Data Processing Agreement
This agreement under GDPR Article 28 and Spanish Organic Law 3/2018 (LOPDGDD) article 33 forms part of the Terms of Service between Voixa Consultors S.L., tax ID B24744351 (“Pescada”, the processor), and the Customer. It applies whenever Pescada processes personal data on the Customer’s behalf.
Where the Customer is itself a processor for its own clients (as an accounting firm usually is), Pescada acts as its sub-processor and the Customer confirms it is authorised by its clients to engage Pescada on these terms.
1. Subject, duration and purpose
Pescada processes personal data only to provide the service described in the Terms: storing and exchanging documents, keeping the activity log, sending notifications and reminders, and reading documents to extract accounting data and match payments to invoices. The agreement lasts as long as the Terms and any retention the law requires afterwards.
2. Data and data subjects
| Data subjects | Personal data |
|---|---|
| Users at the Customer and at its clients | Name, email, company, role, activity in the portal |
| Employees of the Customer’s clients | Data in payroll and tax documents: name, tax ID, social security number, bank account, salary |
| Customers and suppliers who are individuals or sole traders | Name, tax ID, address, amounts invoiced or paid, bank account |
| Partners, directors and signatories | Name, ID document number, address, signature |
The service is not designed for special categories of data (GDPR Article 9). The Customer will not upload such data unless agreed in writing.
3. Pescada’s obligations
- Process personal data only on the Customer’s documented instructions, which are these terms and the Customer’s use of the service, and tell the Customer if an instruction appears to infringe data protection law.
- Ensure that everyone authorised to process the data is bound by confidentiality.
- Apply the measures described on the Security page, which forms Annex 2 of this agreement.
- Engage only the sub-processors listed on the Sub-processors page (Annex 1), under written terms imposing the same obligations. Give at least 30 days’ notice of any new or replaced sub-processor; the Customer may object on reasonable data-protection grounds and, if we cannot address the objection, end the contract before the change applies.
- Help the Customer answer requests from data subjects and meet its obligations under GDPR Articles 32 to 36, taking into account the information available to Pescada.
- Notify the Customer of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, with the information then available.
- Make available the information needed to demonstrate compliance and allow audits, including inspections, by the Customer or an auditor it appoints, with 30 days’ notice and at most once a year unless a breach or a supervisory authority requires otherwise.
- Keep a record of processing activities as required by GDPR Article 30(2).
4. International transfers
Customer data is hosted in the European Union. Where a sub-processor outside the European Economic Area processes it, the transfer relies on an adequacy decision, including the EU-US Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses, as listed in Annex 1.
5. Customer’s obligations
The Customer confirms it has a lawful basis for the data it and its clients upload, gives data subjects the information the law requires, and keeps the list of people with access up to date.
6. Automated reading
The Customer instructs Pescada to read bank statements and invoices automatically, including with the AI provider listed in Annex 1 for PDFs and images. The Customer can ask us to switch AI reading off for its account; structured bank files (Norma 43, camt.053, CSV) are always read on Pescada’s own servers.
7. The activity log as evidence
The Customer acknowledges that the activity log is hash-chained and append-only, and that the tracking reports exported from it record the sending, notification, opening and confirmation of documents. The Customer may rely on them as evidence of those events with its clients.
8. End of the service
When the contract ends, the Customer can export its documents and activity log for 30 days. Pescada then deletes the Customer’s personal data, including copies, except where Spanish or EU law requires it to be kept. Documents are stored under a lock that prevents deletion for 6 years from upload, so that records required by the Commercial Code (article 30) are preserved; until the lock expires they are kept blocked and used for no other purpose, and they are deleted when it expires.
9. Liability and governing law
Liability follows the Terms of Service and GDPR Article 82. This agreement is governed by Spanish law and the courts of Barcelona have jurisdiction.