Auftragsverarbeitungsvertrag

1. Parties and conclusion

Controller (“Customer”): the company or self-employed person that has accepted the VectorInvoice Terms of Service, with the details stored in its account and in its billing data.

Processor (“Provider”): Alexander Mauz, individual activity (individuali veikla) in the Republic of Lithuania, trading as “VectorInvoice”, individual activity certificate no. 1174510, Vytauto g. 8-37, LT-66130 Druskininkai, Lithuania, VAT number LT100015222816, email support@vectorinvoice.lt.

This Agreement is an integral part of the VectorInvoice Terms of Service (https://www.vectorinvoice.lt/en/terms, the “Main Contract”). It is concluded automatically when the Customer accepts the Terms of Service; no separate request or signature is needed. It applies to all personal data that the Provider processes on behalf of the Customer under the Main Contract.

2. Subject matter and nature of the processing

The Provider operates the web application VectorInvoice, which lets the Customer upload receipts and invoices, have fields read from them, keep an income and expense journal, issue sales invoices, manage a team, and prepare Lithuanian tax files (such as i.SAF, GPM311, FR0600, and FR0781) for the Customer's own review.

Processing operations: hosting and storage; encryption; automated reading of fields from uploaded documents; display to the Customer's authorised users; generation of export files and draft tax files; sending emails that the Customer triggers (for example invitations, invoice emails, security codes); VAT-number validation when the Customer uses the lookup; support access only after a time-limited grant by the Customer; export and deletion.

The Provider does not submit any file to the Lithuanian tax authority (VMI) or any other authority on the Customer's behalf.

Customer data is not used to train machine-learning models, not sold, and not used for advertising.

3. Duration

This Agreement runs for the term of the Main Contract and afterwards until all Customer personal data has been deleted or returned under the section “Deletion and return”.

4. Categories of data subjects

The Customer's account holders and authorised users; employees and team members the Customer invites; the Customer's suppliers, buyers, and other business contacts named in receipts, invoices, bank lines, or journal entries, where they are natural persons or contain names of contact persons; persons who receive emails the Customer sends through the service.

5. Categories of personal data

Account data: name, email address, password hash, optional authenticator secret and recovery-code hashes, language, plan, and billing status.

Taxpayer data of the Customer: legal name, personal or company code, VAT code, address, IBAN.

Document data: receipt and invoice images and PDFs, extracted text, supplier and buyer names, codes, VAT numbers, email addresses, invoice numbers, dates, amounts, line descriptions, notes, travel purpose and destination.

Bank lines and journal entries entered or imported by the Customer; team data (invite emails, review comments); support data (ticket subject, messages, attachments, contact name and email); technical data (session identifiers, IP address for rate limiting and security logs, audit log entries with actions and counts, not content).

No special categories of data (Article 9 GDPR) are intended to be processed. If the Customer uploads documents that contain such data, the Customer is responsible for that decision.

6. Instructions

The Provider processes personal data only on documented instructions of the Customer. The Main Contract, this Agreement, and the Customer's use of the functions of the application are the instructions.

The Provider informs the Customer without delay if it considers that an instruction infringes data protection law, and may suspend that instruction until it is confirmed or changed.

If Union or Member State law requires processing beyond the instructions, the Provider informs the Customer before the processing unless that law prohibits it.

7. Confidentiality

The Provider ensures that persons authorised to process the personal data are bound to confidentiality.

8. Technical and organisational measures (Article 32 GDPR)

The measures below describe the service as built. They are a description, not a certification; no certificate is claimed.

Encryption at rest: field-level encryption with AES-256-GCM. Each customer account has its own data key, which is wrapped by a master key; the plain data key is not stored. Receipt files are encrypted with a random per-file key that is wrapped by the account data key; object storage only receives ciphertext. Email and VAT look-ups use a keyed blind index. Deleting an account destroys its data key, which makes remaining ciphertext copies unreadable. Dates, statuses, currency codes, and other technical metadata are not encrypted at field level.

Encryption in transit: HTTPS only, with HSTS on the website and the API. The production database connection requires TLS. Calls to subprocessors use HTTPS; the mailbox connection uses IMAP over TLS.

Tenant isolation and access control: all queries are scoped to the Customer's taxpayer, and PostgreSQL row-level security is enabled on tenant tables. Provider support access to Customer documents requires an active, time-limited grant (1 to 72 hours) created by the Customer, which the Customer can revoke; each access is written to the audit log.

Authentication and sessions: passwords are hashed with Argon2id; sessions use httpOnly, Secure, SameSite=Strict cookies with short-lived access tokens and rotating refresh tokens; CSRF protection; two-factor authentication (TOTP with recovery codes) is available to users and required for administrator accounts; sign-in is locked after repeated failures; rate limits apply to sign-in, the API, uploads, and emails; deletions require the password and a one-time email code.

Integrity and logging: an append-only audit log that stores actions and counts, not document content. Uploads have a size limit and file-type checks; images are re-encoded and their metadata removed; PDFs are rebuilt, and PDFs with scripts or embedded files are rejected. Security headers include a Content Security Policy.

Availability: hosting on managed services of Scaleway in the region Paris (fr-par). Database backups use the backup feature of the managed database service.

Data minimisation and location: receipt reading only calls the EU endpoint of Mistral AI; other endpoints are refused in code. Key management and transactional email are restricted in code to the region Paris (fr-par). Uploaded receipt files are kept for 2 years (730 days) from the document date by default, with reminders 60 and 14 days before deletion; extracted fields remain until the Customer deletes them.

Organisational measures: a documented breach-response procedure; review of these measures on significant changes.

The Provider may update the measures, provided that the overall level of protection is not reduced.

9. Subprocessors

The Customer gives general authorisation to engage the subprocessors listed in Annex 1. The Provider informs the Customer of any intended addition or replacement at least 30 days in advance by email and by updating the public list at https://www.vectorinvoice.lt/en/subprocessors. The Customer may object on reasonable data-protection grounds within that period; if no solution is found, the Customer may terminate the affected service.

The Provider imposes data-protection obligations on each subprocessor that are equivalent to those in this Agreement, and remains liable for the subprocessor.

Transfers outside the EU/EEA take place only if the requirements of Chapter V GDPR are met. Customer content is processed in the EU (France). Stripe may transfer payment data outside the EU under the safeguards described in its privacy policy. Providers may process their own account and billing metadata elsewhere under their own terms.

10. Assistance to the Customer

The Provider supports the Customer with appropriate technical and organisational measures in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). Self-service functions: export of account data, deletion of files, deletion of records, deletion of the account. Requests that the Provider receives directly are forwarded to the Customer without undue delay.

The Provider assists the Customer with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available to the Provider.

11. Deletion and return

During the term, the Customer can export and delete data at any time in Settings.

After the Main Contract ends, or after a free trial ends without a paid plan, the Customer can export its data for 30 days. The account is read-only during that window. After that period the Provider deletes the Customer's personal data, unless Union or Member State law requires storage. A reduced accounting row (period, direction, document number, date, and amounts) may be kept for the retention window configured in the application. Deleting the account destroys the account's data key.

Logical backups of the managed database are not volume encryption. Field and file ciphertext stays ciphertext in those copies, and access stays limited to the operator. Copies are overwritten according to the backup retention of the hosting service. Emails already sent and the append-only audit log, which contains no document content, are not removed by the deletion function.

The Provider confirms the deletion by email if the Customer asks for it.

12. Audits and information

The Provider makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, in particular this description of measures and the subprocessor list.

The Customer may carry out audits, including inspections, itself or through an independent auditor bound to confidentiality, with reasonable advance notice and during business hours. Audits of subprocessors are carried out by means of the audit reports and information they publish.

13. Personal data breaches

The Provider notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach that affects Customer data, by email to the email address of the Customer's account. As far as known, the notification contains the information in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point (support@vectorinvoice.lt). Information may be provided in phases.

The Provider takes the necessary measures to secure the data and to mitigate adverse consequences, and documents every breach.

Notifying the supervisory authority and the data subjects is the Customer's responsibility as controller. The Provider does not notify the authority on the Customer's behalf unless instructed.

14. Liability and final provisions

Liability follows Article 82 GDPR and the liability clause of the Main Contract.

In case of conflict, this Agreement prevails over the Main Contract regarding data protection.

This Agreement is governed by the law of the Republic of Lithuania. The courts of the Republic of Lithuania competent for Druskininkai, the Provider's place of business, have jurisdiction, as far as the law allows such an agreement. Mandatory data-protection rules remain unaffected.

Changes to this Agreement are made in the same way as changes to the Main Contract, with at least 30 days' notice by email.

The English text of this Agreement is binding. Versions in other languages are translations; in case of conflict, the English text prevails.

Annex 1: Subprocessors

Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France: Serverless Containers (website and API), managed PostgreSQL, Object Storage (encrypted receipt files), logs, and Transactional Email. Data: all Customer data listed above. Location: region fr-par (Paris, France). Account encryption keys in this deployment are held by the application.

Mistral AI SAS, 15 rue des Halles, 75001 Paris, France: reading uploaded receipts, turning a sentence into a draft, speech-to-text, only through the EU endpoint api.eu.mistral.ai. Data: the uploaded document, sentence, or recording only. Only when receipt reading is switched on.

Hostinger (EU): domain, DNS, and mailboxes for @vectorinvoice.lt, and receipt mail when that module is on. Data: content of emails that the Customer or its users send to those mailboxes, and the Provider's replies.

Stripe Payments Europe, Limited, Dublin, Ireland: payments for paid plans (Checkout, customer portal, subscriptions, invoices). Data: name, email, billing address, VAT number if entered, and payment details of the Customer's account. Card details are entered on Stripe's page and are not stored by VectorInvoice.

Not subprocessors in the strict sense: the VAT-number lookup of the European Commission (VIES) and the Lithuanian open-data portal get.data.gov.lt receive a VAT number or company code when the Customer uses the lookup.