Data Processing Agreement

Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28 GDPR between the customer of the service "yourtinyoffice" (the "Controller") and CMaier GmbH, Webersiedlung 11, 8402 Werndorf, Austria (the "Processor"). Version 2026-11-02.

This agreement forms part of the Terms of Service and is concluded upon their acceptance at first login. The acceptance is recorded with timestamp and version in the Controller's account, satisfying the written form in electronic format under Art. 28(9) GDPR. The Controller may print this page or save it as PDF.

1. Subject matter and duration

1. The subject matter is the provision of the Service for managing customers, time records, offers, invoices, expenses and bank transactions as software as a service.
2. The duration corresponds to the term of the service contract. This agreement ends when the service contract ends.

2. Nature and purpose of processing, data categories, data subjects

1. Nature and purpose: storage, display, editing, generation of documents (PDF, electronic invoices), dispatch by e-mail on instruction, verification of VAT identification numbers, reading of uploaded documents with the built-in AI where the Controller has switched the respective AI feature on, backup and deletion, in each case to provide the Service to the Controller.
2. Data categories: company and contact data of the Controller's customers (company, contact person, address, e-mail address, phone number, VAT ID, free-text notes), service and time records (date, hours, project, description of work), offer and invoice data (line items, amounts, payment status), expense, income and bank transaction data (counterparty, purpose, amount, date, bank statement imports, uploaded receipts), e-mail addresses of document recipients.
3. Data subjects: customers, prospects and contact persons of the Controller's customers, recipients of offers and invoices, suppliers and other counterparties of the Controller appearing in expenses and bank statements, team members, partner accounts and tax advisors granted access by the Controller (e-mail address and login).
4. The Service is not intended for processing special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). The Controller will not intentionally enter such data. Should such data incidentally be contained in free-text fields or attachments, it is processed solely as part of the Service under this agreement and with the measures in Annex 2.

3. Instructions

1. The Processor processes personal data only on documented instructions from the Controller. The Controller's use of the Service's functions (e.g. creating a customer, sending an invoice, triggering a VAT ID check) constitutes an instruction.
2. Further instructions are given by the Controller in text form to [email protected]. The Processor informs the Controller without delay if it considers an instruction to infringe data protection law.
3. Processing outside the EU/EEA only takes place to the extent described in Annex 1.

4. Obligations of the Processor

1. It ensures that persons authorised to process the data are bound to confidentiality.
2. It implements the technical and organisational measures described in Annex 2 pursuant to Art. 32 GDPR and adapts them to the state of the art without lowering the level of protection.
3. It assists the Controller by appropriate means in responding to data subject requests (Art. 12–22 GDPR). Access, rectification and erasure can be carried out by the Controller through the Service's functions; assistance beyond that is provided against reimbursement of reasonable costs.
4. It assists the Controller in complying with the obligations under Art. 32–36 GDPR, taking into account the information available to it.
5. It notifies the Controller of personal data breaches without undue delay and no later than 48 hours after becoming aware, to the e-mail address stored in the account, with the information required under Art. 33(3) GDPR to the extent available.
6. It makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

5. Sub-processors

1. The Controller grants general authorisation for the engagement of the sub-processors listed in Annex 1.
2. The Processor notifies intended changes (addition or replacement) by e-mail before they take effect, as a rule 30 days and at least 10 days in advance, the latter corresponding to the objection period the Processor itself has towards its sub-processors (Mistral AI announces changes with reasonable notice and a 10-day objection period). The Controller may object within this period for important data protection reasons. If no agreement is reached, the Controller may terminate the service contract with effect from the date the change takes effect.
3. The Processor binds sub-processors by contract to data protection obligations equivalent to this agreement and is liable for them as for its own conduct.

6. Audit rights

1. The Controller has the right to verify compliance with this agreement. The Processor fulfils this primarily by providing documentation, self-assessments and the reports or certifications of its sub-processors (e.g. the SOC 2 Type 2 and ISO 27001 reports of Supabase, the ISO 27001 certification of Hetzner and the annual independent audit of Hetzner's technical and organisational measures).
2. Where this is insufficient in an individual case, the Controller may, after reasonable notice and at most once a year during usual business hours, carry out an audit itself or through an auditor bound to confidentiality. The Controller bears the costs.

7. Return and deletion

1. When the processing ends, the Processor, at the Controller's choice, returns all personal data processed on its behalf or deletes it.
2. Return: the Controller can export all data at any time through the data export in the settings, as a ZIP file with a machine-readable JSON file and the original files (PDF, XML, receipts), covering all data categories under clause 2.2. If the contract ends other than by deletion of the account, the Processor provides the export on request in text form for 30 days after the end of the contract.
3. The Controller may state or change its choice until the end of the contract. Deleting the account in the settings constitutes the choice of deletion.
4. Deletion: the data, including copies held by sub-processors, is removed immediately from the live Service; residual backup copies are deleted automatically within 30 days, unless statutory retention duties of the Processor apply. Backups are not restored except for disaster recovery.
5. On request, the Processor confirms deletion in text form.

8. Liability, final provisions

1. Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the Terms of Service.
2. In case of conflict between this agreement and the Terms of Service, this agreement prevails with regard to data protection.
3. Austrian law applies; the place of jurisdiction is Graz.

Annex 1: Sub-processors

Supabase's further sub-processors (support, monitoring, security and communication tools, mostly in the USA) are published at supabase.com/legal/customer-resources/subprocessor-list (status 12 October 2026). They do not store the Controller's data but may come into contact with it when Supabase provides support, monitoring or security services; this is covered by the Standard Contractual Clauses in Supabase's Data Processing Addendum. The Processor subscribes to Supabase's and Hetzner's sub-processor notifications and passes on changes in accordance with clause 5.

Mistral AI's sub-processors are published at trust.mistral.ai/subprocessors (checked on 3 November 2026). The Processor passes on changes announced by Mistral AI in accordance with clause 5. Nothing is transmitted to Mistral AI for an AI feature the Controller has not switched on.

Not sub-processors but independent bodies: the European Commission (VIES query of VAT identification numbers on instruction), the European Central Bank (retrieval of reference rates without personal data) and Stripe Payments Europe, Ltd. (billing of the Controller's fees; concerns only the Controller's own data, not the data of its customers). When the Controller uses its own SMTP server on the Pro plan, that server's operator is a processor of the Controller, not of the Processor.

Annex 2: Technical and organisational measures

Physical and system access control

• Operation in certified data centres of the sub-processors (physical security, access control, fire protection, redundant power supply).
• Access to servers and database only by the Processor via SSH keys or authenticated management consoles; no password logins.
• User access to the Service only through personal accounts with password (minimum length, hashing by the authentication service), encrypted HttpOnly session cookies with limited lifetime, rate limiting against brute force.

Data access control and tenant separation

• Strict tenant separation at the database level: every table carries a tenant identifier, and the database's row level security policies enforce that each query only reads or writes data of the logged-in tenant.
• Every request runs in a database transaction carrying the user's verified identity (JWT, verified against the authentication service's public key).
• Documents are stored in a private storage area with tenant-specific paths; no public access.
• Protection against cross-site request forgery, security headers (HSTS, nosniff, frame protection), no embedded third-party scripts.

Transfer control

• Encrypted transmission (TLS 1.2+) between browser and Service, between Service and database, and for e-mail dispatch (STARTTLS/TLS).
• Stored SMTP credentials are encrypted with AES-256-GCM, never displayed again and not exported; the key is kept outside the database.

Input and availability control

• Finalized invoices are immutable; times of creation, finalization, dispatch and payment are recorded.
• Daily automatic database backups by the database provider; timestamps and request identifiers in server logs without content data.
• The application runs in isolated containers without root privileges; dependencies are updated regularly.

Organisation

• Processing exclusively by the Processor personally; no further staff with data access.
• Data processing agreements with all sub-processors; regular review of these measures.
• Deletion concept: deletion of account data after the end of the contract in accordance with clause 7.