Parties and scope
This data processing agreement forms part of the terms of use between the business customer identified by its account and Rayquest Ventures LLC, whose business details appear above. It applies where we process personal data in the customer's workspace on its behalf. The customer is the controller, or a processor authorised by its controller; Rayquest Ventures LLC is the processor or subprocessor respectively. These processing terms take precedence over conflicting general terms concerning that processing.
For account administration, our own security, support administration and business records, the separate controller responsibilities in the privacy notice apply. Paddle independently handles its own purchase records. This agreement does not turn either party's independent controller activities into processing on the other's behalf.
Processing description and duration
The subject matter is the provision of FakturFokus invoice creation, inspection, storage, retrieval and deletion functions and support requested by the customer. Processing includes receiving, organising, calculating, checking, storing, retrieving, transmitting to authorised recipients and deleting data. It continues for the service relationship and the applicable deletion/retention periods.
Data subjects can include the customer's staff, suppliers, customers, invoice recipients and their representatives. Data can include names, contact and postal details, tax identifiers, bank/payment details, invoice items and amounts, correspondence, document identifiers and related metadata. Special-category data and criminal-record data are outside the intended scope and must not be supplied. The customer determines the specific content, purposes and lawful basis.
Instructions and confidentiality
We process customer content only on documented instructions, including the agreed service functions, account settings, the customer's authorised requests and this agreement, unless applicable law requires otherwise. We inform the customer of a legally required instruction before processing unless prohibited by law. We promptly tell the customer if we consider an instruction to infringe applicable data-protection law and may suspend the affected processing while it is resolved.
The customer is responsible for lawful collection, necessary notices, accurate instructions and authority to appoint us. Persons authorised to handle customer data must be bound by confidentiality or an appropriate statutory duty. Access must be limited to what is necessary for their task. Customer content must not be used for advertising or sold.
Security measures
We must maintain technical and organisational measures appropriate to the processing risks and review them as the service changes. The service uses HTTPS, authenticated private workspaces, backend ownership checks, database row-level security, separate API/worker roles and private object storage. Downloads require authorised requests or short-lived signed access. Background processing uses bounded jobs and access controls; application logs exclude document bodies and credentials.
Support access is restricted to authorised operators. The operator console exposes account/document metadata rather than document downloads; support can read content deliberately supplied in a support request. Account views are logged. Retention, account closure and background deletion limit ongoing availability. Credentials and provider access must be restricted and incident/recovery procedures maintained. These measures do not constitute end-to-end encryption, a particular certification, statutory archiving or an uptime/recovery guarantee.
Subprocessors
The customer gives general authorisation to use WIIT AG (webtropia), Germany, for application hosting and Supabase, including its disclosed infrastructure and account-email subprocessors, for authentication, database and private storage. The project region is Frankfurt, Germany. Supabase identifies its entities, further subprocessors and international arrangements in its data processing addendum and legal resources. The privacy notice distinguishes other independent service recipients such as DNS and payment providers.
We must impose data-protection duties on subprocessors that protect the customer data to the standard required by applicable law, and remain responsible for their performance of the processing duties we delegate. Before adding or replacing a subprocessor for customer content, we must give at least 30 days' notice through an account communication or email and an opportunity to object on reasonable data-protection grounds. The parties will seek a reasonable alternative. If the objection cannot be resolved, the customer may end the affected processing without a termination penalty; existing payment/refund rights are unaffected.
Zoho Mail provides the separate support email mailbox. If the customer chooses to send customer-controlled personal data by email, Zoho processes that correspondence and its attachments for email-based support; the application does not automatically forward workspace documents to Zoho. Its privacy notice describes its group entities and international processing. The subprocessor protection and change-notice obligations above also apply to this processing.
Locations and international transfers
Core application infrastructure is in Germany; the operator is a US company and account/support administration is performed from the United States. Supabase also has international operations as described in its linked terms. These locations form part of the disclosed processing arrangements, not a promise of EU-only access.
A transfer restricted by applicable data-protection law may take place only on documented instructions and with a valid transfer mechanism and any necessary supplementary protection. We must cooperate with the customer on required transfer assessments and supply information about applicable arrangements. This agreement does not itself replace or purport to be the European Commission's standard contractual clauses. Where a separate transfer instrument is legally necessary, it must cover the relevant parties and processing before the restricted transfer takes place.
Assistance, incidents and accountability
Taking account of the nature of processing and information available to us, we must assist the customer with data-subject requests, security obligations, breach notifications, impact assessments and consultations with supervisory authorities. Requests concerning customer-controlled invoice data are referred to the customer unless law requires a direct response.
We must notify the customer without undue delay after becoming aware of a personal-data breach affecting its processed data, provide available information about its nature, effects and mitigation, and provide further information as it becomes available. The customer remains responsible for notifications it is legally required to make to authorities or individuals.
We must make available information reasonably necessary to demonstrate compliance with these processing duties and allow and contribute to legally required audits, including inspections by the customer or a confidentiality-bound auditor. Audit arrangements must reasonably protect other customers' data, security and service availability; they must not prevent a legally required audit. Contact us through the details above to arrange instructions, assistance or an audit.
Return and deletion
The customer can download available files and delete records or close the account. Files/reports follow their displayed expiry, ordinarily seven days for Free and thirty days for existing advanced reports. Drafts, contacts and products remain until deleted or the account is closed. The customer should retrieve content before expiry or closure.
At the customer's choice we must return available customer data or delete it at the end of processing and delete remaining copies, except where applicable law requires retention. Automated expiry remains an agreed instruction; it does not promise recovery of expired files. Recovery copies, if any, must be isolated from normal use and removed through their retention rotation, with deletion records reapplied before restored data is reopened. The confidentiality and protection duties continue for any data lawfully retained. We must provide confirmation of completion on request.