Data Processing Agreement

Application and parties

This Data Processing Agreement (DPA) forms part of the Terms of Service between the customer accepting those Terms and Jscriptech, MB (company code 305972924), V. Nagevičiaus g. 3, Vilnius, Lithuania (processor), whenever we process personal data on the customer's behalf. It applies to every plan, including Free and trial access, where such processing occurs. Contact legal@dingvoice.com for a countersigned copy or additional processing details; requesting a signature is not a condition for these duties to apply.

The customer is the controller or, where acting for another controller, the processor that authorizes us as its subprocessor. Each party must meet the data protection obligations applicable to its role. This DPA does not govern our independent controller processing, such as our own billing records, described in the Privacy Policy. Mandatory data protection requirements and applicable transfer clauses prevail over conflicting contract terms.

Processing details

Subject matter and purpose: providing, maintaining, securing, and supporting the DingVoice cloud accounting service and connected features selected by the customer. Processing continues for the service relationship and the limited return, deletion, backup, or legally required retention periods described below. Frequency is ongoing and on demand according to customer use.

Nature of processing includes collection, storage, organization, retrieval, calculation, OCR or AI extraction where enabled, transmission to authorized users or providers, export, restriction, and deletion. It includes handling documents, business records, audit logs, and support or rights requests on the customer's instructions.

Data subjects include customer personnel, contractors, clients, suppliers, payees, and individuals appearing in uploaded business documents. Data can include names, contact and account details, invoices, receipts, banking transactions, payroll inputs, authentication or membership identifiers, notification routing identifiers and associated message content, and other information the customer chooses to enter. Uploads must comply with the Terms' restrictions on sensitive data; the service is not designed to require special-category or criminal-offence data.

Customer instructions and duties

The Terms, this DPA, enabled settings, authorized use, and written requests constitute documented instructions. The customer must have the authority and legal basis for the processing and transfers it requests, provide required notices, minimize data, and manage access. Where acting as processor, it must have its controller's authorization.

We process personal data only on documented instructions, including instructions about transfers, unless binding EU or Member State law requires otherwise; we inform the customer before such processing unless that law prohibits notice for important public-interest reasons. We promptly inform the customer if we consider an instruction to infringe applicable data protection law and may pause the affected processing while the parties resolve it.

Confidentiality and technical measures

We ensure that personnel authorized to process customer personal data are bound by confidentiality obligations or an appropriate statutory duty, and that access is limited to the duties they perform.

We implement and maintain technical and organizational measures appropriate to the risks under Article 32 GDPR. These cover authenticated access and authorization by workspace, limiting production access, network and storage protections including encryption as appropriate, protection of credentials, security monitoring and incident handling, resilience and recovery arrangements, and periodic evaluation of safeguards. Measures must take account of the state of the art, implementation costs, and the nature, scope, context, purposes, and risks of processing.

We provide information reasonably needed to assess the measures on request under the audit process below. Customers remain responsible for their users, devices, permissions, lawful instructions, and independent recordkeeping; this does not reduce our own processor duties.

Assistance and personal data breaches

Taking account of the nature of processing, we assist the customer with appropriate measures to respond to data subject requests. We pass requests about customer-controlled records to the customer and do not decide them independently unless required by law. We also assist with security, breach notification, data protection impact assessments, and prior consultation obligations, taking account of the information available to us.

We notify the customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. Available information will include the nature of the breach, affected categories and approximate numbers where known, likely consequences, measures taken or proposed, and a contact for follow-up. We may provide information in stages as the investigation proceeds and cooperate with the customer's response. The customer's statutory notification deadlines are not a permitted waiting period for our notice.

Subprocessor authorization and changes

Subprocessors are listed in the register below and in the Privacy Policy. The customer gives general written authorization through this DPA for the listed providers to perform the processing described, only to the extent required for features used and subject to applicable transfer safeguards. Independent controller activities of payment or other providers are not subprocessing under this authorization.

We give written notice to the account contact of intended additions or replacements at least 30 days before the new subprocessor processes customer data, allowing the customer to object on reasonable data protection grounds. We work in good faith to resolve an objection through an alternative or by disabling the affected feature. If it cannot be resolved, the customer may terminate the affected service before that processing begins and receive a proportionate refund for unused prepaid affected service. If mandatory law requires an earlier change, we inform the customer as soon as legally permitted and do not treat that exception as blanket authority for unrelated processing.

We engage subprocessors under written obligations providing the same relevant data protection protections as this DPA, including confidentiality, security, assistance, deletion, and transfer requirements. We remain responsible to the customer for their performance as required by Article 28 GDPR. A list entry alone does not replace our duty to put those obligations in place.

International transfers

Data is hosted in the United States unless agreed otherwise in writing; no EU-only residency is promised. The customer authorizes the transfers necessary for the listed services it uses, only where lawful safeguards are in place. Before a restricted transfer, we must establish an applicable adequacy basis or execute the appropriate Standard Contractual Clauses or another lawful mechanism, together with any required assessment and supplementary measures.

This DPA is not itself an execution of EU international-transfer Standard Contractual Clauses and does not assert that every vendor arrangement already meets every transfer requirement. Request applicable safeguards or any necessary additional execution at legal@dingvoice.com. No instruction or contractual authorization overrides a legal prohibition on a transfer.

Return and deletion

At the end of processing services, at the customer's choice, we return or delete personal data processed on its behalf and delete existing copies unless EU or Member State law requires retention. Request the preferred return method and available export scope through Settings or legal@dingvoice.com. During the service, we also act on lawful documented deletion instructions subject to authorization and applicable legal exceptions.

Deletion may require coordinated jobs, retries, and provider follow-up. Backup copies remain protected, are isolated from ordinary use, and expire under the applicable retention cycle; if restored, deletion instructions must be reapplied. Where retention is legally required, we restrict data to that purpose and inform the customer unless prohibited. We provide information about completion and applicable exceptions on request; anonymization is acceptable only where data can no longer identify a person and the customer's instructions or applicable law allow it.

Information and audits

We make available information necessary to demonstrate compliance with our processor obligations and allow and contribute to audits, including inspections by the customer or an independent auditor it appoints. The parties first use relevant documentation where adequate and agree reasonable notice, confidentiality, scope, and security arrangements to protect other customers without preventing effective verification or regulator access.

Routine audit costs may be agreed in advance; no fee, notice condition, or contractual term may frustrate a legally required audit, urgent investigation, or supervisory authority power. We promptly inform the customer of an instruction we consider unlawful. Liability allocation in the Terms applies only to the extent lawful and cannot remove data subjects' statutory compensation rights or our mandatory processor responsibility.

Contacts and law

Processor instructions and DPA requests: legal@dingvoice.com. Privacy requests: privacy@dingvoice.com. Security incidents: security@dingvoice.com. Keep the account contact current so notices reach the appropriate person.

This DPA follows the Lithuanian governing-law and dispute terms in the Terms of Service, subject to mandatory data protection law and any applicable transfer clauses. It survives termination for as long as we hold customer personal data in our processor role.

Subprocessor register