Data Processing Agreement

Last updated: 1 November 2026
The Polish version is binding. This English version is a translation.

Draft. For review by a lawyer. The Polish version is binding; this English version is a translation.

For the lawyer: (1) The clauses follow the standard contractual clauses in Commission Implementing Decision (EU) 2021/915 (Art. 28(7) GDPR). Clause 2 says the clauses must not be modified. I could only retrieve a summary of the official text from EUR-Lex, not the full text, so the clauses below are drafted from the model and are not a verbatim copy. Please replace them with the verbatim official text (OJ L 199, 7.6.2021, p. 18), keeping the numbering and adding only the options chosen in the annexes. (2) Options chosen: general authorisation for sub-processors with 14 days’ notice (clause 7.7(a), option 2); docking clause (clause 5) left out. (3) Is concluding the agreement electronically by accepting the terms enough? (4) How liability for breach of this agreement interacts with the liability cap in the terms.

Preliminary provisions

This agreement (the “Agreement”) is concluded between the customer of Fiskora (the person or entity that created an account at app.fiskora.com), the Controller, and [FIRMA], [ADRES], NIP [NIP], REGON [REGON], the Processor or “Fiskora”.
The Agreement takes effect when the customer accepts the terms and creates an account. It lasts as long as Fiskora processes personal data on the Controller’s behalf (until the data is deleted after the service ends).
The Agreement is the contract referred to in Art. 28(3) GDPR. It is based on the standard contractual clauses in Commission Implementing Decision (EU) 2021/915. If the Controller is itself a processor (for example an accounting office acting for its client), Fiskora is its sub-processor, and “Controller” in this Agreement then means that processor, who guarantees that it has authority from the data controller.
On data protection matters, this Agreement prevails over the terms if they conflict.
“Personal data”, “processing” and “personal data breach” have the meaning given in the GDPR (Regulation (EU) 2016/679).

SECTION I

Clause 1. Purpose and scope

a) The purpose of these clauses is to ensure compliance with Art. 28(3) and (4) GDPR. b) The Controller and Processor have agreed to these clauses to ensure compliance with Art. 28(3) and (4) GDPR. c) The clauses apply to the processing of personal data described in Annex II. d) Annexes I to IV are an integral part of the clauses. e) The clauses do not affect the obligations to which the Controller is subject under the GDPR. f) The clauses do not by themselves ensure compliance with obligations related to international transfers under Chapter V GDPR.

Clause 2. Invariability of the clauses

a) The Parties undertake not to modify the clauses, except to add information to the annexes or update it. b) This does not prevent the Parties from including the clauses in a wider contract, or from adding other clauses or additional safeguards, provided they do not contradict the clauses or restrict the rights of data subjects.

Clause 3. Interpretation

a) Where the clauses use terms defined in the GDPR, those terms have the same meaning. b) The clauses shall be read and interpreted in the light of the GDPR. c) The clauses shall not be interpreted in a way that runs counter to the rights and obligations in the GDPR or that prejudices the fundamental rights or freedoms of data subjects.

Clause 4. Hierarchy

In the event of a contradiction between the clauses and the provisions of related agreements between the Parties, existing at the time the clauses are agreed or entered into afterwards, the clauses prevail.

Clause 5. Docking clause

Not applicable.

SECTION II. OBLIGATIONS OF THE PARTIES

Clause 6. Description of processing

The details of the processing, in particular the categories of personal data and the purposes for which they are processed on behalf of the Controller, are in Annex II.

Clause 7. Obligations of the Parties

7.1. Instructions

a) The Processor processes personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law to which it is subject. In that case, the Processor informs the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Controller may give further instructions throughout the processing. Instructions are always documented. b) The Processor immediately informs the Controller if it considers that the Controller’s instructions infringe the GDPR or other Union or Member State data protection provisions.

The Controller’s instructions are: this Agreement, the terms, and actions the Controller takes in the app (for example issuing and sending an invoice to KSeF or by email, exporting, deleting the account).

7.2. Purpose limitation

The Processor processes personal data only for the specific purposes in Annex II, unless it receives further instructions from the Controller.

7.3. Duration of the processing

Processing takes place for the duration specified in Annex II.

7.4. Security of processing

a) The Processor implements at least the technical and organisational measures in Annex III to ensure the security of personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. In assessing the appropriate level of security, the Parties take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to data subjects. b) The Processor grants members of its personnel access to the personal data only to the extent strictly necessary for implementing, managing and monitoring the Agreement. It ensures that persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the Processor applies specific restrictions or additional safeguards. Fiskora is not designed for such data and the Controller should not enter it (see Annex II).

7.6. Documentation and compliance

a) The Parties must be able to demonstrate compliance with the clauses. b) The Processor deals promptly and adequately with the Controller’s enquiries about processing under the clauses. c) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations in the clauses and the GDPR. At the Controller’s request, it also permits and contributes to audits of the processing covered by the clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the Controller may take into account relevant certifications held by the Processor. d) The Controller may conduct the audit itself or mandate an independent auditor. Audits may include inspections at the Processor’s premises or physical facilities and are, where appropriate, carried out with reasonable notice. e) The Parties make the information referred to in this clause, including the results of any audits, available to the supervisory authority on request.

For the lawyer: Practical audit rules (notice, frequency, cost, scope: written answers and documentation rather than a visit to the Hetzner data centre) can be spelled out in an additional provision outside the clauses, as long as it does not change clause 7.6.

7.7. Use of sub-processors

a) The Processor has the Controller’s general authorisation to engage sub-processors from the agreed list (Annex IV). The Processor informs the Controller in writing, by email to the account address, at least 14 days before any intended change adding or replacing sub-processors, giving the Controller enough time to object before the sub-processor is engaged. The Processor provides the information needed for the Controller to exercise the right to object. b) Where the Processor engages a sub-processor for specific processing on behalf of the Controller, it does so by a contract imposing the same data protection obligations as those in these clauses. The Processor ensures the sub-processor complies with the obligations to which the Processor is subject under the clauses and the GDPR. c) At the Controller’s request, the Processor provides a copy of such a contract and any amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, it may redact the text. d) The Processor remains fully responsible to the Controller for the sub-processor’s performance of its contract. It notifies the Controller of any failure by the sub-processor to fulfil its obligations. e) The Processor agrees a third-party beneficiary clause with the sub-processor under which, if the Processor has factually disappeared, ceased to exist in law or become insolvent, the Controller has the right to terminate the sub-processor contract and instruct the sub-processor to erase or return the personal data.

For the lawyer: Clause 7.7(e): do providers such as Hetzner, Cloudflare and Backblaze accept this in their standard DPAs? If not, consider how to present the limitation to customers.

7.8. International transfers

a) Any transfer of data to a third country or an international organisation by the Processor takes place only on documented instructions from the Controller or to fulfil a specific requirement under Union or Member State law, and in compliance with Chapter V GDPR. b) The Controller agrees that where the Processor engages a sub-processor under clause 7.7 for specific processing activities and those activities involve a transfer within the meaning of Chapter V GDPR, the Processor and the sub-processor can ensure compliance with Chapter V by using standard contractual clauses adopted by the Commission under Art. 46(2) GDPR (Decision 2021/914), or by relying on an adequacy decision (including the EU-US Data Privacy Framework), provided the conditions for their use are met.

Clause 8. Assistance to the Controller

a) The Processor promptly notifies the Controller of any request it has received from a data subject. It does not respond itself unless the Controller has authorised it to. b) The Processor assists the Controller in fulfilling its obligation to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling (a) and (b), it follows the Controller’s instructions. c) In addition to its duty to assist under (b), the Processor also assists the Controller in ensuring compliance with: (1) the obligation to carry out a data protection impact assessment; (2) the obligation to consult the supervisory authority prior to processing where the assessment indicates a high risk that the Controller does not mitigate; (3) the obligation to ensure the data is accurate and up to date, by informing the Controller without delay if it learns the data is inaccurate or outdated; (4) the obligations in Art. 32 GDPR. d) The Parties set out in Annex III the appropriate technical and organisational measures by which the Processor assists the Controller, and the scope and extent of the assistance required.

In practice: the Controller can export and delete data itself in the app. For anything else, support@fiskora.com helps within 2 working days (a target, not a guarantee or SLA).

Clause 9. Notification of personal data breach

In the event of a personal data breach, the Processor cooperates with and assists the Controller in complying with its obligations under Art. 33 and 34 GDPR, taking into account the nature of processing and the information available.

9.1. Breach concerning data processed by the Controller

The Processor assists the Controller: a) in notifying the breach to the supervisory authority without undue delay after the Controller became aware of it, where relevant (unless the breach is unlikely to result in a risk); b) in obtaining the information that, under Art. 33(3) GDPR, must be stated in the Controller’s notification (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed); c) in complying with the duty to communicate the breach to data subjects where it is likely to result in a high risk.

9.2. Breach concerning data processed by the Processor

The Processor notifies the Controller without undue delay, where possible within 48 hours of becoming aware of the breach, by email to the account address. The notification contains at least: a) a description of the nature of the breach (where possible, categories and approximate number of data subjects and records); b) contact details where more information can be obtained; c) its likely consequences and the measures taken or proposed to address it. If not all information can be provided at once, the first notification contains what is available and further information follows without undue delay as it becomes available.

For the lawyer: The 48-hour target is an addition (the standard clauses say “without undue delay”). Keep it? Is it feasible for a sole proprietor?

SECTION III. FINAL PROVISIONS

Clause 10. Non-compliance with the clauses and termination

a) Without prejudice to the GDPR, if the Processor is in breach of its obligations under these clauses, the Controller may instruct it to suspend processing until it complies or the Agreement is terminated. The Processor promptly informs the Controller if it cannot comply with the clauses for whatever reason. b) The Controller is entitled to terminate the Agreement insofar as it concerns processing under the clauses if: (1) processing was suspended by the Controller under (a) and compliance is not restored within a reasonable time and in any event within one month of suspension; (2) the Processor is in substantial or persistent breach of the clauses or its GDPR obligations; (3) the Processor fails to comply with a binding decision of a competent court or the supervisory authority regarding its obligations under the clauses or the GDPR. c) The Processor is entitled to terminate the Agreement insofar as it concerns processing under the clauses if, after informing the Controller that its instructions infringe applicable legal requirements (clause 7.1(b)), the Controller insists on compliance. d) After the Agreement ends, the Processor, at the Controller’s choice, deletes all personal data processed on its behalf and certifies to the Controller that it has done so, or returns all the data and deletes existing copies, unless Union or Member State law requires storage. Until then the Processor continues to ensure compliance with the clauses.

In practice: before the end, the Controller can download a ZIP export (PDF, XML, CSV) and request account deletion. Data is deleted within 30 days of the request, and backups age out within a further 30 days. Until the Controller deletes the account, an account with an unpaid or cancelled subscription stays read-only and the data is kept on the Controller’s instruction (see Annex II). Fiskora is not a substitute for an invoice archive, and statutory duties to keep invoices remain with the Controller.

For the lawyer: Can keeping data read-only after a subscription lapses, until the customer deletes it, be reconciled with clause 10(d) as an “instruction of the Controller”? Should there be a final deletion after, say, 24 months of inactivity?

Annex I. List of parties

Controller: the Fiskora customer. Details (name or company name, address, NIP, contact email) are those given in the account at app.fiskora.com. The Agreement is concluded electronically by creating an account and accepting the terms; no separate signature is needed. Date: the date the terms are accepted.

Processor: [FIRMA], [ADRES], NIP [NIP], REGON [REGON]. Contact person: [NAME], [EMAIL: support@fiskora.com]. Data protection officer: none appointed [to be confirmed].

Annex II. Description of the processing

Categories of data subjects: the Controller’s business contacts (buyers and sellers, their contact persons and representatives, where they are natural persons or sole traders), the Controller’s employees and collaborators, other persons named on invoices, and persons with an accountant login invited by the Controller for read-only access.

Categories of personal data: name, company name, address, NIP and other tax identifiers, email address, phone number (if entered), bank account number, invoice content (line items, amounts, descriptions, dates), data in invoice XML and PDF files, KSeF reference numbers, sending history.

Sensitive data: none intended. The Controller should not enter special categories of data or data on criminal convictions. If an item description on an invoice reveals such data (for example a medical service), that is the Controller’s responsibility, and Fiskora applies the safeguards in Annex III.

For the lawyer: Is this statement enough, or are additional safeguards needed under clause 7.5?

Nature of processing: storing, displaying, generating PDF and XML, sending to and receiving from KSeF on the Controller’s instruction, sending invoices by email on the Controller’s behalf, exporting, backups, deletion.

Purposes: providing the Fiskora service (issuing, sending, receiving and emailing VAT invoices) to the Controller under the terms.

Duration: from account creation until the data is deleted under clause 10 and the retention rules in the terms and privacy policy (read-only mode until the Controller deletes the account; deletion within 30 days of request; backups age out within a further 30 days; accounts that never issued a real invoice and are inactive for 12 months are deleted after two warning emails).

Annex III. Technical and organisational measures

Encryption in transit: connections to the app and between components are protected with TLS.
Customer data isolation: each company’s data is isolated at database level with Postgres row-level security, and the application uses a database account that cannot bypass it. A separate privileged account is used only for migrations and administration. Application-level filtering and cross-company leak tests are also in place.
KSeF certificates: encrypted with a per-customer key; that key is wrapped by a master key held only on the server (never in the database).
Authentication: password accounts with email verification; two-factor authentication (TOTP) required before a KSeF certificate can be connected; passwords stored as hashes.
Backups and recovery: encrypted backups (age), continuous write-ahead log archiving enabling point-in-time restore; copies in an EU region and on the provider’s own server in Poland.
Hosting: servers at Hetzner (Germany), hardened containers, secrets managed outside the code repository.
Access control: only the provider has access to production data; no admin panel at launch; any future support access will be granted by the customer, time-limited and logged.
Monitoring: uptime monitoring; alerts for stuck KSeF sends and failed workflows.
Retention and deletion: as in Annex II; ZIP export before deletion.
Assistance to the Controller: data export and account deletion in the app; support contact for data subject requests.

For the lawyer: Is the level of detail enough? Clause 7.4 requires concrete measures. Verify the description against the real system before publication; if something is not yet in the product (WAL archiving, RLS, TOTP), it must not be promised.

Annex IV. List of sub-processors

The Controller gives general authorisation (clause 7.7). Changes: 14 days’ notice by email.

Entity	Seat	Activity	Data location	Transfer basis
Hetzner Online GmbH	Germany	hosting of servers and database	Germany / EU	no transfer
Cloudflare, Inc.	USA	CDN and tunnel (traffic to the app), email sending (account and invoice emails with attachments), forwarding mail to support@	global, USA	EU-US DPF / SCCs [to be confirmed]
Backblaze, Inc.	USA	storing encrypted backups	EU region [to be confirmed]	SCCs [to be confirmed]

Not on the list: (1) the encrypted backup copy on the provider’s own server in Poland, under its control, is not a sub-processor; (2) Better Stack, uptime monitoring, receives no customer data; (3) Stripe and Link, LLC are separate controllers of payment data; (4) the Ministry of Finance (KSeF) is a separate controller to which invoices are sent on the Controller’s instruction.

For the lawyer: Does each entry have a valid DPA and SCCs/DPF? Is email sending with an attached invoice PDF through Cloudflare described correctly (is the content only in transit)? Should Better Stack be listed?

Parts adapted from Basecamp’s open-source policies, CC BY 4.0. Clauses based on Commission Implementing Decision (EU) 2021/915.