Normbeleg — Data Processing Agreement (Art. 28 GDPR)

Version 1.0 · effective 10 October 2026

Between the Customer (controller) and PPFTEC S.R.L., Str. Patriarh Iustinian Marina nr. 17-19B, bl. DC12, mansardă, ap. 25, 240469 Râmnicu Vâlcea, Romania, CUI 55537142 (processor, "we"), trading as Normbeleg. This DPA forms part of the Normbeleg Terms of Service ("Terms", normbeleg.ppftec.com/terms) and is accepted with them. Contact for this DPA: privacy@ppftec.com; security incidents: security@ppftec.com.

1. Scope and roles

1.1 This DPA applies to personal data we process on the Customer's behalf to provide Normbeleg (Annex I). The Customer is the controller. If the Customer itself acts as processor for another controller, the Customer confirms it has that controller's authorisation and we are its sub-processor.

1.2 This DPA does not cover data we process as controller for our own purposes (Customer account and installation, acceptance records, our billing, support, security). Our App Privacy Notice (normbeleg.ppftec.com/app-privacy) covers that.

1.3 Stripe. Stripe is the Customer's own provider and the source system from which the App reads data with the permissions the Customer grants. Stripe is not our sub-processor and we are not Stripe's processor. Under the Stripe Apps Agreement (version of 28 April 2026, §8) neither Stripe nor we act as the other's processor or as joint controllers. Stripe processes the Customer's data under the Customer's own agreement with Stripe and in the role that agreement gives it.

1.4 Authorities and buyers. ANAF (Romanian Ministry of Finance, RO e-Factura/SPV) and, where the Poland Pack is used, the Polish Ministry of Finance (KSeF) receive invoices because the law requires the Customer to transmit them. They act as public authorities, not as our processors. Buyers and their mail providers receive invoices because the Customer instructs delivery. These are recipients on the Customer's instruction, not sub-processors.

2. Instructions

2.1 We process personal data only on the Customer's documented instructions, which are: the Terms, this DPA, and the settings the Customer makes in the App (Packs enabled, delivery options, archive option, connections to ANAF/KSeF). We process for no other purpose, unless EU or Member State law requires it; then we inform the Customer first unless that law forbids it.

2.2 We tell the Customer if we think an instruction infringes data protection law.

2.3 Archive instruction. The Customer instructs us:

• (a) all Plans: keep Documents and their records write-protected for 12 months from generation, then delete them;
• (b) paid Plans, once offered, if the Customer selects "Long-term archive" at setup (or later, for new Documents): keep each Document generated while the option is active, write-protected, until 31 December of the 8th year after its issue year, including after cancellation, uninstallation of the App or termination of the Terms, solely for storage, integrity checks and export to the Customer. The Customer confirms that it needs this retention to meet its own legal retention duties;
• (c) after the applicable period we delete, unless the Customer placed a legal hold (Terms 10.6).

3. Confidentiality

Only persons authorised by us who are bound by confidentiality may access the data. At version 1.0 that is PPFTEC's administrator only.

4. Security

We implement the measures in Annex II (Art. 32 GDPR). We may improve them; we will not lower the overall level of protection.

5. Sub-processors

5.1 The Customer gives general authorisation for the sub-processors in Annex III.

5.2 We give at least 30 days' notice of any intended addition or replacement by e-mail to the account owner and by updating Annex III on normbeleg.ppftec.com/dpa. The Customer may object on reasonable data-protection grounds within that period by writing to privacy@ppftec.com. If we cannot address the objection, the Customer may terminate the affected service and receives a refund of any unused prepaid fees.

5.3 We impose on each sub-processor data-protection obligations that are in substance the same as in this DPA, and we remain liable to the Customer for their performance.

6. International transfers

Storage of Customer data is in the EU (Annex II, measure 1). Cloudflare, Inc. is a US company and Workers code runs on Cloudflare's global network, so personal data may be processed transiently outside the EEA. Such transfers rely on Cloudflare's certification under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795) and, as fallback, the Standard Contractual Clauses in Cloudflare's Data Processing Addendum. Personal data that the Customer sends us by e-mail may be processed by Google outside the EEA under the transfer terms of the Google Cloud Data Processing Addendum (Annex III). We make no other transfer outside the EEA without the Customer's prior instruction.

7. Assistance

7.1 Data-subject requests. We forward to the Customer without undue delay any request we receive from a data subject about Customer data and do not answer it ourselves unless instructed. On the Customer's request we help find and export all Documents for a buyer.

7.2 Erasure versus retention. Where an invoice must be kept by law (Art. 17(3)(b) GDPR), the Customer may instruct us to restrict the buyer's Documents instead of deleting them; we keep them only for archive and export, and delete them at the end of the retention period.

7.3 We assist the Customer, taking into account the nature of processing and the information available to us, with Arts. 32–36 GDPR (security, breach notification, impact assessment, prior consultation).

8. Personal data breaches

8.1 We notify the Customer without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting Customer data, at the account owner's verified e-mail and in the App.

8.2 The notice describes, as far as known: what happened, categories and approximate numbers of data subjects and records, likely consequences, measures taken or proposed, and a contact. We provide further information as it becomes available.

8.3 If ANAF or KSeF Credentials may be compromised, we also delete them at once, tell the Customer to revoke them, and report the token to ANAF for blocking where ANAF's procedure provides for it.

9. End of processing: return and deletion

9.1 At the end of the Terms, the Customer can export all Customer data (Terms section 11). After the Data Act retrieval period (at least 30 days after the transition period), we delete all Customer data except:

• write-protected archive copies under 2.3(a) and 2.3(b), kept and deleted as instructed there;
• data we must keep by law.

9.2 Credentials are deleted immediately on disconnect, uninstall or termination.

9.3 Database point-in-time history (Cloudflare D1 Time Travel) rolls off within 30 days of deletion. Write-protected archive objects cannot be deleted before their lock date; this is why the Customer chooses the archive option knowingly.

9.4 On request we confirm deletion in writing.

10. Demonstrating compliance with Art. 28 and audits

10.1 We make available the information needed to demonstrate that we meet our obligations under Art. 28 GDPR: this DPA, Annex II, our records of processing (processor part), and the certifications and audit reports that Cloudflare and Google publish.

10.2 The Customer may send one written questionnaire per year free of charge to privacy@ppftec.com. If that is insufficient, or a supervisory authority requires it, the Customer (or an independent auditor bound by confidentiality) may audit, with 30 days' notice, during business hours, without access to other customers' data, at the Customer's cost. Audits of our sub-processors take place through their own reports.

11. Liability and term

11.1 Liability between the parties follows the Terms (section 14). Data subjects' rights under Art. 82 GDPR are not affected.

11.2 This DPA runs as long as we process Customer data, including any archive period.

11.3 Romanian law; courts as in the Terms. Supervisory authority for PPFTEC: ANSPDCP (Romania).

---

Annex I — Description of the processing

Annex II — Technical and organisational measures (Art. 32)

Annex III — Sub-processors and other parties

Sub-processors (general authorisation)

No other sub-processor is used at version 1.0.

Not sub-processors (stated for transparency)

Version 1.0. SHA-256 of the text of this version, as recorded when you accept it in the app: eb53156d64e05cfda7f7716a7cd8833d5341fb86a32ed1d0d0f69c2a63c26713