Data Processing Agreement
Effective: 2026-07-24 · Agreement under Article 28 GDPR — an integral annex to the Terms of Service
1. Parties and subject matter
Controller: the business registered in the AlphaBill service (the Customer) which records personal data about its own clients (buyers) in the service.
Processor: [CÉGNÉV / COMPANY NAME] (registered address: [SZÉKHELY CÍME / REGISTERED ADDRESS]; tax number: [ADÓSZÁM / TAX NUMBER]; email: info@alphabill.hu), operator of AlphaBill (the Processor).
This agreement sets out the terms on which the Processor processes personal data recorded by the Customer in the service, in accordance with Article 28(3) GDPR. The Customer accepts it upon registration as part of the Terms of Service.
2. Subject, nature and purpose of processing
| Element | Content |
|---|
| Subject | Storage and display of data needed to issue billing documents, PDF generation, email delivery, forwarding of NAV tax reporting |
| Duration | Life of the Customer's account + the statutory accounting retention period (8 years) |
| Nature | Storage, structuring, display, transmission (electronic) |
| Purpose | Technical support of the Customer's invoicing activity |
| Data subjects | The Customer's clients (buyers) and their contact persons |
| Data categories | Name, company name, address, tax number, email, phone, document line-item and amount data, payment references |
| Special categories | The service is not designed for special-category data; the Customer must not record any |
3. Processor's obligations
- Processes data only on the Customer's documented instructions — use of the service's functions (issuing a document, sending email, NAV submission, creating a share link) constitutes such instructions.
- Ensures persons with access are bound by confidentiality.
- Implements the technical and organisational measures of Annex 1 (Art. 32 GDPR).
- Engages the sub-processors listed in Section 4; notifies the Customer in advance of any new sub-processor, against which the Customer may object.
- Assists the Customer in answering data-subject requests (access, erasure, portability — via in-app functions and on request).
- Assists the Customer with its obligations under Articles 32–36 GDPR (security, breach notification, impact assessments).
- In case of a personal data breach, notifies the Customer without undue delay and at the latest within 48 hours of becoming aware, describing the nature of the breach, the data affected and the measures taken.
- On termination — except for data under statutory retention obligations — deletes or returns the data at the Customer's choice.
- Makes available all information necessary to demonstrate compliance and allows and contributes to audits by or on behalf of the Customer, in the first instance by providing this document and its security descriptions.
4. Authorised sub-processors
| Sub-processor | Activity | Location |
|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Németország / Germany | Hosting and infrastructure | EU (Germany) |
| Titan Email | Delivery of transactional email (document notifications) | EU/EEA-compliant service |
NAV (the Hungarian Tax and Customs Administration) is not a sub-processor: transfers to NAV are based on a legal obligation, and NAV acts as an independent controller.
5. Customer's obligations
- The Customer is responsible for having a valid legal basis for the data it records, and for informing its own clients about its processing.
- The Customer treats share links as confidential and sends them only to authorised recipients.
- The Customer must not record special-category data (Art. 9 GDPR) in the service.
Annex 1 — Technical and organisational measures (TOMs)
- Access control: password authentication with bcrypt hashing, optional TOTP two-factor, per-device session revocation, 15-minute lockout after 5 failed logins.
- Tenant isolation: every database query is scoped to the business workspace; user–workspace membership is role-based (owner/admin/member).
- Transport encryption: HTTPS/TLS on all web and API surfaces; SMTP STARTTLS for outgoing email.
- Application security: prepared SQL statements (PDO), CSRF tokens, output HTML escaping.
- Logging: email delivery log, session registry (IP, device), billing log.
- Backups and operations: EU-based infrastructure, regular backups, access restricted to the necessary minimum.