Data Processing Agreement

1. Subject matter and duration

Subject matter: the personal data contained in the business data that the customer and its users enter into e:corg one or receive through the integrations they connect, processed to provide the service described in the Terms of Service.

Duration: the term of the customer's subscription and, after it ends, until the data is deleted or returned under section 9.

2. Nature and purpose of the processing

• Hosting and storage of the customer's organization in e:corg one.
• Recording and computing purchase and sales documents, receipts at the till, stock, payments, debts and accounting postings, and producing the exports and filings the customer asks for (e-Factura, SAF-T, VAT files, accounting exports).
• Sending documents, invitations, reminders and electronic receipts by email on the customer's instruction.
• Exchanging data with services the customer connects: ANAF SPV, couriers, marketplaces and online shops, card terminals, accounting software.
• Analytics, forecasts and answers of the marql assistant built into e:corg one, for the customer's own organization (section 6).
• Support the customer asks for, and keeping the service secure (access control, logs, abuse prevention).

We process the data only for these purposes. We never use it for our own purposes, for advertising or to build profiles, and we never sell it.

3. Categories of data subjects

• The customer's users and staff: owners, administrators, cashiers, storekeepers, accountants and guests invited to stock counts.
• The customer's customers: buyers named on invoices and receipts, people who ask for an electronic receipt, recipients of online orders and deliveries, members of the customer's loyalty programme.
• The customer's partners: suppliers, sole traders and the contact persons of partner companies.
• Other people named in the customer's documents, for example drivers and representatives on transport documents.

4. Categories of personal data

• Identification and contact data: name, email address, phone number, postal and delivery address.
• Tax and company identifiers of partners, and national identification numbers only where the customer enters them, for example where the law requires them on an invoice.
• Transaction data: invoices, receipts, orders, deliveries, payments, debts, bank statement lines and loyalty points.
• Staff data: user account, role, stores, shifts and till activity, cash differences and the activity log.
• Technical data: IP addresses, devices, sessions and security logs.

e:corg one is not designed for special categories of personal data (Article 9 GDPR); the customer should not enter them.

5. Our obligations

• Instructions: we process the data only on the customer's documented instructions, including with regard to transfers of personal data to a third country or an international organisation. The Terms of Service, this DPA and the customer's use and settings of e:corg one are those instructions. If an instruction appears to infringe data protection law we tell the customer. If the law requires us to process data otherwise, we tell the customer first unless the law forbids it.
• Confidentiality: only people who need access to provide or support the service have it, and they are bound by confidentiality.
• Security (Article 32): encrypted connections (HTTPS); access keys of integrations encrypted at rest (AES-256-GCM); the database reachable only from the application's private network; every organization's data separated from the others' in every query; access by role and store inside an organization; two-factor sign-in; rate limits, security logs and an activity log; posted documents that cannot be altered; regular security reviews and a public way to report vulnerabilities (security@ecorg.one).
• Assistance: we help the customer with data protection impact assessments and prior consultations with a supervisory authority, as far as the information available to us allows.

6. Sub-processors

• Railway Corporation (United States; Railway's EU West region, European Union): hosting of the application, its database and stored files.
• Resend (United States; EU region): delivery of the emails the application sends on the customer's instruction.
• MARQL LTD (United Kingdom; data stored in the European Union), the sister analytics product of e:corg one: analytics, forecasts and AI answers for the customer's organization. Its own sub-processors are listed at marql.one/subprocessors. The customer can turn marql off at any time (Privacy Policy, section 5).
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): delivery of notifications to the e:corg one phone app, only for users who turn them on. A notification shows no amounts unless the user chooses to see them.

The customer gives a general authorisation for the sub-processors below. We bind each of them by a written contract to data protection obligations equivalent to this DPA and remain responsible to the customer for their work.

6.1 Changes to sub-processors

We announce a new or replacement sub-processor at least 30 days before it starts, by email to the organization's owners and administrators and in the application, and update this list. The customer may object on reasonable data protection grounds within that period. If we cannot meet the objection, the customer may end the subscription before the change applies, without penalty.

Stripe processes the payments for the customer's e:corg one subscription; for that billing data we are the controller, so Stripe is not a sub-processor of the customer's business data. Services the customer connects itself (ANAF, couriers, marketplaces, banks, accounting software, its own payment accounts) receive data on the customer's instruction and are not our sub-processors.

7. Requests from data subjects

e:corg one lets the customer find, correct, export and delete the personal data it holds, so it can answer requests from the people concerned. If a person writes to us about data the customer controls, we pass the request on to the customer without answering it ourselves, unless the customer asks us to. Where the customer needs more help, we provide it.

8. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, and we aim to do so within 24 hours, by email to the organization's owners and administrators. The notification describes, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed; we complete it as we learn more. We follow a documented incident response process, contain the breach and help the customer meet its own obligations to notify the supervisory authority and the people concerned.

9. End of the processing

While the subscription is active, and for 30 days after we notify the customer that the subscription has ended, the customer can export its data (SAF-T, accounting exports, CSV and the export API); this export is how the data is returned. We delete the organization's data 90 days after that notice, or 7 days after the customer's own deletion request unless the customer withdraws it within those 7 days. We ask our sub-processors, including marql, to delete their copies; a marql organization of the customer's own that was linked to e:corg one is unlinked, not deleted. Backup copies expire in line with our hosting provider's backup retention. We keep only our own invoices to the customer and a minimal record of the deletion that contains no personal data, and any data that European Union or member state law, or UK law where it applies, requires us to keep, only for that purpose.

10. Audits

We make available to the customer the information needed to show compliance with Article 28 and answer reasonable written questionnaires. We allow audits, including inspections, by the customer or an independent auditor it appoints who is bound by confidentiality, with 30 days' notice, during business hours and at most once a year, except after a personal data breach or when a supervisory authority requires it. Each party bears its own costs.

11. International transfers

The customer's data is hosted in the European Union. Transfers between the EU and the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom and the UK adequacy regulations for the EEA. Where a sub-processor processes data outside the EEA or the United Kingdom, the transfer relies on an adequacy decision such as the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses (Decision (EU) 2021/914) and, for data under UK law, the UK International Data Transfer Agreement or the UK Addendum to those clauses.

12. Liability, precedence and contact

Liability under this DPA is subject to the limits in the Terms of Service (section 9, Liability), except where the law does not allow them. If this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails. Governing law and courts are those of the Terms of Service.

Questions about this DPA: hello@ecorg.one. Security incidents and vulnerabilities: security@ecorg.one.

Privacy Policy

Terms of Service