Data Processing Agreement (DPA)

The Processor processes, on behalf of the Controller, the personal data contained in the documents, clients, suppliers and reports managed through the Service, solely to provide the app's functionality (invoicing, e-Factura, reports).

The Processor processes data only on the Controller's documented instructions, conveyed through normal configuration and use of the app, unless required otherwise by law.

Persons authorized to process data are bound by confidentiality obligations.

The Processor may use sub-processors (e.g. cloud hosting providers, transactional email services) only under contracts requiring equivalent safeguards. The current list of sub-processors can be requested at info@facturifirma.ro; the Controller will be notified before any significant change.

Appropriate technical and organizational measures are applied, detailed on the Security page: encryption in transit and at rest, tenant isolation, multi-factor authentication, access logging, periodic backups.

In the event of a personal data breach, the Processor will notify the Controller without undue delay, providing the information necessary for the Controller to fulfil its own notification obligations.

The Processor will assist the Controller, to a reasonable extent, in responding to data subject requests regarding their GDPR rights.

Upon termination of the Service, the Processor will allow the Controller to export its data and will delete or anonymize remaining data, except where retention is required by law (e.g. tax archiving).

The Controller may request reasonable information about the compliance of implemented security measures, under mutually agreed conditions, without affecting the security of other tenants on the platform.