1. Introductory provisions
1.1 These terms of processing personal data (the “Data Processing Agreement”) govern the rights and obligations between you as the controller (the “Controller”) and us, Sufio s.r.o., with registered address at Bottova 1, 811 09 Bratislava, Slovak Republic (Company registration number: 45 991 880), as the processor (the “Processor”) in the context of providing the Service on the Website.
1.2 Capitalised terms not defined in this Data Processing Agreement take the meaning assigned to them in the Terms of Service and/or the Privacy Policy or in the Regulation (EU) 2016/679 – the General Data Protection Regulation (the “GDPR”).
2. Subject matter, purpose and period of processing
2.1 The Processor will, on behalf of the Controller, process data included in invoices created by the Controller through the Service or synchronised automatically from the Controller’s online store connected to the Service (e.g. on the Shopify or BigCommerce platforms). To the extent that such data relates to an identified or identifiable natural person, including the Controller’s customer and/or subscriber, their representative or contact person (the “Data Subject”), it constitutes personal data for the purposes of this Data Processing Agreement (the “Personal Data”). Personal Data may include identification data, contact data, business and tax data relating to natural persons, billing and transaction data, and data concerning purchased products or services. Information relating exclusively to a legal entity does not constitute Personal Data and is not covered by this Data Processing Agreement.
2.2 The Processor will process the Personal Data of Data Subjects for the purposes of providing the Service for the Controller on the Website.
2.3 The Processor may process the Personal Data on behalf of the Controller throughout the duration of the contract between the Controller and the Processor (i.e. the duration of the Controller’s account with the Service). Within 60 days after the end of the provision of Service relating to processing, the Processor will, at the Controller’s choice, delete or return to the Controller all Personal Data and delete all existing copies unless applicable legislation requires storage of the Personal Data. Copies of Personal Data in backups will be deleted in line with the Processor’s regular backup cycle, within 60 days after the end of the provision of Service, and will remain protected under this Data Processing Agreement until deleted.
2.4 The processing consists of collecting (including automatic synchronisation from the Controller’s connected online store), recording, storing, organising, using, retrieving, transmitting (including sending invoices and related documents to Data Subjects by email and to other services connected by the Controller, on the Controller’s instructions) and erasing Personal Data.
2.5 The Service is not designed to process special categories of personal data under Article 9 of the GDPR, personal data relating to criminal convictions and offences under Article 10 of the GDPR, or other sensitive data subject to sector-specific regulation, such as protected health information under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”). The Controller will not submit such data to the Service. The Processor does not act as a business associate or subcontractor within the meaning of HIPAA.
3. Terms of processing
3.1 The Processor will process the Personal Data in accordance with applicable legislation, in particular, the GDPR and the relevant Slovak data protection legislation.
3.2 The Processor will process the Personal Data only on the basis of documented instructions from the Controller, except for cases when required to do so by applicable legislation; in such a case, the Processor will inform the Controller of that legal requirement before processing, unless the relevant legislation prohibits such information on important grounds of public interest.
3.3 The Processor is not authorized to process the Personal Data for a purpose other than that specified by the Controller. The Processor may transfer Personal Data to countries outside the European Union only where the transfer is covered by an adequacy decision of the European Commission, including, where applicable, the EU-U.S. Data Privacy Framework, or by appropriate safeguards under Chapter V of the GDPR, such as the Standard Contractual Clauses adopted by the European Commission. The Processor’s current subprocessors and their locations are listed on the Subprocessors page on the Website.
3.4 The Processor will inform the Controller without delay if the Processor believes that an instruction of the Controller contradicts the GDPR or other legislation relating to the protection of personal data.
3.5 The Controller is responsible for ensuring that it has a lawful basis for the processing of Personal Data and that its instructions comply with applicable legislation. The Controller’s use and configuration of the Service constitute its documented instructions to the Processor.
3.6 To the extent the California Consumer Privacy Act (“CCPA”) or similar U.S. state privacy laws apply to the Personal Data, the Processor acts as a “service provider” or “processor” under those laws. The Processor will not sell or share Personal Data, and will not retain, use or disclose Personal Data outside the direct business relationship with the Controller or for any purpose other than providing the Service.
3.7 The Processor will not use the Controller’s Personal Data to train artificial intelligence or machine learning models.
4. Specific obligations of the Processor
4.1 The Controller hereby gives the Processor general authorisation to engage other processors (subprocessors) in the processing of Personal Data. The current subprocessors are listed on the Subprocessors page on the Website. The Processor will inform the Controller of intended changes at least 30 days in advance, by updating the Subprocessors page and by email to Controllers who have signed up for the Processor’s legal and subprocessor updates. The Controller may object on reasonable data protection grounds within 14 days of the notice. If the parties cannot resolve the objection, the Controller may terminate the Service and receive a refund of prepaid fees for the unused period as its sole remedy.
If the Processor engages a subprocessor in the processing of Personal Data, the Processor will impose on that subprocessor, by means of a contract, the same data protection obligations as set out in this Data Processing Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. If that subprocessor fails to fulfill its data protection obligations, the Processor will remain fully liable to the Controller for the performance of that subprocessor's obligations. For the purposes of this Data Processing Agreement, other processors (subprocessors) are only those that process Personal Data on behalf of the Controller; service providers that the Processor uses for its own purposes as a controller (e.g. for billing, customer support or marketing of its own services) are not subprocessors, and the notification obligations under this Article do not apply to them.
4.2 The Processor undertakes to assist the Controller in assessing the impact of data protection and in prior consultations of supervisory authorities as reasonably deemed necessary by the Controller within the meaning of Articles 35 and 36 of the GDPR, taking into account the nature of processing and the information available to the Processor.
4.3 If the Data Subject exercises his or her rights vis-à-vis the Processor within the meaning of Chapter III of the GDPR, the Processor will forward this request to be processed by the Controller, and may inform the Data Subject accordingly. Having taken into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III of the GDPR.
4.4 The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting the Controller’s Personal Data. The notification will include the information referred to in Article 33(3) of the GDPR to the extent available to the Processor, and may be provided in stages as further information becomes available. Notifying supervisory authorities and Data Subjects is the Controller’s responsibility; the Processor will provide reasonable assistance. Each party bears its own costs related to a Personal Data Breach, except that the Processor bears the costs of remedying its own systems. Any reimbursement of the Controller’s costs is limited to Personal Data Breaches caused by the Processor’s failure to comply with this Data Processing Agreement and is subject to Article 6.4.
4.5 Where assistance under Articles 4.2 and 4.3 goes beyond what the standard features of the Service provide, the Processor may charge reasonable fees for such assistance.
5. Security of Personal Data
5.1 The Processor undertakes to take all measures required under Article 32 of the GDPR, in particular, the Processor undertakes to take appropriate technical and organisational measures taking into account, above all, the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed. A description of these measures is available to the Controller upon request. The Processor may update these measures, provided that the overall level of protection of Personal Data is not reduced.
5.2 The Processor will provide the Controller at any time at the latter’s request any information required to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, in particular, the obligations to take appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and the protection of the Data Subject’s rights is ensured.
5.3 For the purposes of checking compliance with the obligations laid down in this Data Processing Agreement, the Processor will allow for and contribute to audits, including inspections, conducted by the Controller (or another auditor mandated by the Controller), subject to the following conditions. The Processor may first respond to an audit request by providing the information referred to in Article 5.2, such as security documentation, completed security questionnaires or third-party certifications. If this information is not sufficient to demonstrate compliance, the Controller may conduct an audit no more than once every 12 months, with at least 30 days’ prior written notice, during normal business hours, subject to appropriate confidentiality obligations and without access to other customers’ data. The Controller bears the costs of the audit, unless it reveals a material breach of this Data Processing Agreement by the Processor. These limitations do not apply where an audit is required by a supervisory authority.
5.4 The Processor will comply with the obligation of confidentiality of processed Personal Data and will not make available or provide the Personal Data to any third party unless otherwise provided in this Data Processing Agreement. The Processor will ensure that its employees or other persons who are authorized to process or have access to Personal Data are bound by the obligation of confidentiality within the meaning of this Article.
6. Final provisions
6.1 This Data Processing Agreement represents the legally binding agreement on the processing of personal data between the Controller and the Processor within the meaning of Article 28 of the GDPR. The Controller declares that it has read, agrees with without reservation, is bound by and undertakes to abide by this Data Processing Agreement.
6.2 Should any of the provisions of this Data Processing Agreement be found to be or become invalid, ineffective or unenforceable, this will not affect the other provisions and the parties undertake to replace such provisions with valid, effective and enforceable provisions that are closest to the commercial purpose of the original provisions.
6.3 This Data Processing Agreement forms part of the Privacy Policy and the Terms of Service made available on the Processor’s Website. In the event of a conflict between this Data Processing Agreement and the Terms of Service, this Data Processing Agreement prevails only with respect to the processing of Personal Data.
6.4 Each party’s total liability arising out of or related to this Data Processing Agreement, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability set out in the Terms of Service. In any case, the Processor’s aggregate liability under this Data Processing Agreement will not exceed the fees paid by the Controller for the Service in the 12 months preceding the event giving rise to the claim. This limitation does not apply to damage caused intentionally or by gross negligence, or where liability cannot be limited under applicable law. Nothing in this Data Processing Agreement limits or excludes either party’s liability towards Data Subjects under Article 82 of the GDPR. Where either party has paid full compensation to a Data Subject, its right of recourse against the other party will be determined in accordance with Article 82(5) of the GDPR.
6.5 This Data Processing Agreement is governed by the laws of the Slovak Republic. Disputes will be resolved by the courts specified in the Terms of Service.
6.6 The Processor may amend this Data Processing Agreement, in particular due to changes in legislation or in the Service, and will publish any amendments on the Website and notify them by email to Controllers who have signed up for the Processor’s legal and subprocessor updates. Amendments will not materially reduce the protection of Personal Data. Where the Controller has signed a copy of this Data Processing Agreement, the signed version, identified by its date, applies until the parties agree otherwise.
6.7 This Data Processing Agreement becomes valid and effective on May 25, 2018.
Last updated on Oct 22, 2026.