Data Processing Agreement

This Data Processing Agreement ("DPA") under Art. 28 GDPR forms part of the Terms of Service between the customer (the Controller) and [not yet provided], [not yet provided] (the Processor). It applies automatically when the customer accepts the Terms.

1. Subject matter, duration, nature and purpose

1.1 Subject matter: providing the Stoxify inventory service as described in the Terms.

1.2 Duration: for as long as the Terms are in force, plus the erasure period in section 9.

1.3 Nature and purpose: storage, organisation, retrieval, display, export and erasure of data the Controller enters or uploads, and automated reading of documents and labels and AI-generated suggestions using the Google Gemini API (see Annex 2), solely to provide the Service.

2. Types of personal data and data subjects

Data subjects	Types of data
Controller's users	Name, email, time zone, login and usage data
Controller's customers and suppliers (and their contact persons)	Name, company, address, email, VAT number, transaction data (invoices, purchases, prices, discounts)
Persons named on uploaded documents	Data contained in bill and invoice images

No special categories of personal data (Art. 9 GDPR) are intended to be processed. The Controller must not store such data in the Service.

3. Instructions

3.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case the Processor informs the Controller before processing, unless the law prohibits this.

3.2 The Terms, this DPA and the Controller's use of the Service's functions are the Controller's complete instructions. Further instructions must be given in writing or by email to mailtokhajan@gmail.com.

3.3 The Processor informs the Controller immediately if it believes an instruction infringes data protection law.

4. Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security (Art. 32 GDPR)

The Processor implements the technical and organisational measures in Annex 1. It may adapt them to technical progress, provided the level of protection is not reduced.

6. Sub-processors

6.1 The Controller gives general authorisation to engage the sub-processors listed in Annex 2.

6.2 The Processor informs the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object for important data protection reasons within that period; if no solution is found, either party may terminate the contract.

6.3 The Processor imposes the same data protection obligations on each sub-processor by contract and remains liable to the Controller for its sub-processors.

7. Assistance

7.1 Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects (Chapter III GDPR). Most requests can be handled directly in the Service (view, correct, export, delete).

7.2 The Processor assists the Controller in complying with Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments, prior consultation), taking into account the information available to it.

7.3 The Processor notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information required under Art. 33(3) GDPR as far as available.

8. Audits and information

The Processor makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it, with reasonable prior notice, during business hours and without disproportionately disrupting operations.

9. Return and erasure

After the end of the contract (closing the account), the Processor erases all personal data of the Controller after a grace period of 30 days, unless Union or Member State law requires storage. During the contract the Controller can export its data at any time; this is how data is returned. Backups are overwritten in the normal backup cycle (at most 30 days).

10. Liability and precedence

Liability follows Art. 82 GDPR and the Terms. In case of conflict, this DPA takes precedence over the Terms with regard to data protection.

Annex 1 – Technical and organisational measures

• Encryption in transit: all connections use HTTPS/TLS; HSTS enabled.
• Access control: personal accounts with password login; passwords stored as salted hashes (PBKDF2); sessions expire after 14 days; administrative access limited to authorised staff.
• Separation: every customer's data belongs to its own workspace; every database query is scoped to that workspace.
• Integrity: stock changes are written to an append-only ledger with user and time; documents are immutable once created; database constraints prevent negative stock.
• Availability: regular backups; monitoring with automatic error alerts to administrators.
• Data minimisation: no tracking or analytics; unsaved uploaded bill images are deleted after 2 days; only the image or text a feature needs is sent to the AI service, only when the user starts it, and the paid API service does not use it to train models.
• Erasure: automatic, scheduled erasure of closed accounts after the grace period.
• Software: dependencies kept up to date; protection against CSRF, clickjacking and injection by the framework.

Annex 2 – Sub-processors

Sub-processor	Service
[not yet provided]	Hosting of servers and databases
We send emails from our own mail server.	Sending service emails
Google Ireland Limited (Dublin, Ireland) with Google LLC (USA): Gemini API	AI features: reading bills and product labels, stock advice, similar-product search. Transfer safeguards: EU-U.S. Data Privacy Framework and Standard Contractual Clauses.