Data Processing Agreement (DPA)

Processing of third parties' personal data that you enter into the Olvano service (čl. 28 GDPR).

Appendix to the Terms and Conditions of the Olvano service · version 1.0 · effective from 29 June 2026

This data processing agreement (the "DPA") is concluded pursuant to čl. 28 of Regulation (EU) 2016/679 (GDPR) between the user of the Olvano service as the controller and the operator of the service as the processor. The DPA is concluded automatically together with the main agreement (see Terms and Conditions) and forms an integral part thereof.

1. Contracting parties

1.1 Controller – the user of the Olvano service who enters the personal data of third parties into the service (the "Controller").

1.2 Processor:

Daniel Krůl, IČO 09161244, registered office Mlýnská 1692/7, Moravská Ostrava, 702 00 Ostrava, e-mail dankrul.krul@gmail.com (the "Processor").

2. Subject matter and nature of the processing

2.1 The Processor processes personal data for the Controller solely for the purpose of providing the Olvano service (in particular issuing and managing invoices and other documents, matching payments, sending documents and reminders, signing documents and related features).

2.2 Nature of the processing: storage, organization, modification, use, disclosure and erasure of personal data by automated means within the service.

2.3 Duration of the processing: for the duration of the main agreement between the parties, unless otherwise provided below.

3. Categories of data subjects and personal data

3.1 Data subjects: the Controller's clients and business partners, recipients of invoices and documents, persons signing documents through the service, and possibly other persons whose data the Controller enters into the service.

3.2 Categories of personal data: identification and contact data (name, company name, address, IČO/DIČ, e-mail, telephone), billing and payment data, data contained in documents and their attachments, data related to the electronic signature (timestamp, IP address, record of consent, signature data). The Controller does not enter into the service special categories of personal data (čl. 9 GDPR), unless the parties agree otherwise.

The Processor undertakes to:

4.1 process personal data only on the basis of documented instructions from the Controller (the use of the service's features is also considered an instruction), including transfers to a third country only where required by the law to which it is subject; it will inform the Controller of such an obligation in advance, unless the law prohibits this;

4.2 ensure that persons authorized to process personal data have committed themselves to confidentiality;

4.3 adopt appropriate technical and organizational measures to secure the processing under čl. 32 GDPR (in particular hosting in the EU/EEA, access control, encryption of transmission, backups);

4.4 engage another processor (sub-processor) only under the conditions set out in Article 5 of this DPA;

4.5 assist the Controller by appropriate measures in fulfilling its obligation to respond to data subjects' requests (čl. 12–23 GDPR) and in fulfilling the obligations under čl. 32–36 GDPR (security, breach notification, impact assessment);

4.6 after the end of the provision of the service, at the Controller's choice, erase or return all personal data and erase existing copies, unless legal regulations require their storage;

4.7 provide the Controller with the information necessary to demonstrate compliance with the obligations under čl. 28 GDPR and allow for audits or inspections carried out by the Controller or an auditor mandated by it; it will inform the Controller of any instruction that, in the Processor's opinion, infringes the GDPR.

5. Sub-processors

5.1 The Controller grants the Processor general authorization to engage sub-processors in the processing for the purpose of providing the service (in particular providers of hosting and database, e-mail sending, SMS and web analytics, and similar services).

5.2 The Processor will bind each sub-processor by the same data protection obligations as those agreed in this DPA, and is responsible for its activity.

5.3 The Processor will inform the Controller of intended changes to sub-processors (addition or replacement) and will give the Controller the opportunity to raise an objection to the change. The current list of sub-processors corresponds to the list of processors stated in the Privacy Policy.

6. Transfer outside the EU/EEA

If personal data is transferred to a third country, the Processor will ensure appropriate safeguards under čl. 46 GDPR (in particular the European Commission's standard contractual clauses), or another valid legal mechanism.

7. Personal data breach

In the event of a personal data breach, the Processor will report this fact to the Controller without undue delay after becoming aware of it, and will provide the Controller with the cooperation needed for the Controller to fulfill its obligations under čl. 33 and 34 GDPR.

8. Liability

The liability of the parties is governed by the GDPR (čl. 82) and the main agreement. The contractual limitation of liability agreed in the Terms and Conditions applies also to this DPA to the extent permitted by legal regulations.

9. Final provisions

9.1 This DPA takes effect together with the main agreement and lasts for the period during which the Processor processes personal data for the Controller.

9.2 The DPA is governed by the legal order of the Czech Republic and the GDPR. In the event of a conflict between the DPA and the Terms and Conditions, this DPA prevails in matters of personal data processing.