Data Processing Agreement

This is a translation provided for your convenience. The Slovak version is legally binding.

Under Article 28 of Regulation (EU) 2016/679 (GDPR) · part of the terms and conditions

Dušan Šroba - DATACLICK
Andreja Bažíka 31/102, 027 32 Zuberec, Slovenská republika
IČO: 44281820 · DIČ: 1074386434 · IČ DPH: SK1074386434
Zapísaný v živnostenskom registri ObÚ Námestovo, č. 560-12730
Nie sme platiteľmi DPH, registrácia podľa § 7a zákona č. 222/2004 Z. z. o DPH.
Bankové spojenie: SK97 0900 0000 0052 2815 9838 (GIBASKBX)
E-mail: support@dsdata.sk

1. Contracting parties and subject matter

The controller of the personal data is the customer – a company or sole trader using the DSDATA service (hereinafter the “controller”). The processor is the operator of the service specified above (hereinafter the “processor”).
This agreement governs the processing of personal data that the controller enters into the service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Section 34 of Act No. 18/2018 Coll. It forms part of the terms and conditions and is concluded upon registration for the service.

2. Nature, purpose and duration of processing

Účel: poskytovanie služby – vystavovanie, odosielanie a archivácia dokladov, evidencia kontaktov, nákladov, platieb a skladu, výkazy a exporty, ukladanie, triedenie a pripomínanie dokumentov (Dokumenty s AI) a AI asistent, ak ho prevádzkovateľ zapne.
Processing operations: storage, organisation, retrieval, display, transmission (email, e-invoice) on the controller’s instructions, backup and deletion.
Duration: for the term of the service use agreement and subsequently until deletion under clause 8.

3. Categories of data and data subjects

Data subjects: the controller’s customers and suppliers (natural persons – sole traders and company contact persons), consumers to whom the controller issues documents, and account users (employees, accountant).
Data: first name and surname, business name, address, Company ID, Tax ID, VAT ID, email, telephone, bank details, transaction data on documents (items, amounts, dates, payments) and data contained in uploaded attachments.
Dokumenty nahraté do funkcie Dokumenty s AI môžu obsahovať akékoľvek údaje, ktoré sa v nich nachádzajú, vrátane osobitných kategórií (čl. 9 GDPR, napr. údaje o zdraví zamestnanca na potvrdení) a rodné čísla. Prevádzkovateľ rozhoduje, ktoré dokumenty do služby nahrá, a zodpovedá za to, že na ich spracúvanie má právny základ; sprostredkovateľ s nimi zaobchádza s rovnakými opatreniami ako s ostatnými údajmi. Vo fakturácii osobitné kategórie údajov služba nepotrebuje.

4. Obligations of the processor

The processor processes data only on the documented instructions of the controller – such instructions are the use of the service functions and account settings. If, in its opinion, an instruction would breach legal regulations, it will notify the controller without undue delay.
The processor will ensure that persons authorised to process data are bound by confidentiality.
The processor implements appropriate technical and organisational measures under Article 32 GDPR: encrypted communication (HTTPS), passwords and API keys stored only as a cryptographic hash, separation of data of individual companies, role-based access control, daily backups with rotation, document history logs and regular software updates.
The processor assists the controller in handling requests from data subjects (access, rectification, erasure, portability) – primarily through the service functions (edit, export, delete) and, upon request, also by providing assistance.
The processor assists the controller in fulfilling obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available.
The processor will notify the controller of a personal data breach without undue delay, no later than within 48 hours of becoming aware of it, together with the information necessary for its assessment and notification to the authority.
Upon request, the processor will provide the information necessary to demonstrate compliance with these obligations and will allow an audit to a reasonable extent, subject to prior agreement on the date and a confidentiality obligation.

5. Sub-processors

The controller grants general consent to the engagement of the sub-processors listed below. The processor has an agreement with them imposing the same data protection obligations and is responsible for their compliance.
The processor will inform the controller of any intention to add or replace a sub-processor at least 14 days in advance by email or in the application. The controller may object to the change; if the parties do not reach agreement, the controller may terminate the agreement with immediate effect.

Processor	Activity	Location	When
WebCreators, s. r. o. (HostCreators), Československej armády 1617/24, 974 01 Banská Bystrica, Company ID No. 45329702	web hosting – operation of the application, database, backups and email sending	data centres in the Slovak Republic (EU)	always
OpenAI, or Anthropic	AI asistent a Dokumenty s AI – spracovanie konkrétnej úlohy (text, nahratý doklad alebo dokument)	EU / USA – standard contractual clauses, EU–US framework	len ak firma AI zapne súhlasom
Digitálny poštár (certified Peppol provider)	delivery of the e-invoice to the recipient	EU	only when sending an e-invoice via Peppol

6. Transfers to third countries

Údaje sa ukladajú v Slovenskej republike (EÚ). Do tretích krajín sa môžu preniesť len pri AI asistentovi a Dokumentoch s AI, ktoré prevádzkovateľ zapne, a to na základe štandardných zmluvných doložiek EÚ alebo rámca EÚ – USA na ochranu údajov. Poskytovatelia AI údaje z API nepoužívajú na trénovanie modelov.

7. Rights and obligations of the controller

The controller is responsible for the lawfulness of processing, in particular for ensuring that it has a legal basis for processing the data of its customers and suppliers (usually the performance of a contract and statutory obligations under accounting and VAT regulations) and that it has informed them.
The retention of accounting documents (10 years) is the controller’s obligation. The service provides an archive and data export for this purpose.

8. Termination and deletion of data

Prevádzkovateľ si pred ukončením môže kedykoľvek stiahnuť kompletný archív (Nastavenia → Údaje a zrušenie účtu): doklady v PDF a XML, prílohy, dokumenty a prehľady v CSV.
After the account is cancelled, the processor will permanently delete the data within 90 days (until then, the controller may restore it by signing in); from backups, it will disappear according to their rotation schedule, no later than within 12 months. Data that the processor is required to retain under specific legislation (e.g. its own subscription invoices) will be retained only to the extent necessary.

9. Final provisions

In matters not governed by this agreement, the Terms and Conditions and the GDPR shall apply. In the event of any conflict, this agreement shall prevail over the Terms and Conditions in matters concerning the protection of personal data.
Zmluva nadobúda účinnosť 25. 9. 2026 a platí počas trvania zmluvy o používaní služby. Znenie rozšírené o Dokumenty s AI je účinné od 8. 10. 2026.