Data Processing Agreement
Version of 26 October 2026 · pursuant to Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") · also known as personuppgiftsbiträdesavtal (SE), verwerkersovereenkomst (NL), databehandleravtale (NO), Auftragsverarbeitungsvertrag (AVV, DE)
This page keeps the text of this version unchanged. The current version is at dpa.html.
between the customer that accepts this agreement when starting Itogix on eu.itogix.com — the "Controller" — and CaviTech GmbH, Sterngasse 3/2/6, 1010 Vienna, Austria, FN 458635 p, Commercial Court of Vienna — the "Processor" or "Itogix". This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Main Agreement"). It is concluded electronically (Article 28(9) GDPR); Itogix keeps a record of the acceptance.
1. Subject matter and duration
1.1 The Processor provides the Itogix service: it obtains the Controller's accounting data — either (a) from the Controller's Microsoft Dynamics 365 Business Central environment through the Microsoft API, or (b) from ledger exports that the Controller's users upload (SIE 4, XAF auditfile, SAF-T Financial, DATEV format, FEC) — reconciles it, calculates management reports and presents them to the Controller's authorised users in a web dashboard (the "Service"). In doing so the Processor processes personal data on behalf of the Controller.
1.2 The nature, purpose and scope of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
1.3 This DPA applies for as long as the Processor processes personal data on behalf of the Controller under the Main Agreement, including the deletion period in clause 9.
2. Instructions
2.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Processor is subject; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits it.
2.2 The Main Agreement, this DPA and the Controller's use and configuration of the Service (including connecting a Business Central environment, uploading ledger exports, inviting users and requesting deletion) are the Controller's documented instructions. Further instructions are given in text form; e-mail suffices.
2.3 The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
3. Controller's responsibilities
3.1 The Controller is responsible for the lawfulness of the processing, including the legal basis for making the accounting data available to the Processor, and for the accuracy of the data in its accounting records.
3.2 Business Central. The Controller decides which Business Central environment and company are connected and which permission set the Itogix application receives. The Service is designed for read-only access (permission set "D365 READ"). The Controller can revoke the access at any time in Business Central or in Microsoft Entra.
3.3 Ledger exports. The Controller decides which exports and which fiscal years its users upload. Standard exports contain more than the Service needs to calculate the reports, in particular the master data of customers and suppliers (names, addresses, VAT and registration numbers); the Service stores them as set out in Annex I. The Controller can have the stored exports deleted at any time.
3.4 The Service is not designed to process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). The Controller should avoid recording such data in posting descriptions of the companies it connects or whose exports it uploads.
4. Confidentiality
The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to the persons who need it to operate and support the Service.
5. Security of processing
5.1 The Processor implements the technical and organisational measures set out in Annex II to ensure a level of security appropriate to the risk (Article 32 GDPR).
5.2 The Processor may update the measures as technology develops, provided the level of security is not reduced. Material changes are notified to the Controller by e-mail.
6. Sub-processors
6.1 The Controller gives general authorisation for the Processor to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex III.
6.2 The Processor informs the Controller at least 30 days in advance of any intended addition or replacement of a sub-processor. The Controller may object on reasonable data protection grounds within 14 days; if the Parties cannot resolve the objection, the Controller may terminate the affected part of the Main Agreement without penalty.
6.3 The Processor imposes on each sub-processor, by contract, data protection obligations that provide at least the same level of protection as this DPA, and remains liable to the Controller for the performance of the sub-processor's obligations.
7. International transfers
7.1 The personal data is stored and processed in the European Economic Area (EEA). Any transfer of personal data to a country outside the EEA, including access from such a country, takes place only in compliance with Chapter V GDPR (for example an adequacy decision or the Standard Contractual Clauses adopted by the European Commission, supplemented by measures where needed).
8. Assistance to the Controller
8.1 Data subject requests. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests to exercise data subject rights (Chapter III GDPR). Requests received directly by the Processor are forwarded to the Controller without undue delay and are not answered by the Processor unless the Controller instructs it to.
8.2 Other obligations. The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Processor.
8.3 Personal data breaches. The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided in phases without undue delay.
9. Deletion and return
9.1 On termination of the Service, or earlier on the Controller's request, the Processor deletes the Controller's environment, including all personal data, within 30 days, unless Union or Member State law requires storage. On request made before termination, the Processor first provides an export of the reports held in the Service in Excel format.
9.2 Backup copies are deleted as the backup cycle rotates, at the latest 14 days after the deletion under 9.1, plus up to 7 days for the hosting provider's server backups. Until then they remain protected under this DPA and are not used for any other purpose.
9.3 The Processor confirms the deletion in writing on request.
10. Information and audits
10.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, in particular a description of the current technical and organisational measures and the current list of sub-processors.
10.2 The Processor allows for and contributes to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, with at least 30 days' notice, during business hours, no more than once a year unless required by a supervisory authority or after a personal data breach, and subject to confidentiality. Each Party bears its own costs.
11. Records and cooperation
The Processor maintains a record of processing activities carried out on behalf of the Controller (Article 30(2) GDPR) and cooperates with the supervisory authority on request.
12. Liability and precedence
12.1 Liability is governed by the Main Agreement and Article 82 GDPR.
12.2 In case of conflict, this DPA prevails over the Main Agreement with regard to the processing of personal data.
13. Final provisions
13.1 This DPA is governed by the law of Austria. Place of jurisdiction: Vienna.
13.2 Amendments require text form; e-mail suffices. Changes follow the procedure of the Main Agreement.
13.3 If any provision is invalid, the remaining provisions remain in force.
Annex I — Description of the processing
| Nature of the processing | Retrieval over the Microsoft Business Central API (read-only) or receipt of ledger exports uploaded by the Controller's users; storage, reconciliation, calculation, presentation in a web dashboard, downloads of the reports (Excel, presentation files) on request, sending one-time sign-in codes, invitations, reminders to upload the month's export and e-mails about the month to the Controller's users (a month is ready, with its key figures; a month already shown as final has changed; each with a link to stop them) by e-mail, deletion. |
|---|---|
| Purpose | Providing management reporting and month-close status to the Controller based on its accounting records. |
| Frequency | Continuous. Business Central: an automatic extract every night and on request. Ledger exports: whenever the Controller's users upload one (typically once a month after the month is closed). Dashboard access by authorised users at any time. |
| Categories of data subjects | (a) the Controller's authorised users of the dashboard (employees, advisers, its accountant); (b) natural persons who appear in the Controller's accounting records — for example sole traders as customers or suppliers, contact persons, or employees named in posting descriptions or document references. |
| Categories of personal data | (a) Users: e-mail address, name if provided, role, sign-in time, IP address in security logs, one-time sign-in codes (stored only as salted hashes, valid 15 minutes). (b) Accounting records: names or identifiers contained in posting descriptions and document numbers, together with dates and amounts of the entries. (c) Business Central: the connector reads customer and vendor names of unposted documents only transiently; they are not stored; the Service does not request customer, vendor, employee or payroll master data. (d) Ledger exports: the whole export as uploaded, including customer and supplier master data where the format contains it (names, addresses, VAT and registration numbers — SAF-T and XAF in particular); customer and supplier names with their turnover and open balances are shown in the dashboard (customers and suppliers report). |
| Special categories | None intended (see clause 3.4). |
| Retention | For the duration of the Main Agreement; deletion as in clause 9. Raw extracts from Business Central are deleted immediately after they have been accepted. Ledger exports: the latest export (one file or a set of files) of each fiscal year is kept, encrypted, so that the reports can be rebuilt; an earlier export of the same year is replaced; the Controller's administrator can have the stored exports deleted at any time; all are deleted with the environment (clause 9). |
| Location | Germany (EEA). |
Annex II — Technical and organisational measures
- Hosting and physical security. Virtual server at Hetzner Online GmbH in its data centre in Nuremberg, Germany. Physical access control, power, cooling and fire protection are provided by the data centre operator.
- Server access. Administrative access only over SSH with personal keys; password logins and direct root logins are disabled. Firewall: only SSH and HTTPS (HTTP for certificate issuance and redirect) are reachable from the internet; application processes listen on the local interface only, behind a TLS reverse proxy. Operating-system security updates are installed automatically. Administrative access is limited to the Processor's technical staff.
- Encryption in transit. HTTPS (TLS, HSTS) for all dashboard traffic; TLS for all calls to the Microsoft APIs and to the e-mail provider.
- Encryption at rest. Uploaded ledger exports are stored encrypted (authenticated encryption with an application key that is kept on the server outside the customers' environments). Other data (reports, imported packages, users, logs) is not encrypted at rest; it is protected by the access controls described here.
- Credentials. The Itogix application secret for Microsoft Entra is stored only on the server, in a file readable by the nightly sync job; the dashboard processes cannot access it. The Processor holds no Business Central user passwords of the Controller and no credentials of the Controller's accounting program (exports are uploaded by the Controller's users). Dashboard users sign in with one-time e-mail codes; there are no stored user passwords.
- Separation. Each customer has its own environment (separate directory and application process). The public demonstration (a fictional company, no real data) runs in an isolated process that cannot see other environments, keys or backups.
- Access control in the Service. Two roles, managed by the Controller's administrator: administrator (users, data and settings) and user (views the reports and downloads exports). Sign-in codes valid 15 minutes, stored only as salted hashes, void after five wrong attempts, with rate limiting; secure, HTTP-only, same-site session cookies.
- Logging. Each environment keeps an audit log of sign-ins, data imports, uploads, deletions and user management. The web front end keeps no access logs with visitors' IP addresses.
- Data minimisation. The Business Central connector reads ledger-level data only (see Annex I); extracts and intermediate packages are deleted after import. Of the uploaded exports only the latest of each fiscal year is kept; uploads are limited in size, and an upload that is not a ledger export of the environment's company and format is refused and not stored.
- Integrity. Every imported month is reconciled before it is shown: against the Business Central trial balance to the cent, or, for uploaded exports, against the totals and balances contained in the file where the format provides them; a month that does not reconcile is marked on the screen. Deployments of the software are built from version control and verified against a digest of the code.
- Availability and backups. Daily backups of each environment, kept for 14 days on the server, and daily backups of the whole server by the hosting provider (Hetzner Cloud Backups, the last seven kept, in the same data-centre location). Automated monitoring every five minutes e-mails the Processor's staff about failed services, environments, imports (uploads and nightly synchronisation), backups, certificates, disk space and processes stopped for lack of memory; a failed import is also shown to the Controller's users in the Service.
- Incident handling. Personal data breaches are assessed and notified as in clause 8.3.
- Deletion. At the end of the contract the whole environment (service, web address, data, users, logs, local backups) is deleted by an automated daily job 30 days after the contract end; the Processor's staff are notified 7 days in advance and of the result.
- Personnel. Confidentiality undertakings for everyone with access; access withdrawn when no longer needed.
Annex III — Sub-processors
| Sub-processor | Location | Service | Data concerned |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Germany (data centre Nuremberg) | Hosting (virtual server, daily server backups) | All data of the Service (stored on the server) |
| Sendinblue SAS (Brevo), Paris, France | France (EU) | Transactional e-mail: sign-in codes, invitations, upload reminders, e-mails about the month | Recipient e-mail address, message content (code, link, company name, month; in e-mails about the month also the month's revenue, net profit, cash and revised figures, as on the dashboard) |
| EuroDNS S.A., Luxembourg; Google (Gmail) | Luxembourg; Google: EU and United States (EU–US Data Privacy Framework) | Support e-mail: messages to hello@itogix.com are forwarded to the support team's mailbox | Only what the Controller chooses to send by e-mail. Ledger exports are uploaded in the Service, not sent by e-mail. |
Not sub-processors: Microsoft — Business Central and Microsoft Entra are the Controller's own services under the Controller's agreement with Microsoft; Itogix accesses them on the Controller's instruction. Let's Encrypt (ISRG) — issues TLS certificates for host names; no personal data. No AI or large-language-model provider receives the Controller's data; if that changes, it will be added here under clause 6.2.