Data processing agreement

Parties and scope

• Controller: the customer, the business or other organisation whose workspace (tenant) holds the data.
• Processor: Aleksei Baranovski, a private individual using an Estonian entrepreneur account (simplified business income taxation), Kalevipoja põik 1, 13614 Tallinn, Estonia.

This DPA covers the customer organisation's data: invoices, price lists and other supplier documents, supplier contacts, catalog, orders and the details of the organisation's staff in its workspace. Data about account holders that we use for our own purposes (sign-in, security, billing) is covered by our Privacy policy, where we are the controller.

Subject matter and duration

We process personal data to provide the Bilketa service to the customer. Processing lasts for as long as the customer uses the service, plus the deletion period described under Deletion and return.

Nature and purpose of processing

• Receiving, storing and reading invoices, price lists and other supplier documents, including automated extraction of lines with AI models, to build the customer's catalog and supplier records.
• Searching and displaying the catalog and supplier details to authorised users.
• Composing order emails and, after a user confirms them, sending them through the customer's connected Gmail account.
• Hosting, backing up, securing and, on request, exporting or deleting the data.

Categories of data and data subjects

The service is not designed for special categories of personal data (GDPR Art. 9), and the customer should not upload them.

Our obligations as processor

We will:

• process the personal data only on the customer's documented instructions, which are these terms and the customer's use of the service, unless EU or Member State law requires otherwise (in which case we will tell the customer first unless the law forbids it);
• tell the customer if we believe an instruction breaks data protection law;
• ensure that everyone authorised to process the data is bound by confidentiality;
• take appropriate technical and organisational security measures (Art. 32), including encryption in transit, encryption of Gmail credentials at rest, hashing of passwords, sessions and API key secrets, tenant isolation on every database query, least-privilege production access, and backups;
• not use customer data for our own purposes, including training AI models; using a customer's documents to evaluate or improve extraction requires the customer owner's separate opt-in.

Subprocessors

The customer gives general authorisation for us to use the subprocessors listed on the Subprocessors page. We will announce any new or replacement subprocessor at least 30 days in advance on that page and by email to account owners. The customer may object on reasonable data protection grounds; if we cannot resolve the objection, the customer may terminate the affected service. We impose the same data protection obligations on each subprocessor by contract and remain responsible for its performance.

International transfers

We host data in the EU. Where a subprocessor processes data outside the European Economic Area (currently Anthropic, Google and Cloudflare in the United States), the transfer is covered by the European Commission's Standard Contractual Clauses or another valid mechanism under Chapter V of the GDPR.

Personal data breaches

We will notify the customer without undue delay, and at the latest within 72 hours, after becoming aware of a personal data breach affecting its data. The notice will describe what happened, the data and people likely affected, the likely consequences and what we are doing about it, with further details as they become known, so that the customer can meet its own obligations under Articles 33 and 34.

Assistance and audits

• We help the customer respond to data subject requests (access, correction, deletion, portability), mainly through the export and deletion features of the service, and forward any request we receive directly.
• We help with data protection impact assessments and consultations with supervisory authorities where they concern our service.
• We make available the information needed to show compliance with Article 28 and allow audits by the customer or an auditor it mandates, on reasonable notice, at most once a year unless a breach or authority requires otherwise.

Deletion and return

The customer can export its data at any time. When the customer closes its workspace or the agreement ends, we delete its personal data within 30 days, and from backups within a further 12 months (monthly archive copies), unless the law requires us to keep it. See Deleting your data.

Your obligations as controller

The customer is responsible for having a lawful basis for the personal data it uploads, for informing its staff and supplier contacts where required, and for the instructions it gives through the service, including the content and recipients of order emails. Questions about this DPA: [email protected].