: the controller's customers, suppliers and contact persons.

1.6. Categories of data: identification and contact data (name, address, registration/VAT ID, e-mail, phone), business-transaction data (items, prices, payment details), and optionally attachment and note content at the controller's choice.

2. Processor obligations

The processor undertakes to:

a) process data solely on the controller's documented instructions — instructions are given through the service configuration and the controller's actions; the processor will alert the controller if an instruction would in its view breach the GDPR,

b) ensure that persons authorised to process data are bound by confidentiality or a statutory duty,

c) implement technical and organisational measures under Art. 32 GDPR proportionate to the risk — principally transport encryption (TLS), hashing of credentials, tenant data isolation, role-based access control, audit logging, regular backups and restore testing,

d) respect the conditions for sub-processors under Art. 3,

e) reasonably assist the controller in fulfilling obligations towards data subjects (access, rectification, erasure, portability, restriction, objection) — in particular via service functions (export, edit, delete),

f) assist the controller with obligations under Art. 32–36 GDPR (security, breach notification, impact assessment) proportionate to the nature of the processing,

g) at the controller's choice after the contract ends, **delete or return all data** and delete existing copies — the duty to retain tax documents after termination belongs to the controller as the obliged person, not to the processor,

h) make available to the controller the information needed to demonstrate compliance with this agreement and allow audits per Art. 4.

3. Sub-processors

3.1. The controller grants the processor general authorisation to engage the sub-processors listed below. The controller will be informed of list changes by e-mail reasonably in advance and may object; on non-acceptance the controller may terminate the agreement.

3.2. Current list of sub-processors:

Document e-mail sent via the SMTP server configured by the controller travels through infrastructure chosen by the controller — it is not a sub-processor of the processor, but part of the controller's instructions.

3.3. The processor ensures sub-processors are bound by obligations matching this agreement; the processor is liable to the controller for their performance.

4. Security breaches and audits

4.1. The processor will notify the controller of a personal-data security breach without undue delay, no later than 48 hours after discovery, to the account e-mail, with reasonable information on its nature, scope and remedial measures.

4.2. Audits are carried out by the controller or an auditor appointed by them, at the earliest after notice delivered typically 30 days in advance, and to a reasonable extent (typically by questionnaire or by submission of certifications and operational documentation; a physical audit only in justified cases and under conditions protecting trade secrets and other users' data). Audit costs are borne by the controller unless the audit proves a material breach of this agreement.

5. Controller obligations

5.1. The controller is responsible for the lawfulness of obtaining the data, for fulfilling information duties towards data subjects, and for ensuring the content entered into the service corresponds to the purpose of processing.

5.2. The controller decides the service configuration (who gets access, what is published by link, what is sent by e-mail or API) — these choices are processing instructions.

6. Final provisions

6.1. This agreement is governed by Czech law. Differences between this agreement and the Terms of Service on data processing are resolved in favour of this agreement.

6.2. The agreement ends when the account ends; obligations under Art. 2(g) survive until the data is deleted/returned. Version legal-v2.