{"id":27404,"date":"2026-07-02T11:37:23","date_gmt":"2026-07-02T11:37:23","guid":{"rendered":"https:\/\/envoice.eu\/?page_id=27404"},"modified":"2026-07-14T12:20:42","modified_gmt":"2026-07-14T12:20:42","slug":"dpa","status":"publish","type":"page","link":"https:\/\/envoice.eu\/en\/dpa\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">The Data Processing Agreement (the \u201c<\/span><b>DPA<\/b><span style=\"font-weight: 400;\">\u201d) is an integral part of the Terms of Service regarding the Envoice Products. Unless otherwise defined in this DPA, capitalised terms used in DPA will have the same meaning they do in the Terms of Service. By accepting the Terms of Service, the Client is also deemed to have accepted this DPA.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This DPA incorporates the Annex to the European Commission\u2019s implementing decision (EU) 2021\/915 of 4 June 2021 on standard contractual clauses between controllers and processors (the \u201c<\/span><b>SCCs<\/b><span style=\"font-weight: 400;\">\u201d) available at: <\/span><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32021D0915&amp;locale-en\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A32021D0915&amp;locale-en<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The following options shall apply in relation to this DPA:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>Clauses in the SCCs<\/b><\/td>\n<td><b>Agreed option<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 1 (a)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 1<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 5<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Shall not apply.<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 7.7 (a)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 2: general written authorisation.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The agreed list of sub-processors is provided in the <a href=\"https:\/\/envoice.eu\/en\/subprocessors\/\">List of Sub-processor(s)<\/a>. Envoice shall inform the Client of any intended changes concerning the addition or replacement of sub-processors.<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 8 (c) 4)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 1<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 9.1 (b)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 1<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 9.1 (c)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 1<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Clause 9.2 third paragraph<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Option 1<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>ANNEX I to the SCCs \u2013 Parties<\/b><\/h2>\n<table>\n<tbody>\n<tr>\n<td colspan=\"2\"><b>Processor \/ Supplier<\/b><\/td>\n<\/tr>\n<tr>\n<td><b>Name:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Envoice O\u00dc<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Address:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Endla tn 15, 10122 Tallinn, Estonia<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Contact details:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">support@envoice.eu<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Signature and accession date:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Date of acceptance of the <\/span><a href=\"https:\/\/envoice.eu\/en\/terms-of-service\/\"><span style=\"font-weight: 400;\">Terms of Service<\/span><\/a><span style=\"font-weight: 400;\"> by the Client.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<table>\n<tbody>\n<tr>\n<td colspan=\"2\"><b>Controller \/ Client<\/b><\/td>\n<\/tr>\n<tr>\n<td><b>Name<\/b><\/td>\n<td rowspan=\"2\"><span style=\"font-weight: 400;\">A legal entity whose representative has accepted Envoice\u2019s <\/span><a href=\"https:\/\/envoice.eu\/en\/terms-of-service\/\"><span style=\"font-weight: 400;\">Terms of Service<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Address<\/b><\/td>\n<\/tr>\n<tr>\n<td><b>Contact details:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Contact details are provided in the Client Account registration form.<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Signature and accession date:<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Date of acceptance of the Terms of Service by the Client.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>ANNEX II to the SCCs \u2013 Description of Processing<\/b><\/h2>\n<p><b>Categories of data subjects whose personal data is processed and categories of personal data<\/b><\/p>\n<p><b>Categories of data subjects:<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Employees of the Client<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Users of the Software designated by the Client<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Clients (natural persons) of the Client<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Representatives of the Client\u2019s clients<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Other individuals whose personal data are included in the documents provided to Envoice by the Client.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Anyone else who submits documents to Envoice for Client or on Client\u2019s behalf<\/span><\/li>\n<\/ul>\n<p><b>The types of personal data processed<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Identity Data<\/b><span style=\"font-weight: 400;\"> includes: first name, last name, username or similar identifier, personal identification code, title, date of birth, gender, job title and tax registration numbers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Contact Data<\/b><span style=\"font-weight: 400;\"> includes: billing address, email address and telephone numbers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Transaction Data<\/b><span style=\"font-weight: 400;\"> includes: details about payments, receipts or invoices; details about payments and other details of products and services purchased from Envoice.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Technical Data<\/b><span style=\"font-weight: 400;\"> includes: internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices used to access the Envoice Products.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Profile Data<\/b><span style=\"font-weight: 400;\"> includes: username and password, purchases or orders made, user preferences, feedback and survey responses.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Usage Data<\/b><span style=\"font-weight: 400;\"> includes: information about usage of the Software and Envoice Products<\/span><\/li>\n<\/ul>\n<p><b>Sensitive data processed (if applicable)\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Invoices uploaded to Envoice may potentially include special categories of personal data. The processor will apply all technical and organisational measures set forth in Annex III to safeguard such data.<\/span><\/p>\n<p><b>Nature of the processing and purpose(s) for which the personal data is processed on behalf of the controller<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Provision of Envoice software and services pursuant to the Subscription Plan.<\/span><\/p>\n<p><b>Duration of the processing<\/b><\/p>\n<p><span style=\"font-weight: 400;\">During the validity of the service agreement (Terms of Service) between the Client and the Supplier and for up to 60 days after the termination unless agreed with the Client otherwise.<\/span><\/p>\n<p><b>Breach Notification<\/b><\/p>\n<p><span style=\"font-weight: 400;\">In the event of a data breach affecting personal data processed under this DPA, the Processor (Envoice) shall notify the Controller (Client) without undue delay.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The notification shall include at least:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A description of the nature of the data breach, including the categories and approximate number of data subjects and records concerned.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The likely consequences of the breach.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Measures taken or proposed by the Processor to address the breach and mitigate any possible adverse effects.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The Processor will assist the Controller in complying with their obligations under Articles 33 and 34 of the GDPR, including any required communications with data subjects or supervisory authorities.<\/span><\/p>\n<h2><b>ANNEX III to the SCCs \u2013 Technical and Organisational Measures<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) of the EU SCC\u2019s are those established and maintained under clause 4 of this Data Processor Agreement and includes without limitation those found at <\/span><a href=\"https:\/\/envoice.eu\/en\/information-security\/\"><span style=\"font-weight: 400;\">https:\/\/envoice.eu\/en\/information-security\/<\/span><\/a><span style=\"font-weight: 400;\"> as amended from time to time.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Data Processing Agreement (the \u201cDPA\u201d) is an integral part of the Terms of Service regarding the Envoice Products. Unless otherwise defined in this DPA, capitalised terms used in DPA will have the same meaning they do in the Terms of Service. By accepting the Terms of Service, the Client is also deemed to have [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":39,"comment_status":"closed","ping_status":"closed","template":"legal-page.php","meta":{"_acf_changed":false,"_lmt_disableupdate":"no","_lmt_disable":"","footnotes":""},"class_list":["post-27404","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/pages\/27404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/comments?post=27404"}],"version-history":[{"count":3,"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/pages\/27404\/revisions"}],"predecessor-version":[{"id":27467,"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/pages\/27404\/revisions\/27467"}],"wp:attachment":[{"href":"https:\/\/envoice.eu\/en\/wp-json\/wp\/v2\/media?parent=27404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}