Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Controller") and [YOUR LEGAL NAME], sole trader in Cyprus ("we", "us", "Processor") and applies when we process personal data on your behalf as part of the Service.

By using the Service, you agree to this DPA. If your organisation needs a signed paper version for your compliance records, email support@cyprus24h.com and we will send one.

1. Definitions

Terms used here have the meanings given in the GDPR (Regulation (EU) 2016/679). In particular:

• "Personal Data" means personal data uploaded into the Service by you or on your behalf — e.g. names and email addresses of your customers, suppliers, employees, etc.
• "Processing" has the meaning in Article 4(2) GDPR.
• "Sub-processor" means a third party engaged by us to process Personal Data on your behalf.

2. Subject-matter and duration

We process Personal Data only for the purpose of providing the Service to you, for as long as you have an active account, plus a short retention period thereafter as described in the Privacy Policy.

3. Nature and purpose of processing

We provide hosted multi-tenant accounting software. We store, transmit, back up, and operate on Personal Data only as needed to deliver the Service's functionality.

We do NOT:

• Use Personal Data to train machine learning models
• Sell or share Personal Data with marketers
• Use Personal Data for purposes other than providing the Service

4. Types of data and categories of data subjects

Customers typically upload data including:

• Names, addresses, email addresses, phone numbers of their customers, suppliers, employees
• Bank account details, VAT numbers, tax IDs
• Financial transaction data (invoices, payments, journal entries)
• Payroll data (where the payroll module is used) — which may include national insurance numbers, salary details

Data subjects include the Customer's own:

• Customers and clients
• Suppliers and contractors
• Employees and contractors

You remain responsible for ensuring you have a lawful basis (under Article 6 GDPR, and Article 9 where special categories are involved) to upload this data into the Service.

5. Controller responsibilities

You confirm that:

• You have a lawful basis for processing the Personal Data you upload
• You have provided required notices to data subjects
• You have obtained any required consents
• Your instructions to us comply with applicable data protection law

6. Processor obligations

We will:

• Process Personal Data only on your documented instructions (using the Service constitutes a documented instruction), and as required by law
• Ensure persons authorised to process Personal Data are bound by confidentiality
• Implement appropriate technical and organisational measures (see Annex II)
• Assist you (at your expense, beyond reasonable assistance) in responding to data subject rights requests
• Assist you with Data Protection Impact Assessments, breach notification, and prior consultation with supervisory authorities
• Notify you without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting your data
• On termination, return or delete Personal Data as you instruct, subject to legal retention requirements

7. Sub-processors

We use the sub-processors listed in Annex I. By accepting this DPA you consent to our use of these sub-processors.

We will give you at least 30 days' notice before adding or replacing a sub-processor (by email, or by publishing an update on our website with notice in the next product release notes). If you reasonably object to a new sub-processor on data-protection grounds, you may terminate the Service for the relevant tenant before the change takes effect.

We remain liable for the acts and omissions of our sub-processors as if they were our own.

8. International transfers

Personal Data is stored within Cyprus and the EEA. Where we use sub-processors that transfer data outside the EEA (see Annex I), we ensure appropriate safeguards are in place (e.g. EU Standard Contractual Clauses, adequacy decisions).

9. Audit

You may audit our compliance with this DPA once per year on at least 30 days' written notice, during business hours, without unreasonably disrupting our operations. We may charge reasonable costs of providing audit support. As an alternative to on-site audits, you may rely on written audit reports, certifications, or our completed answers to a reasonable questionnaire.

10. Liability

Our liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law (including Article 82 GDPR) provides otherwise.

11. Term

This DPA applies for as long as we process Personal Data on your behalf, plus any extended retention period required by law.

12. Conflicts

If this DPA conflicts with the Terms of Service, this DPA prevails on matters of data protection.