Data Processing Agreement

This Data Processing Agreement ("Agreement") is an annex to the Payper Terms of Service and applies when Payper ApS, CVR no. 46639766 ("Processor") processes personal data on behalf of the Customer ("Controller") in connection with use of the Payper Platform.

The Agreement is intended to meet the requirements of GDPR Article 28.

1. Parties and roles

1. The Customer is controller for personal data that the Customer or its users enter into the Platform about their own customers, enquiries, employees and other data subjects.
2. Payper is processor for processing necessary to provide the Platform under the Customer's instructions.
3. Payper is an independent controller for its own account administration, billing, support logs, security logging and own marketing. See the Privacy Policy.

2. Purpose and instructions

1. The Processor may process personal data only to provide, operate, secure, support and further develop the Platform in accordance with the contract and the Controller's documented instructions.
2. Documented instructions consist of the Terms of Service, this Agreement, Platform settings and any written instructions from the Controller.
3. The Processor shall promptly inform the Controller if an instruction appears to infringe the GDPR or other data protection law.
4. The Controller is responsible for having a lawful basis and for informing data subjects.

3. Categories of data subjects and data

Depending on Customer use, processing may include:

• Data subjects: the Customer's end customers/contacts, employees, suppliers and other persons the Customer registers
• Data types: name, contact details, address, appointments, job data, calendar data, messages, images, time tracking, billing-related information and related technical logs

The Platform is not intended for systematic processing of special categories of personal data (GDPR Art. 9) unless the parties agree otherwise in writing.

4. Duration

Processing continues while the Controller has access to the Platform and until deletion/return is completed after termination under the Terms of Service (generally up to 3 months after termination unless otherwise agreed or law requires longer retention).

5. Security

1. The Processor implements appropriate technical and organisational measures under GDPR Art. 32, including access control, encryption in transit, logging, backup and limited employee access.
2. Persons at the Processor who process personal data are subject to confidentiality.
3. The Processor shall notify the Controller without undue delay of a personal data breach that must be reported under GDPR Art. 33, with the information reasonably available to the Processor.

6. Sub-processors

1. The Controller gives general authorisation for the Processor to use sub-processors for hosting, database, email, SMS, payments, CDN, AI features and similar operations.
2. At the time of this Agreement, approved sub-processors include among others: Supabase, Stripe, Resend, Twilio, Cloudflare, Hetzner/Coolify, OpenAI/Anthropic (AI features), and Google, Dinero and Billy to the extent the Customer enables the integration.
3. The Processor enters into written agreements with sub-processors imposing equivalent data protection obligations.
4. Before adding or replacing a sub-processor, the Processor will inform the Controller with reasonable notice (generally 30 days) so the Controller may object on objective data-protection grounds. Continued use without objection is deemed acceptance.
5. The Processor remains responsible to the Controller for the sub-processors' performance.

7. Transfers to third countries

Primary hosting is in Germany (EU). If personal data is transferred outside the EU/EEA, the Processor ensures a valid transfer basis, typically Standard Contractual Clauses and/or an adequacy decision.

8. Assistance to the Controller

1. Taking into account the nature of processing, the Processor assists the Controller in fulfilling obligations towards data subject rights (GDPR Chapter III).
2. Upon reasonable request, the Processor provides information necessary to demonstrate compliance with Art. 28 and Arts. 32-36.
3. Extensive assistance, audits or custom development may be charged at a reasonable hourly rate by agreement, unless caused by the Processor's breach.

9. Audit

The Controller may once per year, with reasonable notice, request relevant documentation of the Processor's compliance with this Agreement. On-site audit requires objective grounds, adequate notice and must be conducted so operations and other customers are not unduly disrupted. Confidentiality and security must be respected.

10. Deletion and return

1. On termination, the Processor shall, at the Controller's choice, delete or return personal data and delete existing copies, unless EU or Danish law requires retention.
2. If the Controller gives no other instruction, data is deleted after the period stated in the Terms of Service (generally no later than 3 months after termination).
3. The Controller is responsible for exporting data during the retrieval period.

11. Liability

Liability for breach of this Agreement follows the limitation of liability in the Terms of Service, unless mandatory law provides otherwise.

12. Effective date

This Agreement takes effect when the Customer accepts Payper's Terms of Service or otherwise enters into an agreement to use the Platform, and continues until processing has finally ceased.

13. Contact