Provider: NIZU OÜ (Processor)
Client: The entity using NIZU.io services (Controller)
1.1 This DPA applies to the processing of personal data by NIZU OÜ on behalf of the Client in the context of providing PEPPOL e-invoicing services. 1.2 Definitions: The terms "Personal Data," "Data Subject," "Processing," "Controller," and "Processor" shall have the meanings given to them in the General Data Protection Regulation (GDPR) (EU) 2016/679.
2.1 Subject Matter: The processing of electronic invoice data, which may contain personal information (names, contact details, financial data, VAT numbers). 2.2 Duration: The processing shall continue for the duration of the Service Agreement plus the period until all data is deleted or returned in accordance with this DPA.
3.1 NIZU OÜ shall process personal data only on documented instructions from the Client, including with regard to transfers of personal data to a third country. 3.2 The Service Agreement, including the transmission of data via the PEPPOL network, constitutes the Client’s primary instructions.
4.1 NIZU OÜ shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
Encryption: Data encryption in transit (via TLS) and at rest.
Access Control: Limiting access to personal data to authorized personnel only.
Resilience: Ensuring the ongoing confidentiality, integrity, and availability of processing systems. 4.2 By entering into this agreement, the Client acknowledges that these measures provide an adequate level of protection.
5.1 The Client provides a general authorization for NIZU OÜ to engage sub-processors (e.g., cloud infrastructure providers like AWS, Google Cloud, or Azure). 5.2 NIZU OÜ shall inform the Client of any intended changes concerning the addition or replacement of sub-processors, giving the Client the opportunity to object. 5.3 NIZU OÜ shall ensure that sub-processors are bound by data protection obligations at least as stringent as those in this DPA.
6.1 NIZU OÜ shall, insofar as possible, assist the Client by appropriate technical and organizational measures for the fulfillment of the Client’s obligation to respond to requests for exercising the Data Subject's rights (e.g., right to access, rectification, or erasure).
7.1 NIZU OÜ shall notify the Client without undue delay after becoming aware of a personal data breach. 7.2 The notification shall include the nature of the breach, the categories of data involved, and the measures taken to mitigate the impact.
8.1 NIZU OÜ shall make available to the Client all information necessary to demonstrate compliance with Article 28 of the GDPR. 8.2 NIZU OÜ shall allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client, provided such audits are requested with reasonable notice and conducted during business hours to minimize disruption.
9.1 Upon termination of the Service Agreement, NIZU OÜ shall, at the choice of the Client, delete or return all personal data to the Client, unless Estonian or European Union law requires the continued storage of the personal data (e.g., for accounting or tax purposes).
10.1 Liability under this DPA is subject to the limitations of liability set forth in the General Terms and Conditions of the Service Agreement.
11.1 This DPA is governed by Estonian Law. Any disputes shall be settled in the Harju County Court in Tallinn, Estonia.
Categories of Data Subjects: Client's employees, customers, and suppliers.
Types of Personal Data: Names, addresses, email addresses, phone numbers, VAT IDs, bank account numbers, and transaction details included in invoices.
Nature of Processing: Receiving, converting, validating, and transmitting e-invoices via the PEPPOL network.
