Data Processing Agreement

Last updated: 1 November 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", acting as data controller) and ZITA CH SINGLE MEMBER PRIVATE COMPANY, operating Billino ("Processor"), represented by Christos Zioutas. It governs any processing of personal data Billino carries out on your behalf when you use the service — for example, the names and addresses of your invoice recipients, details on expense receipts you upload, or customer data synced from a connected Shopify store. It applies automatically alongside the Terms of Service; by creating an account, you accept this DPA on behalf of your business.

Subject matter and duration

The subject matter is Billino's processing of personal data contained in invoices, invoice recipients, expense receipts, and — where you connect a store — Shopify order and customer data. Processing continues for as long as your account is active, and afterward only as needed to complete the deletion obligations below.

Nature and purpose of processing

We collect, store, structure, retrieve, and transmit the personal data described above solely to provide the Billino service as you direct — generating, storing, and delivering invoices and expense records, and running AI-assisted features (such as receipt scanning) where you choose to use them. We do not process this data for any purpose of our own.

Categories of data subjects and personal data

Data subjects may include your customers and invoice recipients, your suppliers or vendors named on expense receipts, and — where connected — your Shopify store's customers. The personal data involved is whatever you choose to include: typically names, addresses, email addresses, and similar identifying details on invoices, recipients, or receipts.

Our obligations as processor

• We process personal data only on your documented instructions — in practice, by operating the Billino service as you configure and use it — unless EU or member state law requires otherwise, in which case we will inform you before processing unless the law prohibits this.
• Everyone with access to your data is bound by confidentiality.
• We implement the technical and organizational security measures described below.
• We engage sub-processors only as described below, and remain responsible for their performance.
• We give you the tools described in "Data subject requests" below to action your customers' GDPR rights requests directly, and will otherwise assist you, taking into account the nature of the processing, where that's not sufficient.
• We will assist you in meeting your obligations around security of processing, breach notification, and data protection impact assessments, taking into account the nature of the processing and the information available to us.
• At the end of the provision of services, we will delete or return all personal data at your choice, and delete existing copies, unless EU or member state law requires us to keep it.
• We will make available the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits.

Your obligations as controller

You are responsible for the lawfulness of the personal data you put into Billino — including having a valid legal basis for collecting and sharing it — and for ensuring the instructions you give us (by using the service) comply with applicable data protection law.

Sub-processors

You give general authorization for us to engage the sub-processors listed below. We'll give reasonable advance notice of any change, with an opportunity to object.

Where a sub-processor is located outside the EU/EEA without an adequacy decision covering it, the transfer is covered by Standard Contractual Clauses as noted above.

Security measures

We maintain the following measures, appropriate to the risk:

• All invoice, recipient, and account data is hosted in the EU (Hetzner, Nuremberg / Frankfurt, Germany).
• All traffic between your device and our servers is encrypted in transit (TLS).
• Tenant isolation is enforced at the database layer (row-level security) — no account can access another account's data.
• Issued invoices are immutable — they cannot be destructively edited once issued.
• Automated daily backups.
• Access to production systems is limited to authorized team members, bound by confidentiality.
• Two-factor authentication is enabled on backend and infrastructure accounts where supported.
• Application and infrastructure logs are collected to support incident investigation.

Data subject requests

You can action a GDPR data subject request from any of your customers directly in the app, for any recipient on your account:

• Export — download everything held about that recipient, including their invoices, which we retain for your own accounting and tax recordkeeping.
• Deletion — we anonymize the recipient's personal details across your account, including on affected invoices. The invoice records themselves are not deleted: invoices are legal and accounting documents that must be retained under applicable law, and GDPR's right to erasure does not override that obligation (Art. 17(3)(b)). The invoice number, dates, and amounts stay intact; the recipient's name and other identifying details are replaced.
• Timing — a deletion request is processed immediately if you confirm it, or automatically within 21 days if you take no action, giving you a review window first.

This covers requests that reach you directly as well as ones Shopify forwards to us on a connected store's behalf.

Breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay.

Deletion and return of data

When the provision of services ends, we will delete or return your personal data at your choice, without undue delay, and in any event within a reasonable period reflecting normal backup rotation. This is separate from the per-customer deletion tool described above, which remains available throughout the relationship and is subject to the same accounting-retention limits.

Audit rights

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and provide for audits — including inspections — by you or an auditor you appoint, by mutual arrangement and with reasonable notice.

Liability, term, and governing law

Liability under this DPA is subject to the limitation of liability in our Terms of Service. This DPA applies for as long as we process personal data on your behalf, and survives until our deletion obligations above are complete. It is governed by German law, consistent with the Terms of Service.

Contact

Questions about this DPA or data protection generally? Email support@billino.io.