Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between Docktape Kft. (registered office: 1115 Budapest, Szentpétery utca 14. 1. em. 4.; company registration number: 01-09-395269; tax number: 27720835-2-43), the company operating Finecko (“Processor”, “we”), and the Customer named in the order or sign-up for the Finecko service (“Controller”, “you”). It applies to the Customer Personal Data we process on your behalf when you use the managed Apache Fineract service, and it is incorporated into the Terms of Service.

“Customer Personal Data” means personal data contained in the data you or your users upload to or create in your Finecko environment. Terms such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given in Regulation (EU) 2016/679 (“GDPR”). Personal data we collect for our own purposes (for example your account, billing and website data) is not covered here; see our Privacy Policy.

We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, your configuration and use of the service, and any further written instruction you give that is consistent with the Terms. We inform you if we believe an instruction infringes the GDPR or other EU or Member State data protection law. If we are required by law to process the data otherwise, we inform you beforehand unless the law prohibits it.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I.

We grant access to Customer Personal Data only to personnel who need it to provide the service, and we make sure they are bound by confidentiality obligations. Access to the underlying infrastructure is restricted to Finecko engineers, and Customer Personal Data is accessed by us only to operate the service or in response to a support request.

We implement the technical and organisational measures required by Article 32 GDPR, summarised in Annex II. We may update them, provided the overall level of security is not reduced.

You give us general authorisation to use the sub-processors that process Customer Personal Data and are listed on our sub-processor page. We impose on each sub-processor data protection obligations that are no less protective than those in this DPA, and we remain responsible for their performance.

We update the sub-processor page before adding or replacing a sub-processor that processes Customer Personal Data, and we notify the Customer contact by email. You may object on reasonable data protection grounds within 30 days of the notice. If we cannot accommodate the objection, you may terminate the affected service in accordance with the Terms.

The Finecko service, including Customer Personal Data, is hosted in the European Union (Frankfurt, Germany). We transfer Customer Personal Data outside the European Economic Area only on your documented instructions or where a sub-processor does so, and only with an appropriate safeguard under Chapter V GDPR, such as Standard Contractual Clauses or an adequacy decision.

Taking into account the nature of the processing, we assist you, by appropriate technical and organisational measures and as far as possible, in responding to requests from data subjects to exercise their rights. If a data subject contacts us directly about Customer Personal Data, we forward the request to you and do not respond except as you instruct.

We also assist you with your obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us.

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information available to us that you need to meet your own notification duties under Articles 33 and 34 GDPR, including the nature of the breach, the data and data subjects concerned, likely consequences, and the measures taken or proposed.

When the service ends, Customer Personal Data is available for export for 30 days, as set out in the Terms. After that we delete it from our systems unless EU or Member State law requires us to keep it. Copies in backups are deleted when the backups expire under our backup retention schedule.

We make available to you the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint. Audits are done on reasonable written notice, during business hours, subject to confidentiality, and without disrupting the service or exposing other customers’ data. Each party bears its own costs unless otherwise agreed.

The limitations of liability in the Terms apply to this DPA. This DPA applies for as long as we process Customer Personal Data on your behalf. It is governed by the laws of Hungary, and disputes are subject to the jurisdiction set out in the Terms. If there is a conflict between this DPA and the Terms on the processing of Customer Personal Data, this DPA prevails.

This DPA applies automatically as part of the Terms. If you need a countersigned copy, email [email protected].