Data processing agreement
Last updated 9 November 2026
This agreement is part of the terms of service. It applies when [Company name AB] ("the processor") processes personal data for the customer ("the controller") while providing Koncernify. It meets article 28 of the General Data Protection Regulation (GDPR). If it conflicts with the terms of service, this agreement applies.
1. What is processed
| Subject matter | Providing Koncernify: receiving, reviewing, posting and recording journals, and making reports. |
|---|---|
| Duration | While the customer uses the service, and until the data is deleted under section 9. |
| Nature and purpose | Storing, reading from and writing to the customer's ledger, routing journals for review, signing decisions, producing reports, and drafting journals with AI when a person asks for it. |
| Types of personal data | Names and work email addresses of people in the workspace. Personal data that appears in journals and ledger entries, such as names of employees, suppliers or customers in descriptions, and amounts linked to them. |
| Data subjects | The customer's staff and auditors who use the service, and people named in the customer's books. |
The service is not designed for special categories of personal data. The customer should not put such data in journal descriptions.
2. Instructions
The processor processes personal data only on the controller's documented instructions. These terms, the settings the customer chooses in its workspace, and what its users do in the service are those instructions. If the processor believes an instruction breaks data protection law, it will tell the controller. If the law requires other processing, the processor will tell the controller first unless the law forbids it.
3. Confidentiality
Everyone at the processor who can access the personal data is bound by confidentiality and only accesses it when needed to run or support the service.
4. Security
The processor keeps the technical and organisational measures in the annex, which are designed to meet article 32. It may improve them but will not lower the overall level of protection.
5. Subprocessors
The controller gives general authorisation for the processor to use subprocessors. The current ones are on the subprocessors page. The processor will tell the workspace owners by email at least 30 days before adding or replacing one. The controller may object on reasonable data protection grounds within that time. If the parties cannot agree, the controller may end the subscription and get back fees paid for the time after the change.
Each subprocessor is bound by data protection terms at least as protective as these. The processor is responsible to the controller for its subprocessors.
6. Transfers
Where personal data is transferred outside the EU or EEA, the processor makes sure there is a valid transfer mechanism: an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or the European Commission's standard contractual clauses.
7. Help with requests and assessments
The processor helps the controller answer requests from data subjects, mostly through features in the service. If a data subject contacts the processor directly, it passes the request on to the controller without answering it. The processor also gives reasonable help with impact assessments and consultations with supervisory authorities.
8. Personal data breaches
The processor tells the controller without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting the controller's data. The notice says what happened, what data and people are affected, the likely consequences, and what is being done. The processor gives updates as it learns more, so that the controller can meet its own 72-hour duty to notify the supervisory authority.
9. End of processing
An owner can download all of the workspace's data at any time, also after the subscription ends. The processor deletes the personal data 90 days after the end, or at once when an owner deletes the workspace. Backups of the deleted data expire within 30 days. The exception is the record of journals approved for a real ledger, which is the controller's accounting records: on the controller's instruction, the processor keeps it read-only, with sign-in closed, until the end of the eighth calendar year after the latest journal date, hands it over on request, and then deletes it.
10. Information and audits
The processor gives the controller the information needed to show that this agreement is met. The controller may audit, or have an independent auditor audit, compliance once a year with 30 days' notice, at its own cost, during working hours and under confidentiality. Where a recent independent report covers the questions, the processor may provide that instead.
Annex: security measures
- Encryption in transit: all traffic uses TLS.
- Encryption at rest: tokens for connected ledgers are encrypted with a key held apart from the database. The database provider encrypts stored data.
- Access in the service: sign-in through Google or Microsoft, roles and approval authority set by the customer, and agent keys that are scoped to one agent and can be revoked.
- Integrity: every review decision is signed and timestamped every hour by an outside authority. Decisions made through the agent hook are also hash-chained and countersigned. A change after the timestamp can be detected by anyone with the public keys.
- Separation: each customer's data is held under its own workspace and checked on every request.
- Abuse protection: requests are rate limited per address, per key and per workspace.
- Access by staff: limited to the people who run the service.
- Development: changes pass the automated test suite before they are deployed.