Article I. Introductory Provisions
Article 28(3) of the GDPR establishes the obligation of the Controller to conclude a Data Processing Agreement with the Processor before the commencement of personal data processing, at the latest on the day the processing begins.
This Agreement replaces any previous agreements related to the processing of personal data within the management of the Controller.
This Agreement forms Annex No. 2 to the framework agreement on accounting services.
Article II. Subject of the Agreement
The subject of this Agreement is the regulation of the rights and obligations of the Controller and the Processor in relation to the processing of the Controller’s personal data by the Processor.
The data processing subject to this Agreement concerns the personal data of data subjects as further specified in this Agreement. Data processing under this Agreement involves operations or sets of operations on personal data, including collection, recording, organization, use, restructuring, combination, storage, updating, retrieval, browsing, deletion, and destruction, using both automated and non-automated means.
Article III. Subject, Nature, and Purpose of Processing
The purpose of personal data processing by the Processor is to ensure activities under the framework accounting agreement so that the Controller has complete documentation ready without having to add personal data about data subjects to prepared documents, thereby enabling the Controller to fulfill certain statutory obligations through the Processor.
Personal data may only be collected for specific purposes under this Agreement or the framework accounting agreement and must not be further processed in a manner incompatible with the purpose of this Agreement or the framework accounting agreement.
The Processor processes the Controller’s personal data in separate information systems:
Accounting system and individual tax returns: purpose – management of accounting, invoicing, and cash register.
Client database: purpose – management of client records, service agreements, and shared documents.
HR and payroll system: purpose – management of personnel and payroll records for employment, payroll, social security, health, and pension purposes.
Double-entry accounting and corporate tax returns: purpose – management of accounting, invoicing, and cash register.
Business trips system: purpose – management of business trip records, fuel consumption, vehicle-related costs, and travel expense settlements.
Article IV. Duration of Processing
The Processor shall comply with the principle of data minimization under Article 5(1)(c) GDPR, retaining personal data in an identifiable form only as long as necessary for the purpose for which the data is processed.
The duration of processing of data subjects’ personal data by the Processor shall be governed by the duration of the contractual relationship between the Controller and the Processor, i.e., for the duration of the framework accounting agreement.
Article V. Categories of Data Subjects and Scope of Personal Data
The Processor processes for the Controller personal data of the following categories of data subjects and includes the following data (by information system):
Accounting system and individual tax returns: full name, address, date of birth, bank account number, vehicle registration number, VIN, personal ID number, ID card number, phone number, email address, and family-related personal data.
Client database: full name, address, date of birth, personal ID number, ID card number, phone number, email address.
HR and payroll: personal number, full name, titles, previous names, date of birth, ID number, nationality, place of birth, marital status, residence addresses, contact information, employment duration, type of work, payroll-related data, qualifications, pension and health restrictions, account numbers, family details, and employment history.
Double-entry accounting and corporate tax returns: full name, address, date of birth, vehicle registration number, VIN, personal ID number, ID card number, bank account number, phone number, email address.
Business trips: full name, address, date of birth, vehicle registration number, VIN.
Article VI. Rights and Obligations of the Processor
The Processor shall process personal data only based on documented instructions of the Controller and only to the extent necessary to fulfill the framework accounting agreement, and may not use the data for any other purpose. The Processor may not create databases for purposes other than fulfilling contractual obligations under the framework accounting agreement.
Documented instructions include this Agreement and any other agreements between the parties if processing of data occurs for the same purpose as under this Agreement.
The Processor undertakes to maintain confidentiality of information obtained from processing personal data and not disclose data to third parties without Controller’s consent.
The Processor may not use or disclose personal data without Controller’s consent; this obligation continues after the termination of this Agreement.
The Processor shall implement appropriate technical and organizational measures to ensure security proportional to the risks of processing, including pseudonymization and encryption if applicable.
Technical and organizational measures include access control, data protection, and system integrity measures.
The Processor ensures that all individuals authorized to process data are trained and bound by confidentiality obligations.
If engaging sub-processors, the Processor shall ensure a similar data processing agreement is in place.
The Processor shall cooperate with the Controller to fulfill data subject rights and security obligations.
The Processor shall notify the Controller of personal data breaches within 24 hours.
Upon termination, the Processor shall delete or return all personal data and copies thereof.
The Processor shall ensure data accuracy, provide necessary information to demonstrate GDPR compliance, and maintain records of processing activities.
The Processor does not transfer personal data to third countries without adequate protection unless authorized by the Controller.
The Processor may commence processing personal data on the effective date of this Agreement.
Article VII. Rights and Obligations of the Controller
The Controller shall provide the Processor with personal data in a timely and proper manner.
The Controller shall promptly inform the Processor of any data subject requests for correction, deletion, or restriction of processing.
The Controller shall notify the Processor of any changes in personal data processing, especially cessation of processing.
The Controller shall fulfill information obligations towards data subjects and provide evidence to the Processor upon request.
The Controller shall notify the Processor of any sanctions applied by supervisory authorities due to Processor’s breaches.
The Controller shall inform the Processor of any deficiencies in processing so that corrective measures may be taken.
Article VIII. Termination of the Agreement, Delivery
This Agreement terminates:
automatically upon termination of the framework accounting agreement;
by withdrawal if one party materially breaches this Agreement;
by mutual agreement of the parties.
Upon termination:
The Processor’s right to process data ceases;
The Processor shall return or transfer data to the Controller as agreed;
All rights and obligations under this Agreement expire, except confidentiality obligations.
Delivery of documents shall follow the delivery agreement in the framework accounting agreement.
Article IX. Final Provisions
This Agreement constitutes the entire agreement regarding its subject and replaces all prior agreements and arrangements, oral or written.
This Agreement is governed by Slovak law, especially Act No. 513/1991 Coll., Commercial Code.
If any provision is invalid or unenforceable, it does not affect other provisions; parties shall replace it with a valid provision preserving the intended purpose.
Changes to this Agreement require mutual written consent.
This Agreement is concluded for an indefinite period.
This Agreement is executed in two identical copies, one for each party.