Data Processing Agreement

1. Roles and instructions

For Customer business data containing personal data, the Customer is the data controller and MK Accounting Service Provider is the data processor unless law requires a different role. The Provider shall process such data only on documented instructions expressed through this agreement, platform configuration, support requests and lawful requirements.

2. Processing details

Processing includes collection, storage, organisation, retrieval, reporting, transmission, backup, support and deletion necessary to operate MK Accounting. Data subjects may include Customer users, customers, suppliers, employees and other persons recorded by the Customer. Data categories depend on enabled modules and may include identity, contact, commercial, financial, employment and payroll information.

3. Provider obligations

• Ensure authorised personnel are bound by confidentiality.
• Apply appropriate risk-based technical and organisational safeguards.
• Assist the Customer, within reasonable limits, with data-subject requests, security incidents and compliance information.
• Notify the Customer without undue delay after confirming a personal-data breach affecting Customer data, subject to lawful restrictions.
• Delete or return Customer data after termination when requested and legally permitted.
• Maintain relevant processing and security records.

4. Customer obligations

• Have a lawful basis and provide required notices for all uploaded personal data.
• Issue lawful instructions and avoid uploading excessive or prohibited data.
• Manage users, permissions, devices and exported copies.
• Determine statutory retention and respond to individuals and regulators.

5. Sub-processors and transfers

The Customer authorises infrastructure, hosting, backup, communications and support sub-processors reasonably required to deliver the service, provided they are bound by appropriate protection duties. The Provider remains responsible for its sub-processor obligations. Material new sub-processors or cross-border arrangements shall be handled in accordance with applicable notice and legal requirements.

6. Audit and assurance

On reasonable written request, the Provider will supply available information needed to demonstrate relevant processing controls. Audits must protect other customers, confidential information and system security and should avoid unreasonable disruption or cost. ISO, ISACA and eGA references are control-design guidance, not a certification statement.

7. Priority and duration

This DPA applies while the Provider processes Customer personal data and survives termination until that processing ends. If it conflicts with the Terms on personal-data protection, this DPA controls to the extent of the conflict. Effective date: 06 October 2026.