Data Processing Agreement

Version v5-2026-10 · Effective from: 27 Oct 2026 · Document for signature

This is an English translation for convenience. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails. Česká verze

concluded under Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”)

The parties

Controller

hereinafter the “controller”

Processor

hereinafter the “processor”. The processor is a natural person carrying on business, is not entered in the Commercial Register, and the processor’s registered office is also the address of the processor’s residence.

1. Introductory provisions

1. The parties have concluded a contract for the provision of the Evikom service — an operating system for keeping records of stock, consumption write-offs and orders, for managing company finances including the payroll list, for recording bank transactions and for sending company mail (hereinafter the “main contract” and the “service”). The scope of the parts switched on for a particular controller is determined by the order.
2. In performing the main contract, the processor processes personal data of which the controller is the controller. This agreement governs the conditions of such processing and is an integral part of the main contract.
3. If this agreement conflicts with the main contract in matters of personal data protection, this agreement prevails.
4. The controller is responsible for having a legal basis for the processing and for having fulfilled its information duty towards data subjects. The processor neither determines nor assesses the legal basis.

2. Subject matter, nature and purpose of the processing

1. The subject matter of the processing is the operation of the service for the controller — that is, storing and making available the data that the controller and its people enter into the service, and displaying it in overviews. If hosting of the controller’s website or e-shop has been ordered under Article 10 of the main contract, the subject matter also includes the operation of that website — that is, receiving and storing the data entered into it by its visitors and customers, in particular orders, delivery addresses and messages sent from forms. If an AI automation has been ordered under Article 10 of the main contract, the subject matter also includes processing of data in that automation — that is, reading and processing documents, messages and other materials that the controller lets into the automation, and passing them to another processor under Annex 3.
2. The nature of the processing is in particular the collection, storage, organisation, consultation, rectification, erasure and backup of data, carried out automatically on the processor’s servers.
3. The purpose of the processing is exclusively the provision of the service under the main contract — records of stock and its movements, compiling orders, managing the access of individual persons, keeping a log of activity in the system, keeping the company’s income and expenses including records of people on the payroll list and wages paid, recording and matching movements on the controller’s bank account, and preparing and sending mail on behalf of the controller; if hosting of the controller’s website or e-shop has been ordered, also the operation of that website including receiving orders and making them available to the controller; if an AI automation has been ordered, also processing of data in it (for example reading an invoice from an e-mail, preparing a reply or an overview), only within the scope that the controller lets into the automation.
4. The processor must not process the data for any purpose of its own, in particular must not use it for its own analyses, statistics, comparisons across customers, marketing or for training machine-learning models.
5. If an AI automation has been ordered, the processor sets it up so that people who communicate directly with artificial intelligence are informed at the start that they are communicating with artificial intelligence (Article 50(1) of Regulation (EU) 2024/1689). The controller does not remove or suppress this notice.
6. A detailed description of the processing is in Annex 1.

3. Duration of the processing

The processor processes personal data for the duration of the main contract and thereafter for the time necessary to fulfil the obligations under Article 13 of this agreement. This agreement terminates together with the main contract; the provisions on confidentiality and on the handling of data after termination continue to apply thereafter.

4. Categories of data subjects and of personal data

The definition is in Annex 1. The controller acknowledges that it partly determines the scope of the data itself, by the accounts it sets up and by what its people write into the free-text fields.

5. Instructions of the controller

1. The processor processes personal data only on documented instructions of the controller. The conclusion of the main contract and of this agreement, the specification of the scope of the service set-up, and an instruction sent by e-mail from the controller’s contact address are also regarded as documented instructions.
2. The processor will immediately inform the controller if it considers that an instruction infringes the GDPR or other data protection regulations. Until the matter is clarified, it may postpone carrying out such an instruction.
3. If European Union or Member State law requires the processor to process, it will inform the controller of that before the processing, unless that law prohibits this on important grounds of public interest.

6. Obligations of the processor

The processor undertakes to:

• process the data only within the scope and for the purpose under this agreement;
• ensure that persons authorised to process the data are bound by confidentiality (Article 7);
• adopt and maintain measures under Article 32 GDPR (Article 8 and Annex 2);
• engage other processors only under the conditions of Article 9;
• assist the controller in responding to requests from data subjects (Article 10);
• assist the controller in fulfilling obligations under Articles 32 to 36 GDPR (Article 11);
• handle the data after termination as instructed by the controller (Article 13);
• provide the controller with the information necessary to demonstrate compliance with these obligations and allow audits (Article 14);
• keep records of categories of processing activities under Article 30(2) GDPR;
• immediately inform the controller if it receives from a public authority a request for disclosure of the controller’s data, unless the law prohibits this.

7. Confidentiality

1. The processor will bind to confidentiality all persons who gain access to the data, including after their cooperation with the processor ends.
2. Access to the controller’s data is held only by persons who need it for set-up, support or maintenance of the service, and only to the necessary extent.
3. The processor will not make the data available to a third party, with the exception of other processors under Article 9 and cases where a legal regulation so requires.

8. Security of processing

The processor has adopted the technical and organisational measures set out in Annex 2. The measures correspond to the nature, scope and purpose of the processing and to the risks to the rights of data subjects.

The processor may change the measures provided that this does not lower the level of security achieved. It will inform the controller of a material change.

9. Other processors

1. The controller grants the processor a general written authorisation to engage other processors. The current list is in Annex 3 and, in a continuously updated form, at the list of sub-processors.
2. The processor will notify the controller by e-mail of an intended change or addition of another processor at least 30 days in advance.
3. Within that period the controller may raise a reasoned objection to the change. If the objection cannot be resolved within 30 days, the controller may terminate the main contract with effect from the day on which the change is to take effect; no other sanctions arise from this.
4. The processor will impose on each other processor the same obligations as it has itself under this agreement. The processor is fully liable to the controller for the performance of the other processor’s obligations.

10. Assistance with data subjects’ rights

1. If a data subject addresses a request directly to the processor, the processor will not handle it itself — without undue delay, and no later than within 5 working days, it will pass it on to the controller and tell the data subject that it has done so.
2. The processor will assist the controller, by appropriate technical and organisational measures, in handling requests for access, rectification, erasure, restriction of processing and portability, and objections. It will provide assistance within 10 working days of delivery of the controller’s instruction, unless the parties agree otherwise.
3. Assistance in the usual scope is free of charge. If a request requires extraordinary work beyond normal operation, the parties will agree on payment in advance.

11. Assistance under Articles 32 to 36 GDPR

The processor will assist the controller in ensuring the security of processing, in notifying and communicating personal data breaches and in data protection impact assessments, taking into account the nature of the processing and the information available to it. In particular, it will provide a description of the technical and organisational measures and information on the location and flow of data.

12. Personal data breach

1. If the processor discovers a breach of the security of the controller’s personal data, it will report it to the controller without undue delay and no later than within 48 hours of becoming aware of it. It sends the report by e-mail to the controller’s contact address.
2. The report contains, to the extent known at the time: a description of the nature of the breach, the approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact for further information. The processor will supplement missing information gradually as it ascertains it.
3. Notification to the supervisory authority and communication to data subjects is made by the controller, not by the processor. The processor will provide it with all necessary assistance for this.
4. The processor keeps its own record of breaches and on request will make it available to the controller to the extent that it concerns the controller.

13. Handling of data after termination

1. After the provision of the service ends, the processor will, at the controller’s choice, return or delete the data, including existing copies, unless a legal regulation requires it to keep them.
2. The controller will communicate its choice no later than within 30 days of the end of the main contract. If it does not, the processor will delete the data.
3. Return means handover in a machine-readable format (CSV or another common format) within 15 days of the instruction.
4. The processor will carry out deletion from the production database within 30 days of the end of the main contract, or within 15 days of handing over the data under paragraph 3, whichever is later (as in Article 17 of the main contract); on the controller’s express instruction to delete earlier, it will delete within 30 days of the instruction.
5. The data disappears from backups gradually as the backups are overwritten, no later than 30 days after deletion from the production database. During that time the backups are inaccessible for normal operation and are used exclusively for disaster recovery.
6. At the controller’s request, the processor will confirm in writing that deletion has been carried out.

14. Demonstrating compliance and audit

1. At the controller’s request, the processor will provide the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, usually in written form (a description of measures, answers to a questionnaire).
2. If that is not sufficient, the processor will allow an audit or inspection carried out by the controller or by an auditor whom the controller mandates and to whom the processor has no reasoned objection.
3. An audit may be carried out at most once every 12 months, after at least 30 days’ notice, during working hours and in a way that does not disrupt operation. More often only if a security breach has occurred or if a supervisory authority orders the audit.
4. An audit must not endanger other customers’ data. The service runs on shared infrastructure; the processor will therefore make available only the environment and records relating to the controller and may refuse access only where disclosure of other customers’ data would be at risk. The processor protects its trade secrets by the confidentiality of the persons carrying out the audit under paragraph 6, not by refusing access.
5. The costs of the audit are borne by the controller; the costs of the processor’s own assistance, up to one working day per year, are borne by the processor.
6. Persons carrying out the audit must be bound by confidentiality.

15. Transfers to third countries

The processor processes the data in the territory of the European Union and does not transfer it to third countries or international organisations, with two exceptions. First: the provider of the outgoing e-mail service listed in Annex 3 (Google Ireland Limited, Google Workspace) may transfer the data contained in the mail sent outside the European Economic Area, in particular to the USA. The transfer is safeguarded by the European Commission’s adequacy decision under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) and by standard contractual clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021). If the scope of transfers were to change, the procedure is the same as for a change of another processor under Article 9, and the transfer must be safeguarded by one of the tools under Chapter V GDPR. Further exceptions are listed in Annex 3.

The second case is AI automation. If the controller has ordered it, the data the controller lets into it is processed by the provider of the artificial intelligence model named in Annex 3 (Anthropic, PBC), usually in the United States. The transfer is safeguarded by standard contractual clauses (Commission Implementing Decision (EU) 2021/914) contained in the provider’s data processing addendum and by other measures under Chapter V GDPR. Controllers who have not ordered an AI automation have nothing of this kind transferred.

The controller hereby gives a documented instruction for the transfers described in this Article (Article 28(3)(a) GDPR); the processor makes no other transfers unless required to by Union or Member State law (Article 5(3)).

16. Liability

The liability of the parties is governed by the GDPR and the law of the Czech Republic. Claims under this agreement — including a claim for compensation of harm caused by a breach of the GDPR and a claim for compensation of an administrative fine imposed on the controller for breach of an obligation which, under this agreement, rests with the processor — are subject to the limitation of liability under Article 16 of the main contract, but at twice the amount.

The limitation does not apply where a legal regulation does not permit it — in particular to harm caused intentionally or by gross negligence, to harm to the natural rights of a person, and to the processor’s liability towards data subjects under Article 82 GDPR. An administrative fine imposed by a supervisory authority directly on the processor is borne by the processor itself; this limitation does not affect it.

17. Final provisions

1. This agreement is governed by the law of the Czech Republic. It is concluded in the same way as the main contract — by signing the order of which it is an integral part; confirmation of the order by e-mail from the controller’s contact address is sufficient. It takes effect on the day the main contract takes effect. A separate signature of this agreement is made for the avoidance of doubt, but is not a condition of its effectiveness.
2. Amendments require written form; an e-mail from the parties’ contact addresses is also regarded as written form, where the amendment concerns the annexes.
3. Annexes 1, 2 and 3 form an integral part of the agreement.
4. If any provision is invalid, the rest of the agreement is not affected.

Annex 1 — Description of the processing

Categories of data subjects

• The controller’s employees and collaborators to whom the controller has set up access — owner, manager, staff, accountant and other roles according to the set-up.
• The controller’s employees and collaborators on the payroll list — including those who never log in to the system. If the Finance module is switched on, their job position, type of employment, wage and start and end dates are recorded.
• Counterparties of payments — natural persons who paid the controller or whom the controller paid, if their transaction appears in an imported bank statement (counterparty name, counterparty account number, message for the recipient).
• Recipients and senders of mail — persons to whom the controller writes from the system, and persons whose message the controller records in the system.
• Contact persons of the controller’s suppliers and business partners, if the controller enters their data into the records. If the partner is a natural person carrying on business, their identification and contact data are personal data.
• Customers and visitors of the controller’s website or e-shop — only if its hosting has been ordered. They are persons who submit an order or a form on the controller’s website; the scope of the fields to be filled in is determined by the controller’s website.
• Other natural persons whom the controller or its people name in notes on entries, orders, documents and messages. The scope is determined exclusively by the controller.
• Persons in the materials of an AI automation — only if ordered: persons named in documents, e-mails and messages that the controller lets into the automation, including the controller’s customers.

Categories of personal data

Apart from the last IP address of a paired device stated in the table above, IP addresses appear only in the web server’s operating logs, which are kept for 14 days and serve only for operation and security.

The e-shop’s payment gateway, if one is connected to a hosted e-shop, is another processor under Article 9 and will be added to Annex 3 by the procedure under the same Article. The processor does not store payment card data.

Purpose and retention period

• Account and permissions — to enable and restrict access. For as long as the account exists; cancelled on the controller’s instruction.
• Authorship of entries and activity log — traceability of stock movements and changes to settings. For the duration of the main contract.
• Login data — security of access, protection against password guessing. The session ends by logout or no later than after 14 days of inactivity.
• Payroll and employment data — keeping the payroll list and breaking payroll costs down by individual people. For the duration of the main contract; the processor erases a particular person on the controller’s instruction.
• Bank statement data — matching payments with documents and an overview of movements on the controller’s account. For the duration of the main contract.
• Content of mail sent — documenting what was sent to whom on behalf of the controller. For the duration of the main contract.
• AI automation (only if ordered) — processing materials on the controller’s instruction. For the duration of the automation’s operation, at most for the duration of the main contract; at the AI model provider as set out in Annex 3.
• Data from the controller’s website or e-shop — operating the website and passing orders and messages to the controller. For as long as hosting is ordered; afterwards it is handled under Article 13.

The controller’s employees and the log of their activity

Annex 2 — Technical and organisational measures

The following measures are the actual state of the system, not a list of intentions.

Access control

• Passwords and PINs are stored exclusively as a hash created by the scrypt function with a random salt for each record. The initial password or PIN is set when the account is created by the system administrator on the processor’s side and handed to the controller; the processor does not store it in readable form, does not retain it after handover, and it cannot be recovered from the stored hash. The processor changes or resets a password or PIN at the controller’s request.
• The login token is stored in the database only as a SHA-256 hash and is compared in a way that resists timing attacks.
• The login cookie is marked HttpOnly and SameSite=Lax; in operation over HTTPS the Secure flag is added.
• A session ends by logout or after 14 days of inactivity; a tablet session is valid for a shorter time.
• Repeated failed logins temporarily lock the account; the lock time grows with further attempts.
• A tablet is put into operation with a one-time pairing code; it expires after use and the tablet then logs in with a PIN on the paired device.
• Permissions are evaluated on the server according to the account’s role, not according to what the browser sends. The scope of premises is derived from the account, never from a request parameter.

Separation of individual customers’ data

• The data of all customers is in one database, separated by row level security rules enforced by the database, not by the application.
• The rules are switched on in the mode that applies even to the table owner. The application’s database role is not an administrator role and has no authority to bypass the rules.
• If a query lacks the identification of the company, the database returns no row — an error shows up as an empty result, never as disclosure of other people’s data.
• A second layer of rules restricts access by premises, so that a bar tablet does not see the data of another premises.
• This behaviour is verified by an automated test that is run before deployment.

Transmission and storage

• Traffic between the browser and the server is encrypted (HTTPS).
• The database is not accessible from the internet.
• The servers are located in a data centre in the European Union; physical security is provided by its operator (Annex 3).
• From the start of operating the service for the controller, the processor backs up the database daily, stores the backups encrypted outside the production server and keeps them for 30 days; they serve exclusively for disaster recovery. This is an undertaking of the processor from the start of operation, not a description of the state before that moment.

Organisational measures

• Access to the controller’s data is held only by a narrow circle of persons on the processor’s side, bound by confidentiality, and only to the extent necessary for set-up, support and maintenance.
• Changes to settings made by the processor are logged.
• The processor keeps records of categories of processing activities under Article 30(2) GDPR. The record is kept in writing, is kept up to date and the processor will provide it to the controller or to a supervisory authority on request.

What is not in place

To keep the list honest: two-factor authentication of login and encryption of individual items inside the database are not in place. The data is protected by access control and by separation at the database level, not by encrypting the content of individual columns. The processor will inform the controller of the introduction of further measures.

Annex 3 — Other processors

The current list, including the date of the last change, is at the list of sub-processors. As of the date this agreement takes effect, the following are engaged:

Cloudflare, Inc. (USA) handles domain name resolution in DNS only mode — traffic goes directly to the server, Cloudflare does not see the content and is not a processor of personal data.

Anthropic, PBC: under the provider’s data processing addendum, data is processed to provide the service and is deleted within 30 days after the contract with the provider ends; the provider does not use API data to train its models. We monitor changes to its other processors and will announce them to the controller without undue delay.

Signatures

The parties declare that they have read the agreement, that it expresses their true will, and in witness thereof they append their signatures.