Data protection at reporting.finance – in brief

Who is who: Your company is the controller; Hospitality CEE, s.r.o. (operator of reporting.finance) is the processor. We process your data only on your instructions and only to produce your reports. The operator’s employees act under its authority and are not sub-processors.

What data: Accounting exports (journal, chart of accounts, cost centres, activities, contracts) and optionally hotel PMS statistics. They contain personal data only incidentally: names and IDs of self-employed suppliers, document texts, possibly payroll or guest names. Plus user accounts (name, email, sign-ins, audit records). Do not upload special-category data, health records or birth numbers; healthcare clients use Annex D.

Where the data are: In the EEA – Google Cloud, Frankfurt (at rest). Transactional emails (invitations, password resets) are sent by Resend (USA, certified under the EU-U.S. Data Privacy Framework; logs in the USA). All sub-processors are listed in Annex C and at https://reporting.finance/legal/sub-processors. Uploaded accounting data are stored in Frankfurt; email logs (Resend) are in the USA, and the encrypted connection may terminate at a Google network edge.

Security: Each client’s data separated in the database, roles, mandatory two-factor sign-in (authenticator / QR) for admins and editors, encryption, audit log, 7-day backups. Our staff look at your data only at your request or to handle an incident.

Incidents: We notify you of a personal data breach without undue delay and within 48 hours of becoming aware (including notice from a sub-processor).

Sub-processor changes: Typically 30 days’ notice (not less than 14); you may object within 14 days and, if needed, terminate the service without penalty. Future AI features will run in the EU through Google Cloud (Vertex AI), are switched on only after notice and your consent, and your data will not be used to train models.

When we part: 30 days to export your data (Excel reports, source files, mappings). We then logically delete the data within 30 days; backups expire within 7 days; residual Google copies follow Google’s cycle (up to 180 days).

What we need from you: The agreement is accepted in the app by a person authorised to act for your company (director, registered proxy or attorney with a power of attorney), with active 2FA. Fill in the contacts in Annex A. Confirm group companies in the app. Do not upload special-category data or birth numbers, and consider uploading payroll in aggregate. Manage your users and remove access that is no longer needed. User notice: https://reporting.finance/legal/user-privacy-notice. Notices: privacy@reporting.finance.

This summary is for guidance only and is not part of the agreement; Data Processing Agreement v1.2 prevails.