Data Processing Agreement

Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28 GDPR between the customer of the service "yourtinyoffice" (the "Controller") and CMaier GmbH, Webersiedlung 11, 8402 Werndorf, Austria (the "Processor"). Version 2026-09-19.

This agreement forms part of the Terms of Service and is concluded upon their acceptance at first login. The acceptance is recorded with timestamp and version in the Controller's account, satisfying the written form in electronic format under Art. 28(9) GDPR. The Controller may print this page or save it as PDF.

1. Subject matter and duration

1. The subject matter is the provision of the Service for managing customers, time records, offers and invoices as software as a service.
2. The duration corresponds to the term of the service contract. This agreement ends when the service contract ends.

2. Nature and purpose of processing, data categories, data subjects

1. Nature and purpose: storage, display, editing, generation of documents (PDF, electronic invoices), dispatch by e-mail on instruction, verification of VAT identification numbers, backup and deletion, in each case to provide the Service to the Controller.
2. Data categories: company and contact data of the Controller's customers (company, contact person, address, e-mail address, phone number, VAT ID, free-text notes), service and time records (date, hours, project, description of work), offer and invoice data (line items, amounts, payment status), e-mail addresses of document recipients.
3. Data subjects: customers and contact persons of the Controller's customers, recipients of offers and invoices.
4. Special categories of personal data (Art. 9 GDPR) are not subject to processing. The Controller will not enter such data in free-text fields.

3. Instructions

1. The Processor processes personal data only on documented instructions from the Controller. The Controller's use of the Service's functions (e.g. creating a customer, sending an invoice, triggering a VAT ID check) constitutes an instruction.
2. Further instructions are given by the Controller in text form to [email protected]. The Processor informs the Controller without delay if it considers an instruction to infringe data protection law.
3. Processing outside the EU/EEA only takes place to the extent described in Annex 1.

4. Obligations of the Processor

1. It ensures that persons authorised to process the data are bound to confidentiality.
2. It implements the technical and organisational measures described in Annex 2 pursuant to Art. 32 GDPR and adapts them to the state of the art without lowering the level of protection.
3. It assists the Controller by appropriate means in responding to data subject requests (Art. 12–22 GDPR). Access, rectification and erasure can be carried out by the Controller through the Service's functions; assistance beyond that is provided against reimbursement of reasonable costs.
4. It assists the Controller in complying with the obligations under Art. 32–36 GDPR, taking into account the information available to it.
5. It notifies the Controller of personal data breaches without undue delay and no later than 48 hours after becoming aware, to the e-mail address stored in the account, with the information required under Art. 33(3) GDPR to the extent available.
6. It makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

5. Sub-processors

1. The Controller grants general authorisation for the engagement of the sub-processors listed in Annex 1.
2. The Processor notifies intended changes (addition or replacement) at least 30 days before they take effect by e-mail. The Controller may object within this period for important data protection reasons. If no agreement is reached, the Controller may terminate the service contract with effect from the date the change takes effect.
3. The Processor binds sub-processors by contract to data protection obligations equivalent to this agreement and is liable for them as for its own conduct.

6. Audit rights

1. The Controller has the right to verify compliance with this agreement. The Processor fulfils this primarily by providing documentation, self-assessments and the reports or certifications of its sub-processors (e.g. Supabase SOC 2).
2. Where this is insufficient in an individual case, the Controller may, after reasonable notice and at most once a year during usual business hours, carry out an audit itself or through an auditor bound to confidentiality. The Controller bears the costs.

7. Deletion and return

1. The Controller can view its data in the Service at any time and export documents as PDF.
2. After the service contract ends, the Processor deletes all personal data of the Controller including backups within 30 days unless statutory retention duties of the Processor require otherwise. On request it confirms deletion in text form.

8. Liability, final provisions

1. Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the Terms of Service.
2. In case of conflict between this agreement and the Terms of Service, this agreement prevails with regard to data protection.
3. Austrian law applies; the place of jurisdiction is Graz.

Annex 1: Sub-processors

Not sub-processors but independent bodies: the European Commission (VIES query of VAT identification numbers on instruction), the European Central Bank (retrieval of reference rates without personal data) and Stripe Payments Europe, Ltd. (billing of the Controller's fees; concerns only the Controller's own data, not the data of its customers). When the Controller uses its own SMTP server on the Pro plan, that server's operator is a processor of the Controller, not of the Processor.

Annex 2: Technical and organisational measures

Physical and system access control

• Operation in certified data centres of the sub-processors (physical security, access control, fire protection, redundant power supply).
• Access to servers and database only by the Processor via SSH keys or authenticated management consoles; no password logins.
• User access to the Service only through personal accounts with password (minimum length, hashing by the authentication service), encrypted HttpOnly session cookies with limited lifetime, rate limiting against brute force.

Data access control and tenant separation

• Strict tenant separation at the database level: every table carries a tenant identifier, and the database's row level security policies enforce that each query only reads or writes data of the logged-in tenant.
• Every request runs in a database transaction carrying the user's verified identity (JWT, verified against the authentication service's public key).
• Documents are stored in a private storage area with tenant-specific paths; no public access.
• Protection against cross-site request forgery, security headers (HSTS, nosniff, frame protection), no embedded third-party scripts.

Transfer control

• Encrypted transmission (TLS 1.2+) between browser and Service, between Service and database, and for e-mail dispatch (STARTTLS/TLS).
• Stored SMTP credentials are encrypted with AES-256-GCM; the key is kept outside the database.

Input and availability control

• Finalized invoices are immutable; times of creation, finalization, dispatch and payment are recorded.
• Daily automatic database backups by the database provider; timestamps and request identifiers in server logs without content data.
• The application runs in isolated containers without root privileges; dependencies are updated regularly.

Organisation

• Processing exclusively by the Processor personally; no further staff with data access.
• Data processing agreements with all sub-processors; regular review of these measures.
• Deletion concept: deletion of account data after the end of the contract in accordance with clause 7.