Data processing agreement

The controller is the accountancy firm that holds the account on an Accountant plan (the “Accountancy firm” or “you”). The processor is the provider of the LexAlia service (“we”):

We process the data of the businesses the Accountancy firm adds to the account, to show it which legal acts concern each business. The processing of a business lasts while the business is in the account: it ends when the Accountancy firm removes it, when the Accountancy firm deletes its account, or 90 days after the contract for the Accountant plan ends, unless it is renewed. The business's data is then deleted.

We store the businesses' data, complete it at the Accountancy firm's request from GEMI, the General Commercial Registry, compare it automatically with the published acts and show the Accountancy firm the result, in the application and in the emails we send it. We do not use the businesses' data for any other purpose, do not sell it and do not send it to the artificial intelligence provider that generates the summaries of the acts.

• the business's identification: the AFM, the name in GEMI, the name the Accountancy firm gives it and the legal form;
• the KAD codes, the VAT status and the activity attributes the Accountancy firm declares, for example whether the business has employees, sells to consumers, owns real estate or imports or exports;
• the registered office and the municipalities the business follows;
• the turnover and balance-sheet total from the financial statements published in GEMI, and the turnover and number of employees, if the Accountancy firm gives them;
• the matches computed for the business and what the Accountancy firm marked about acts;
• who confirmed, for the Accountancy firm, the business's authorisation and when.

We process no special categories of data.

The natural persons who hold a sole trader's business or practise a liberal profession, whose businesses the Accountancy firm adds: the business's name and data concern them. For companies the data is the company's; where it still concerns a natural person, for example a name that contains a person's name, we treat it the same way.

We undertake:

• to process the data only for the purpose in point 3 and only on the Accountancy firm's instructions, given by using the Service (adding, changing and removing businesses) or in writing, at our contact address, unless the law requires us to process it, in which case we tell you first, unless the law forbids it;
• to tell you at once if we think an instruction of yours infringes data protection law;
• to ensure that the people with access to the data are bound to keep it confidential;
• to apply the security measures described in the Privacy policy: the data is transmitted encrypted, access to it is restricted and logged, and each account sees only its own organisation's data;
• to use other processors only as listed in point 7, under equivalent data protection obligations, and to tell you by email at least 15 days before adding or replacing one, during which you may object or close the account;
• to help you answer data subjects' requests: the data of all the businesses is downloaded from Settings (“Download my data”), and a business's data is deleted by removing the business from the account;
• to help you, with the information we have, to meet your obligations on the security of processing, the notification of security breaches and data protection impact assessments;
• when the processing ends, to delete the businesses' data as point 2 says; until then you can download it at any time, and it disappears from the database backups within 30 days and from the stored copies of the emails we sent you within 90 days;
• to make available to you the information needed to demonstrate compliance with this agreement and to allow audits, agreed in advance, by you or by an auditor you appoint.

For the businesses' data we use the providers in the Privacy policy:

• Hetzner Online GmbH (Germany): hosting of the application, the database and the backups, in data centres in the European Union;
• Resend, Inc. (USA): sending the emails to the Accountancy firm, which contain the businesses' names and the acts that concern them;
• Clerk, Inc. (USA): authentication of the Accountancy firm's users; it receives none of the businesses' data;
• Papaki (Greece) and Google Ireland Limited (Gmail): the email correspondence with us, if you write to us about a business.

Transfers to Resend, in the USA, and Google's processing outside the EEA rely on the standard contractual clauses adopted by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework. The artificial intelligence provider that generates the summaries of the acts receives none of the businesses' data.

If we learn of a security breach affecting the businesses' data, we notify you by email without undue delay and within 48 hours at the latest, with what we know about its nature, the businesses and data affected, the likely consequences and the measures taken or proposed, and we add to it as we learn more.

Each party's liability is as set out in the Terms and conditions.

This agreement forms part of the Terms and conditions for the Accountant plans. The confirmation you give in the application for the first client business you add also accepts it; we keep the date and the version accepted. The agreement applies until the data of the last business added is deleted.

We may change it on the same terms as the Terms and conditions. The version in force is the one published on this page, with its date of last update.