GDPR & data processing

Your role and ours

When you use Zvitly, two roles meet. For the data of your own customers, suppliers and employees you are the Verantwortlicher (controller) within the meaning of Art. 4 Z 7 DSGVO: you decide which data you collect and why. For that data Zvitly is the Auftragsverarbeiter (processor) under Art. 4 Z 8 DSGVO — we store and process it solely on your instructions and never for our own purposes.

This distinction is not a formality. It determines who has to answer an access request, who reports a data breach to the authority, and who is liable for it. In short: with the data inside your Zvitly account you are at the wheel, we are the engine.

Rows 2 and 3 are covered not by this page but by the Datenschutzerklärung (privacy policy). Datenschutzerklärung

The Auftragsverarbeitungsvertrag (AVV)

Art. 28 Abs 3 DSGVO requires every processing on behalf of a controller to rest on a contract. Without it, the very use is already an infringement — yours, not ours, because the obligation falls on the controller. The Auftragsverarbeitungsvertrag (AVV, internationally DPA) is therefore not an add-on but a precondition of use.

How to conclude it with us

1. Write to the address given below with the subject «AVV» and state your company name, address and the email address of your Zvitly account.
2. You will receive the current version of the AVV as a PDF for review. Its content matches this page — but this page does not replace it.
3. The contract is concluded in text form. Art. 28 Abs 9 DSGVO expressly permits the electronic format; a handwritten signature is not required.

Concluding it is free of charge on every plan, including free use. Concluding it directly inside the account is not currently offered — the route is by email.

Contents of the AVV under Art. 28 Abs 3 DSGVO

Art. 28 Abs 3 DSGVO prescribes what an AVV must contain. The two tables below reproduce that catalogue in full: first the key parameters of the processing, then the obligations under lit a to h.

Sub-processors

Zvitly engages the sub-processors listed below. The list is complete and names only providers with which a contract under Art. 28 DSGVO actually exists.

Technical and organisational measures (Art. 32)

Art. 32 DSGVO requires measures appropriate to the risk — and it requires them to be implemented, not merely planned. The list below therefore describes only what is actually running in the product.

Personal data breaches

If we become aware of a personal data breach affecting your data, we inform you without undue delay, as Art. 33 Abs 2 DSGVO requires. «Without undue delay» here means in practice within 24 hours of our becoming aware — so that enough of your own 72-hour deadline is left.

What we do

1. Contain the incident and establish its scope.
2. Notify you as controller — with the nature of the incident, the categories of data affected, the approximate number of data subjects, the likely consequences and the measures taken (Art. 33 Abs 3 DSGVO).
3. Supply details that were not yet established at the time of the first notification — phased notification is permitted and, for larger incidents, the norm.
4. Document the incident on our side and remedy the cause.

Reporting route in Austria: the online form or the PDF form of the Datenschutzbehörde, alternatively by email to dsb@dsb.gv.at or by post to Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien.

Data subject rights in practice

Requests from data subjects go to you, because you are the controller. Our job is to make fulfilling them possible. This table says, for each right, what you can do yourself in the account and what you need us for.

Deletion concept

How long data stays is decided not by preference but by purpose and by law. For accounting data the law is stricter than the wish to delete — and the law prevails.

The periods for data that Zvitly processes as controller — account, contact, website — are set out in the Datenschutzerklärung. Datenschutzerklärung

Transfers to third countries

Your accounting data does not leave the European Union. Database and files are held in Frankfurt am Main, the application runs on EU servers, automatic receipt recognition runs through an Amazon Web Services inference profile that restricts processing to data centres in the EU, and system emails are sent from the EU region Ireland (eu-west-1), where the zvitly.io domain is verified. A third-country element exists solely for the operational data of providers that are US companies or belong to a US group: for Supabase and Amazon Web Services, the respective provider's administrative access to its own platform; for Resend, account data, delivery metadata and logs — that is, the record THAT a message was delivered, not receipts, invoices or your customers' data.

These transfers are lawful on the basis of the DSGVO — not merely tolerated. Resend is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision under Art. 45 DSGVO on 10 July 2023; a transfer on that basis requires no additional authorisation from a supervisory authority. Independently of this, the processing agreements of all three providers contain the Commission's Standard Contractual Clauses under Art. 46 Abs 2 lit c DSGVO, supplemented by technical measures: enforced transport encryption, encryption at rest, and storage and processing in the EU. The contract with Resend is governed by Irish law and Irish jurisdiction.

Data protection impact assessment (Art. 35)

A Datenschutz-Folgenabschätzung (DSFA — data protection impact assessment) under Art. 35 DSGVO is not always necessary. It is required where processing is likely to result in a high risk to the rights and freedoms of natural persons — in particular a systematic and extensive evaluation of personal aspects, large-scale processing of special categories under Art. 9, or systematic monitoring of publicly accessible areas on a large scale.

For the typical use of Zvitly — the bookkeeping of a sole trader or small business — no DSFA is required in our assessment:

• There is no automated decision producing legal effects and no profiling within the meaning of Art. 22 DSGVO.
• Special categories under Art. 9 are not envisaged and are not asked for.
• The processing is confined to the business transactions of a single company and is therefore not «large-scale» within the meaning of Recital 91.

Record of processing activities (Art. 30 Abs 2)

As a processor we maintain our own record of all processing activities carried out on behalf of controllers (Art. 30 Abs 2 DSGVO). It contains:

The exemption in Art. 30 Abs 5 DSGVO for companies with fewer than 250 employees does not apply here: the processing is not occasional. On request we make the record available to the supervisory authority and to you.

Evidence and audit

Art. 28 Abs 3 lit h DSGVO gives you the right to verify compliance with this contract. We honour it in this order — from the lightest to the most intrusive form:

1. Self-disclosure: this page and the AVV describe the processing and the measures. For most reviews that is sufficient.
2. Written information: we answer specific questions in text form within 30 days, including evidence for individual measures.
3. On-site audit: after notice within a reasonable period, during normal business hours, no more than once a year and without disrupting operations — by you or by an auditor you appoint who is bound to secrecy and is not a competitor of ours. Audits prompted by an incident are unaffected by that limit.

Third-party certificates — ISO 27001 or a SOC 2 report, for instance — do not exist for Zvitly itself. For the providers we engage they are available through their trust portals.

Your own obligations as a business

The AVV with us is one building block of your compliance, not the whole of it. The six questions below are the ones we are actually asked — with the answers that apply to an Austrian small business or sole trader.

Short checklist

• AVV concluded with Zvitly.
• AVVs concluded with all other providers.
• Own record of processing activities created under Art. 30 Abs 1.
• Own privacy notice published under Art. 13.
• Checked whether a data protection officer or a DSFA is needed — and noted the outcome.
• Decided who does what in an incident, and noted the 72-hour deadline.

This overview is guidance and does not replace legal advice. Zvitly is neither a tax adviser nor a lawyer.

Contact and version

Questions about processing on your behalf, requests for the AVV, reports of an incident or support with a data subject request go to the address given below, with «Datenschutz» in the subject line. Zvitly has not appointed a data protection officer — the conditions of Art. 37 Abs 1 DSGVO are not met. Enquiries are answered by the management.

This version applies from the date given above and supersedes all earlier ones. The German version is the legally binding one.