DATA PROCESSING AGREEMENT

concluded pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, the “GDPR”)

Version 1.2 dated 30 September 2026

Parties

[CLIENT COMPANY NAME]
Company ID (IČO): [●], registered office at [●],
registered in the Commercial Register kept by the [●] Court in [●], section [●], file [●],
acting through [name, position]
(the “Controller”)

and

Hospitality CEE, s.r.o.
Company ID (IČO): 19489617, registered office at Kaprova 42/14, Staré Město, 110 00 Prague 1, Czech Republic,
registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 387413,
acting through Anna Dempsey, executive director (jednatelka)
(the “Processor”)

(the Controller and the Processor together the “Parties”, each a “Party”.)

Recitals

A. The Processor operates a web-based management reporting platform available at the domain reporting.finance under the trade name “CZ Financial Reporting Paradise” (the “Service”).

B. The Controller uses or intends to use the Service under the Main Agreement. In providing the Service, the Processor processes, on behalf of the Controller, personal data contained mainly in the Controller’s accounting data and in user accounts.

C. The purpose of this Agreement is to set out the rights and obligations of the Parties in respect of that processing in accordance with Article 28 GDPR.

Article 1 – Definitions and interpretation

1.1 The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach”, “special categories of personal data” and “supervisory authority” have the meaning given to them in the GDPR (in particular Articles 4 and 9).

1.2 “Main Agreement” means the agreement under which the Processor provides the Service to the Controller, i.e. the agreement concluded under the General Terms and Conditions of the reporting.finance Service (the “Terms”) together with the order and price list, or any other agreement for the provision of the Service, including the Beta Terms for the reporting.finance Service, in each case as amended.

1.3 “Controller Personal Data” means the personal data processed by the Processor on behalf of the Controller in providing the Service, as described in Annex A.

1.4 “User” means a natural person to whom the Controller, through its administrator, has granted access to the Service.

1.5 “Sub-processor” means a subcontractor engaged by the Processor in the processing of Controller Personal Data (Article 28(2) and (4) GDPR).

1.6 “Business Day” means a day other than a Saturday, Sunday or public holiday in the Czech Republic.

1.7 Annexes A (Description of processing), B (Technical and organisational measures), C (Sub-processors) and, where it applies, D (Supplementary measures for health and similar data) form an integral part of this Agreement. Headings are for convenience only.

Article 2 – Subject matter and roles of the Parties

2.1 The Processor undertakes to process Controller Personal Data on behalf of the Controller to the extent, for the purpose and for the duration set out in this Agreement and in Annex A. The Controller undertakes to cooperate with the Processor as provided in this Agreement.

2.2 The Controller is the controller of the Controller Personal Data. Where the Controller uploads to the Service accounting data of other companies of its group, it shall list those companies in Annex A, Part 2 and confirm in the Service that each of them has authorised the upload. The Controller is the Processor’s sole point of contact for instructions and notices. The Processor may require each further company to accede to this Agreement in the Service or to evidence its authority. Until accession or evidence is provided, the Processor may restrict or suspend uploads of that company’s data. Where the Controller is itself a processor of such data, the Processor acts as its sub-processor and the Controller shall ensure that its agreement with the relevant controller permits such engagement. A representation of authority does not replace missing instructions from the actual controller.

2.3 The Processor is an independent controller (not a processor) of personal data that it processes for its own purposes, in particular: (a) contact and billing data of the Controller and its representatives for concluding and performing the Main Agreement; (b) records of the conclusion of this Agreement (Article 16) and of the Main Agreement; and (c) security records of sign-ins and access to the extent necessary to protect the Service against misuse. Processing under this paragraph is governed by the Processor’s user privacy notice published at https://reporting.finance/legal/user-privacy-notice. Other User data (name, email, role and account settings needed to provide the Service to the Controller) are processed by the Processor as processor. Employees and other persons acting under the Processor’s authority, including persons who operate the Service, process Controller Personal Data solely under the Processor’s instructions (Articles 29 and 32(4) GDPR) and are not Sub-processors.

2.4 Should the Processor, in breach of this Agreement, determine the purposes and means of processing, it shall be considered a controller in respect of that processing (Article 28(10) GDPR).

Article 3 – Controller's instructions

3.1 The Processor processes Controller Personal Data only on documented instructions from the Controller, including with regard to transfers to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Article 28(3)(a) GDPR).

3.2 The Controller’s documented instructions are: (a) this Agreement and the Main Agreement; (b) settings made and actions taken in the Service by the Controller’s Users within their permissions (e.g. uploading data, mapping, inviting a User, exporting, deleting); and (c) further instructions given by the Controller in writing, including electronically, through the contacts listed in Annex A, Part 2.

3.3 The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. The Processor may suspend the execution of such instruction until the Controller confirms or amends it.

3.4 The Processor may decline instructions that go beyond the functionality of the Service described in the Main Agreement, or carry them out for a fee agreed in advance. This does not affect the Processor’s obligations under the GDPR and this Agreement.

3.5 The Processor shall not use Controller Personal Data or other Controller data for its own purposes; in particular, it does not create aggregated or anonymised statistics or benchmarks from them and does not use them to train artificial-intelligence models. Article 2.3 is not affected.

Article 4 – Obligations of the Controller

4.1 The Controller is responsible for having a legal basis for the processing of Controller Personal Data, for data subjects having been duly informed of the processing, and for its instructions complying with the law.

4.2 The Controller shall upload to the Service only data needed for management reporting purposes. The Controller shall not knowingly upload special categories of personal data (Article 9 GDPR), personal data relating to criminal convictions and offences (Article 10 GDPR) or Czech birth numbers (rodná čísla), unless it expressly states so in Annex A, Part 2, in which case Annex D applies. The Controller acknowledges that payroll booked in detail (e.g. trade-union dues deductions or sick-pay compensation), texts of accounting documents and invoices to health insurers or named patients may contain such data, and shall preferably upload them in aggregated form. The prohibition in this paragraph does not relieve the Processor of the duty to implement reasonable technical measures (import warnings; no fields for birth numbers or diagnoses).

4.3 The Controller manages Users and their roles, ensures that only persons who need access to the Service have it, and revokes without undue delay the access of persons who no longer need it. The Controller is responsible for the conduct of its Users and shall ensure that they do not share their credentials or two-factor authentication devices.

4.4 The Controller shall notify the Processor without undue delay of any detected or suspected security breach affecting the Service or its Users' access credentials.

Article 5 – Confidentiality

5.1 The Processor shall ensure that persons authorised to process Controller Personal Data (employees, members of corporate bodies and external contractors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b) GDPR), and that such persons process Controller Personal Data only on the Processor’s instructions in accordance with this Agreement (Articles 29 and 32(4) GDPR).

5.2 Access to Controller Personal Data is limited to persons who need it to perform obligations under the Main Agreement or this Agreement. The Processor’s staff, including employees who operate the Service, access the Controller’s data in the Service only to provide support at the Controller’s request, to handle a security incident or to fix a fault in the Service; such access is logged. Those staff are bound by confidentiality and process the data only on the Processor’s instructions.

5.3 The duty of confidentiality survives the termination of this Agreement and the end of the employment or other relationship of the persons concerned with the Processor.

Article 6 – Security of processing

6.1 The Processor shall implement and maintain the technical and organisational measures under Article 32 GDPR described in Annex B, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks of varying likelihood and severity for the rights and freedoms of natural persons.

6.2 The Processor may change the measures in Annex B in line with technical developments, provided that the overall level of security is not reduced. The Processor shall notify the Controller of material changes by publishing an updated Annex B in the Service.

6.3 The Controller confirms that it has reviewed the measures in Annex B and considers them appropriate in view of the nature of the Controller Personal Data.

Article 7 – Sub-processors

7.1 The Controller grants the Processor a general written authorisation to engage Sub-processors (Article 28(2) GDPR). The Sub-processors as at the date of this Agreement are listed in Annex C; the Controller hereby approves their engagement.

7.2 The Processor shall notify the Controller of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the Controller’s administrators in the Service and by publishing the updated list at https://reporting.finance/legal/sub-processors. The notice shall state the Sub-processor’s name and seat, its activity, the categories of data processed, the location of processing and the safeguards for any transfer to a third country. Where a Sub-processor notifies changes to its own subcontractors at shorter notice, the Processor shall pass the notice on to the Controller without undue delay after receipt and, where the Sub-processor’s notice period allows, at least 14 days in advance; otherwise Article 7.4 applies mutatis mutandis.

7.3 The Controller may object to the change in writing on reasonable data-protection grounds within 14 days of the notice. The Parties shall discuss a solution in good faith (e.g. not using the affected feature for the Controller). If no agreement is reached by the date the change takes effect, the Controller may terminate the Main Agreement in respect of the affected Service with effect no later than that date, without penalty; the Processor shall refund the pro-rata portion of any prepaid fees for the unused period. If the Controller does not object within that period, it is deemed to have consented to the change.

7.4 Where a Sub-processor must be replaced urgently for security reasons or because it has ceased to provide its service, the Processor may make the change at shorter notice. It shall inform the Controller without undue delay; the Controller’s rights under Article 7.3 apply mutatis mutandis.

7.5 Features of the Service that require engaging a new Sub-processor or a new processing activity by a Sub-processor listed in Annex C (in particular future artificial-intelligence features) will be made available to the Controller only after the procedure under Articles 7.2 and 7.3 has been completed and, where such features are optional, only after the Controller’s administrator has switched them on. Artificial-intelligence features will use only services that are covered by the Sub-processor’s data processing terms and in which processing takes place in the European Union; Controller Personal Data will not be used to train artificial-intelligence models.

7.6 The Processor shall impose on each Sub-processor, by contract, the same data protection obligations as those binding the Processor under this Agreement, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures (Article 28(4) GDPR). For Sub-processors providing standardised cloud services, the Processor may rely on their standard data processing terms, provided they meet the requirements of Article 28 GDPR. Material differences from the time limits and rights in this Agreement (in particular on incidents, deletion, audits and sub-processor changes) are set out in Annex C. The Processor remains fully liable to the Controller for the performance of the Sub-processor’s obligations.

Article 8 – Transfers to third countries

8.1 The Processor stores Controller Personal Data within the European Economic Area, primarily in the Google Cloud data centre region europe-west3 (Frankfurt am Main, Germany); other processing locations are set out in Annex C. Transfers to a third country or an international organisation are permitted only under the conditions of Chapter V GDPR (Articles 44 to 49).

8.2 The Controller acknowledges and authorises the transfers listed in Annex C, which rely on: (a) a Commission adequacy decision under Article 45 GDPR, in particular Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework; or (b) the standard contractual clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Article 46(2)(c) GDPR), with supplementary measures where required.

8.3 If a transfer mechanism relied upon ceases to be effective (e.g. because an adequacy decision is invalidated), the Processor shall without undue delay put in place another mechanism under Chapter V GDPR or stop the transfer concerned, and inform the Controller of the solution adopted.

8.4 Where required for a transfer under Annex C, the Processor may conclude the standard contractual clauses (Module Three – processor to processor) with the Sub-processor in its own name.

Article 9 – Data subject rights

9.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR (Article 28(3)(e) GDPR).

9.2 The Processor provides this assistance primarily through features of the Service (viewing and exporting data, deleting import batches, managing Users) and, where such features are not available, upon the Controller’s request sent to the Processor’s support. The Controller acknowledges that Controller Personal Data in the Service are copies of accounting records kept in its accounting software; rectification therefore normally has to be made in the source system and the data re-uploaded to the Service.

9.3 If the Processor receives a request directly from a data subject, it shall forward it to the Controller without undue delay and shall not respond to it on the merits unless authorised by the Controller to do so.

Article 10 – Further assistance

10.1 Taking into account the nature of the processing and the information available to it, the Processor shall provide the Controller with reasonable assistance in ensuring compliance with the obligations under Articles 32 to 36 GDPR, in particular with data protection impact assessments and prior consultation with the supervisory authority (Article 28(3)(f) GDPR).

10.2 Assistance consisting in providing existing documentation (this Agreement, its annexes, documentation of Sub-processors) is provided free of charge. The Processor may charge for more extensive assistance at a rate communicated in advance; this does not apply where the need for assistance results from the Processor’s breach of its obligations.

Article 11 – Personal data breaches

11.1 The Processor shall notify the Controller of a personal data breach affecting Controller Personal Data without undue delay after becoming aware of it (Article 33(2) GDPR) and in any event within 48 hours of the Processor becoming aware. The Processor is also deemed aware when it receives notice from a Sub-processor. The notice shall be sent to the security notification email address stated in Annex A, Part 2, and to the Controller’s administrators in the Service; where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the Processor shall also try to reach the Controller by telephone. The 48-hour period binds the Processor, not a Sub-processor whose own period may be longer; the Processor shall pass on the information available and supplement it under Article 11.2.

11.2 The notice shall contain, where possible, the information referred to in Article 33(3) GDPR, in particular a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed. Where it is not possible to provide the information at the same time, the Processor shall provide it in phases without undue further delay (Article 33(4) GDPR).

11.3 The Processor shall promptly take reasonable measures to contain the breach and mitigate its possible adverse effects, document them and assist the Controller in notifying the breach to the supervisory authority and communicating it to data subjects (Articles 33 and 34 GDPR). The decision on notification and communication rests with the Controller.

11.4 Without the Controller’s prior consent, the Processor shall not inform third parties of a breach affecting Controller Personal Data, except its professional advisers, the Sub-processors concerned and public authorities where required by law.

11.5 The Processor’s notification of a breach does not in itself constitute an acknowledgement of fault or liability.

Article 12 – Information and audits

12.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (Article 28(3)(h) GDPR), on the terms of this Article.

12.2 The Controller shall first rely on: (a) this Agreement and its annexes; (b) the Processor’s written answers to a reasonable security questionnaire, no more than once every 12 months; and (c) certifications and audit reports of Sub-processors (e.g. ISO/IEC 27001 and SOC 2 for Google Cloud), to the extent the Processor may share them with the Controller.

12.3 If the information under Article 12.2 is not sufficient to demonstrate compliance, the Controller may conduct an audit or inspection on the following terms: (a) no more than once every 12 months, unless ordered by a supervisory authority or following a personal data breach affecting Controller Personal Data; (b) with written notice of at least 30 days, including a proposed scope; (c) on Business Days during normal business hours, preferably remotely and without disrupting the Service; (d) the auditor is bound by confidentiality and is not a competitor of the Processor; (e) the audit does not extend to other customers' data or to Sub-processors' data centres, for which their audit reports are used. This clause does not limit the powers of a supervisory authority.

12.4 The Controller bears the costs of the audit. If the Processor’s assistance with the audit exceeds one person-day, the Processor may charge a reasonable fee at a rate communicated in advance. If the audit reveals a material breach of this Agreement by the Processor, the Processor bears its own costs and the reasonable costs of the audit and shall remedy the breach without undue delay. The Processor also bears the costs where the audit was triggered by a personal data breach it caused.

12.5 The Processor maintains a record of the categories of processing activities carried out on behalf of the Controller (Article 30(2) GDPR) and cooperates with the supervisory authority on request (Article 31 GDPR).

Article 13 – Term

13.1 This Agreement takes effect upon its conclusion under Article 16 and is concluded for the term of the Main Agreement. Where the Processor processed Controller Personal Data before this Agreement was concluded, or processes it without a Main Agreement (e.g. during a trial), this Agreement also applies to such processing.

13.2 If the Processor materially breaches this Agreement and fails to remedy the breach within 30 days of the Controller’s written notice, the Controller may terminate this Agreement and the Main Agreement with immediate effect.

13.3 Provisions which by their nature are intended to survive termination (in particular Articles 5, 6, 8, 11, 14, 15 and 18) survive until all Controller Personal Data have been returned or deleted or, where relevant, for as long as needed to assert claims; Article 5.3 is not affected.

Article 14 – Return and deletion of personal data

14.1 During the term of this Agreement, the Controller may at any time export reports from the Service (in particular in Excel format) and download uploaded source files, mapping tables and the chart of accounts in a machine-readable format (XLSX or CSV).

14.2 After the Main Agreement ends, the Controller has read-only access to the Service for 30 days for export purposes (the “Export Period”). At the Controller’s request made during the Export Period, the Processor shall provide once, free of charge, a complete export package (original uploaded files, mapping tables and the chart of accounts in XLSX or CSV format, and the audit log) within 10 Business Days of the request.

14.3 After the Export Period the Processor shall logically delete or anonymise Controller Personal Data in the Service within 30 days. Automated database backups (Cloud SQL) are retained for 7 days and then expire in that cycle. Residual copies in a Sub-processor’s infrastructure (Google Cloud) may be physically erased only in that provider’s standard cycle, which the provider states may take up to 180 days; the Processor does not access those copies to provide the Service.

14.4 The Controller may request earlier deletion in writing; the Export Period ends on the day the request is received; if the request is made during the term of the Main Agreement, the period under Article 14.3 runs from its receipt. At the Controller’s request, the Processor shall confirm the deletion in writing (email sufficing).

14.5 The deletion duty does not apply to data the Processor must keep by law, or to data the Processor processes as an independent controller under Article 2.3 (in particular the record of acceptance of this Agreement, billing data and security logs). The acceptance record is kept for the term of the Agreement and 10 years after it ends, sign-in security logs as a rule for 12 months, and invoices for the period required by tax law.

Article 15 – Liability

15.1 The Parties' liability for harm caused by a breach of this Agreement is governed by the provisions of the Main Agreement on liability and its limitation; for this purpose, this Agreement is deemed to form part of the Main Agreement.

15.2 The Processor’s aggregate liability to the Controller for all claims under this Agreement and the Main Agreement is limited to the higher of: (a) the fees paid by the Controller for the Service in the 12 months preceding the event giving rise to the claim; and (b) EUR 10,000. During the Beta Period and for free use of the Service, including use under the Beta Terms, liability is limited to CZK 25,000. Article 7.2 of the Beta Terms and Article 14.2 of the Terms set the same limit. Administrative fines imposed on the Processor and compensation the Processor has paid to data subjects under Article 82 GDPR solely by reason of its own conduct do not count towards the limit under this Article.

15.3 The limitation of liability does not apply to harm caused intentionally or by gross negligence, to harm to a person’s natural rights or in other cases where limitation is excluded by law (Section 2898 of Act No. 89/2012 Coll., the Civil Code). This provision does not affect the Parties' liability towards data subjects under Article 82 GDPR.

15.4 Where one Party has paid full compensation to a data subject for harm for which the other Party is also liable, it may claim back from the other Party the part of the compensation corresponding to the other Party’s share of responsibility (Article 82(5) GDPR). An administrative fine is borne by the Party on which it was imposed.

Article 16 – Electronic conclusion

16.1 This Agreement may be concluded: (a) by electronic acceptance in the Service under Article 16.2; or (b) by signature of both Parties, either handwritten or by an electronic signature under Regulation (EU) No 910/2014 of the European Parliament and of the Council (eIDAS), as amended.

16.2 By making this Agreement available in the Service the Processor offers to conclude it. The Controller accepts the offer when a person authorised to act on its behalf: (a) is signed in to his or her user account in the Service with the administrator role and that account has active two-factor authentication (TOTP); (b) enters or confirms his or her name, position and the Controller’s identification details and selects the basis of authority (member of the statutory body, registered proxy (prokurista), attorney-in-fact); (c) confirms that he or she is authorised to conclude this Agreement on behalf of the Controller; (d) confirms that he or she has read this Agreement including its annexes and accepts it on behalf of the Controller, and that he or she is aware of the provisions under which changes are deemed accepted unless rejected (Articles 7.3 and 17.3) and of the provisions on group companies (Article 2.2); and (e) clicks the button “Accept on behalf of the Controller”. Where “attorney-in-fact” is selected, the Processor may require a power of attorney to be uploaded. The Agreement is concluded when the Service records the acceptance.

16.3 The Service creates a record of the acceptance containing in particular the Controller’s identification details, the name, position and email address of the accepting person, the identifier of his or her user account, the date and time of acceptance (UTC), the IP address, browser identification, the version identifier of this Agreement and a checksum (hash) of its text. The record is kept systematically, in chronological order and protected against alteration.

16.4 The Parties agree that an Agreement concluded under Article 16.2 is concluded in written form within the meaning of Section 562(1) of Act No. 89/2012 Coll., the Civil Code, and Article 28(9) GDPR, since this method allows the content of the legal act to be captured and the acting person to be identified, and that the record under Article 16.3 is a reliable record within the meaning of Section 562(2) of the Civil Code.

16.5 Without undue delay, and no later than 24 hours after acceptance, the Service shall send to the accepting person, the Controller’s administrators and the Processor an email confirming the conclusion of the Agreement with a PDF copy of the Agreement, including the data from the record under Article 16.3. The version of the Agreement applicable to the Controller and the acceptance record remain permanently available to the Controller in the Service.

16.6 The accepting person represents that he or she is authorised to act on behalf of the Controller, in particular as a member of its statutory body, as a registered proxy (prokurista) or under a power of attorney. The Processor may request evidence of such authority or ask for the Agreement to be concluded under Article 16.1(b). If the Controller becomes aware that the accepting person was not authorised, it shall notify the Processor without undue delay. The Controller’s statutory body may ratify the act in the Service within 15 Business Days of the Processor’s request. If authority is neither evidenced nor the act ratified, the Agreement is treated as not concluded and the Processor may suspend processing until it is concluded by a person with authority. The Controller’s silence alone is not ratification.

Article 17 – Amendments

17.1 The Processor concludes this Agreement in the ordinary course of business with a larger number of customers, and a reasonable need for later amendments is apparent at the time of conclusion, in particular due to changes in legislation, decisions of public authorities, technical development of the Service or changes of Sub-processors. The Processor may therefore amend this Agreement to a reasonable extent (Section 1752 of the Civil Code).

17.2 The Processor shall notify an amendment at least 30 days before it takes effect, by email to the Controller’s administrators and by a notice in the Service; the notice shall include the new version and a summary of the changes. The Processor may also ask the Controller to accept the new version using the procedure in Article 16.

17.3 The Controller may reject the amendment and, for that reason, terminate the Main Agreement and this Agreement with a notice period of three months, during which the existing version applies; the Processor shall refund the pro-rata portion of prepaid fees for the period after the Agreement ends. The Processor may require a material change to the processing (a new purpose, a new special category of data, a new transfer mechanism outside the EEA) to be accepted again under Article 16. If the Controller does not reject the amendment in writing before it takes effect and a fresh acceptance is not required, the Controller is deemed to have accepted it.

17.4 Amendments required by changes in law or by a decision of a supervisory authority may take effect earlier where the law or decision so requires. Changes to Annex C are governed by Article 7. The details in Annex A, Part 2, are updated by the Controller’s administrator in the Service or notified by the Controller to the Processor in writing. Other amendments to this Agreement require a written agreement of the Parties, which may be in electronic form.

Article 18 – Governing law and disputes

18.1 This Agreement is governed by the laws of the Czech Republic, excluding its conflict-of-laws rules, in particular Act No. 89/2012 Coll., the Civil Code, the GDPR and Act No. 110/2019 Coll., on the Processing of Personal Data.

18.2 Disputes arising from this Agreement shall be decided by the courts of the Czech Republic. In accordance with Section 89a of Act No. 99/1963 Coll., the Code of Civil Procedure, the Parties agree that the court of first instance having local jurisdiction shall be the court competent for the Processor’s registered office. Where the Controller has its seat outside the Czech Republic, this also constitutes a choice-of-court agreement under Article 25 of Regulation (EU) No 1215/2012 of the European Parliament and of the Council, where applicable.

Article 19 – Final provisions

19.1 In the event of conflict between this Agreement and the Main Agreement, this Agreement prevails in matters of personal data protection. Where standard contractual clauses apply between the Parties, they prevail over this Agreement in the event of conflict.

19.2 This Agreement is made in the Czech and English languages. In the event of any discrepancy between the language versions, the Czech version prevails.

19.3 If any provision of this Agreement is or becomes invalid or ineffective, the remaining provisions are not affected. The Parties shall replace it with a provision that comes closest to its purpose.

19.4 Notices under this Agreement shall be given in writing, including by email, to the email of the data protection contact stated in Annex A, Part 2, and to the Processor at privacy@reporting.finance.

19.5 This Agreement supersedes all prior arrangements between the Parties on the processing of Controller Personal Data.

Signatures (only where concluded under Article 16.1(b); not used for electronic acceptance)

Za Zpracovatele / For the Processor
V Praze dne [●] / In Prague on [●]

______________________________
Anna Dempsey, jednatelka / executive director

Annex A – Description of processing

Part 1 – General description (applies to all customers)

Subject matter: Provision of the Service: a web-based management reporting platform operating on the Controller’s accounting data (POHODA, Money S3 and other supported accounting systems).

Nature of processing: Receipt of uploaded files (or retrieval from a connected data source of the Controller, where agreed), storage, structuring, mapping to a common chart of accounts, aggregation, consolidation, calculation of indicators, display to Users, export (Excel), backup, sending of transactional emails (invitations, password resets), deletion.

Purpose of processing: Preparation of the Controller’s management reports (profit and loss, balance sheet, cash flow, consolidation, KPIs); administration of User access and security of the Service; support at the Controller’s request.

Data uploaded: Accounting journal, chart of accounts, cost centres (střediska), activities, contracts and other code lists from the accounting system; optionally hotel operating statistics from the property management system (PMS); budgets.

Categories of data subjects: (a) the Controller’s suppliers and customers who are natural persons, including sole traders, and contact persons of business partners named in document texts; (b) the Controller’s employees and members of its corporate bodies, where salaries or remuneration are booked individually; (c) guests and other customers named on documents; (d) Users of the Service.

Categories of personal data: (a)–(c): name, company and VAT IDs, address, document numbers, dates, amounts, texts of accounting entries and documents, accounts and cost centres; for (b) also salary and remuneration amounts where so booked. (d): name, email, role, language, sign-in times and results, IP address and browser identification, two-factor (TOTP) settings, audit records of imports, mapping changes and role changes. The Processor also processes sign-in security records as an independent controller (Article 2.3(c)).

Special categories of data: Not intended (see Article 4.2). Any exceptions are stated by the Controller in Part 2 and are governed by Annex D.

Frequency and duration: Continuously during the term of the Main Agreement and the Export Period; deletion under Article 14.

Location of processing: EEA – Google Cloud, region europe-west3 (Frankfurt, Germany); transfers outside the EEA only as set out in Annex C.

Part 2 – Controller details (completed by the Controller in the Service or in this document)

• Client group in the Service: [●]
• Companies whose data the Controller uploads (name, company ID): [●]
• Confirmation of authority for each further company (Article 2.2) – in the Service / by accession: [●]
• Source systems (POHODA / Money S3 / other) and any connected data source: [●]
• Data from (period): [●]
• Payroll booked per person? (yes / no): [●]
• PMS operating statistics? (yes / no): [●]
• May the data contain special categories or birth numbers? (no / yes – description; Annex D applies): [●]
• Healthcare provider, health insurer or similar? (no / yes – Annex D applies): [●]
• Data protection contact (name, email, phone): [●]
• Data protection officer, if appointed: [●]
• Email for security notices (Article 11): [●]
• Contact for instructions (Article 3.2(c)): [●]

Annex B – Technical and organisational measures (Article 32 GDPR)

1. Separation of client data

Each client group’s data are separated at row level in the database (PostgreSQL row-level security); the application and batch jobs always operate in the context of a single client group, and this requirement is verified by automated tests.
Development uses fictitious or demo data. The staging environment runs in the same region with the same measures; Controller data may be placed there only with the Controller’s prior written consent (e.g. for acceptance testing) and are deleted when testing ends.

2. Access control and authentication

Role-based access (admin, editor, viewer); Users are invited and their roles managed by the Controller’s administrator.
Mandatory two-factor authentication (TOTP, authenticator app with a QR code at set-up) for admins, editors and the Processor’s staff; two-factor authentication is available to viewers but not mandatory. TOTP secrets are stored encrypted in the database.
Rate-limited sign-in; passwords are stored only as salted hashes using the framework’s standard algorithm.
The administration interface is protected by the same two-factor authentication. Acceptance of this Agreement in the Service requires the administrator’s active TOTP.
On import, the Service warns if a column header suggests a birth number or diagnosis; the Service has no fields for birth numbers or diagnoses.

3. Processor staff access

The Processor’s staff access Controller data only for support at the Controller’s request, incident handling or fault resolution; they are bound by confidentiality.
Access to the cloud infrastructure is limited to the persons and service accounts that need it, with least privilege; deployments run without long-lived keys (Workload Identity Federation).
Staff devices on which Controller data may be temporarily stored during support have disk encryption, screen lock and up-to-date software; such data are deleted once the request is resolved.
The Processor’s staff do not enter Controller data into artificial-intelligence tools or other third-party services not listed in Annex C; general-purpose AI tools (e.g. for development and testing) are used only with fictitious or demo data.

4. Encryption and transmission

All communication with the Service is encrypted (HTTPS/TLS); application services are reachable only through the load balancer.
Data are encrypted at rest in Google Cloud storage (database, file storage, backups).
Credentials and keys are stored in Secret Manager, with pinned versions and controlled access.

5. Integrity and audit trail

Uploaded files are stored with a SHA-256 checksum.
Audit log of imports, mapping changes and User role changes; sign-in records.
Code changes go through review and automated tests and are deployed to the staging environment first.

6. Availability and recovery

Managed Google Cloud infrastructure in region europe-west3; automated database backups (Cloud SQL) retained for 7 days, with point-in-time recovery.
The restore-from-backup procedure is documented and tested at least annually.
At the Controller’s request an individual import batch can be deleted; the deletion reaches backups in their normal cycle (Article 14.3).

7. Data location

The database, files and backups are stored in the EEA (europe-west3, Frankfurt). Google’s network infrastructure (global load balancer) may terminate the encrypted connection at the nearest Google network edge; data are not stored there.

8. Organisational measures

Incident response procedure including notification to the Controller within 48 hours (Article 11).
Confidentiality undertakings from all persons with access to data; data protection instructions.
Selection and review of Sub-processors (Annex C), preferring EEA storage and ISO/IEC 27001 or SOC 2 certification.
Records of processing activities (Article 30(2) GDPR) and the post-termination deletion procedure (Article 14).
Source code is kept in a private repository and contains no customer data.

Annex C – Sub-processors

Status as at: 30 September 2026. Current list: https://reporting.finance/legal/sub-processors.

Sub-processor	Activity	Data	Location	Transfer safeguards
Google Cloud EMEA Limited, Dublin, Ireland (and its affiliates incl. Google LLC, USA)	Cloud infrastructure: Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, Secret Manager, load balancing, logging	All Controller Personal Data	EEA – europe-west3 (Frankfurt); Google support access and network edge may be outside the EEA	Cloud Data Processing Addendum; EU-U.S. DPF (Google LLC certified); standard contractual clauses
Plus Five Five, Inc. (Resend), San Francisco, USA	Sending transactional emails (invitations, password resets, acceptance confirmations)	Recipient name and email, email content, delivery logs; no accounting data	Sending from the EU region (where configured); account management and logs in the USA	EU-U.S. DPF (certified); standard contractual clauses in Resend’s DPA
Microsoft Ireland Operations Limited, Dublin, Ireland	Support mailbox (Microsoft 365 / Exchange Online)	Content of emails the Controller or Users send to support (including any attachments)	EEA (EU Data Boundary); limited exceptions under Microsoft’s terms	Microsoft Products and Services DPA; EU-U.S. DPF (Microsoft Corporation certified); standard contractual clauses

Not Sub-processors (no Controller Personal Data): GitHub (source code), domain registrar.

Planned artificial-intelligence features will use models (including Anthropic’s Claude models) provided by Google through Vertex AI with an EU endpoint; processing is governed by the Google Cloud terms above. This new processing activity will start only after notice under Article 7.2 and in accordance with Article 7.5.

The Processor recommends sending accounting data only by uploading it to the Service, not by email.

Differences between the Sub-processors’ standard terms and this Agreement, for which the Processor remains liable to the Controller (Article 7.6): Google Cloud notifies incidents “promptly and without undue delay” (not within 48 hours), provides audits primarily through audit reports, physically erases data up to 180 days after deletion and typically gives 30 days’ notice of sub-processor changes. Resend typically gives 14 days’ notice of sub-processor changes; its primary operations and logs are in the USA, while sending may use an EU region. Microsoft 365: EU Data Boundary with limited exceptions under Microsoft’s terms. The Processor shall verify the DPF list entries (Plus Five Five, Inc.; Google LLC; Microsoft Corporation) before first use and keep a copy.

Annex D – Supplementary measures for health and similar data

Applies only where so stated in Annex A, Part 2, or where the Parties expressly attach it.

D.1 Subject and application. This annex applies where the Controller states in Annex A, Part 2 that uploaded data may contain special categories of personal data or birth numbers, or that it is a healthcare provider, health insurer or a person processing patient data, or where the Parties expressly attach this annex. This Agreement applies except as this annex provides otherwise.

D.2 Purpose and what the Service is not. The purpose of processing remains management reporting (revenue, cost, cost centres, consolidation, KPIs). The Service is not a medical record, a clinical information system or a tool for providing healthcare. The Processor does not decide which patient or insurance data the Controller may upload.

D.3 Controller instructions. The Controller shall preferably upload aggregated data (turnover by cost centre, procedure counts without patient names, payroll in total). It shall not knowingly upload: health records, diagnoses, procedure codes linked to a patient name, birth numbers, test results, patient photographs. It is accepted that the text of an invoice to a health insurer or a named patient may reveal health data; such data are processed only as part of the accounting record for reporting and only where so stated in Annex A, Part 2.

D.4 Roles and legal bases. The Controller is responsible for the legal basis including Article 9(2) GDPR (typically healthcare, employment law or explicit consent, depending on its activity) and for informing patients, employees and other data subjects. The Processor does not review those bases. If the Controller is itself a processor for another provider, it shall ensure that its contract with that provider permits engaging the Processor and this annex.

D.5 Supplementary technical and organisational measures. In addition to Annex B: (a) the Service has no fields for birth number, diagnosis or ICD code; (b) import shows a warning if a column header matches a birth number or the word “diagnosis”; (c) Processor staff access only on a support ticket or incident, and is logged; (d) Controller data are not stored permanently on portable devices – a temporary export on an encrypted disk is deleted after the ticket; (e) staging only with prior written consent and subsequent deletion; (f) artificial-intelligence features stay off for this Controller until the Controller gives separate consent after an impact assessment.

D.6 Impact assessment and assistance. The Processor recommends that the Controller carry out a data-protection impact assessment (Article 35 GDPR) if it will regularly upload identifiable health or insurance data. Assistance under Article 10 of this Agreement includes providing this annex, Annexes B and C and a description of data flows in the Service. The assessment itself is the Controller’s.

D.7 Breach and deletion. A notice under Article 11 of this Agreement for this Controller always states whether the breach may have affected health or similar data. The Controller may request early deletion of a specific import batch; the Processor shall delete it without undue delay and within 15 days, subject to backups under Article 14.3 of this Agreement.

D.8 Group companies. Each legal entity whose data are uploaded must be listed in Annex A, Part 2. The Controller shall confirm authority for each of them in the Service, or that entity shall accede to this Agreement and this annex. Until then the Processor may suspend uploads of that entity’s data. One company’s representation does not replace instructions from the others.

D.9 Severability. If any provision of this annex is invalid or ineffective, the other provisions of this annex and of this Agreement are not affected. In the event of conflict between this annex and this Agreement, this annex prevails for health and similar data.