COBIQO Data Processing Agreement (DPA)

Version 1.0 · Effective from 26 October 2026

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• the Customer, acting as controller ("Controller"); and
• Cobofam South SL ("Cobiqo"), acting as processor ("Processor"),

(together the "Parties"). This DPA forms an integral part of the Terms and Conditions. Capitalised terms not defined here have the meaning given in the Terms and Conditions.

2. Subject matter and scope

This DPA governs the processing of personal data by Processor on behalf of Controller in providing the Service, in accordance with article 28 GDPR. The processing activities are listed in annex 1.

3. Nature and purpose of the processing

Processor processes personal data solely to:

• provide the Service, including invoicing, accounting, personnel and payroll administration, CRM and reading documents;
• carry out Statutory Transmissions on Controller's instructions (Peppol, VeriFactu);
• enable integrations activated by Controller;
• make and restore backups;
• provide support and maintenance, including Support Access (article 7);
• ensure the security and performance of the Service.

4. Categories of data and data subjects

The categories are listed in annex 1. Controller decides which data it includes in the Service. Controller includes special categories of personal data (such as health data in absences) only where there is a legal basis and it is necessary for the administration.

5. Obligations of Controller

Controller shall:

• ensure a valid legal basis for the processing;
• provide the required information to data subjects, including its staff;
• ensure that the personal data is accurate and lawful;
• manage users and permissions in the Account and revoke them in time.

6. Obligations of Processor

Processor shall:

• process personal data only on documented instructions of Controller. Those instructions are set out in the Terms and Conditions, this DPA and Controller's configuration of the Service. Processor informs Controller without delay if, in its opinion, an instruction infringes the GDPR;
• ensure that persons processing personal data are bound by confidentiality;
• take the measures in article 8;
• not use personal data for its own purposes, except aggregated and anonymised data as permitted in the Terms and Conditions;
• assist Controller with a data protection impact assessment and prior consultation, insofar as they concern the Service.

7. Access for support (Support Access)

Controller instructs Processor, for the purposes described in article 16 of the Terms and Conditions, to access the personal data in the Account by means of Support Access. Processor limits this access to what is necessary for the purpose, logs every access, and makes the logs available on request. The Administrator can also consult the logs in the Account. Support Access is read-only by default. This access does not constitute processing outside Controller's instructions.

8. Security measures

Processor takes appropriate technical and organisational measures, including:

• a separate database per Account and separation per Company;
• two-step verification, mandatory for Administrators and platform staff;
• roles and permissions based on the principle of least privilege;
• encryption in transit and of backups outside the server;
• daily backups with regular restore tests;
• logging of sign-ins, administrative actions and Support Access; the platform log cannot be altered;
• measures against unauthorised access and data breaches.

9. Sub-processors

Controller authorises Processor to engage the sub-processors in annex 2. Processor announces a new or replacement sub-processor at least thirty (30) days in advance by email or in the Service. Controller may object on reasonable grounds within that period. If the Parties cannot find a solution, Controller may terminate the Subscription with effect from the date the sub-processor is engaged. Processor imposes the same data protection obligations on sub-processors and remains liable for their performance.

10. International transfers

Processor stores the data of the Service in the European Economic Area. Transfers outside the EEA (for example to an AI provider) take place only with appropriate safeguards, such as standard contractual clauses or an adequacy decision.

11. Data subject rights

Processor assists Controller in responding to data subject requests, including through the export and search features of the Service. Processor forwards any request it receives directly without delay.

12. Personal data breaches

Processor notifies a personal data breach affecting Customer Data without undue delay, and no later than forty-eight (48) hours after becoming aware of it. The notification contains the information available at that time: the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences and the measures taken or proposed. Processor supplements the notification as more becomes known.

13. Retention, return and deletion

Controller can obtain a full export of the Account at any time (article 6.6 of the Terms and Conditions). On termination, Processor deletes the Account after an announced waiting period. Before deletion, Processor automatically makes a full export. Processor keeps it encrypted and inaccessible for use, solely so that Controller or a competent authority can be given access while the statutory retention period for invoices and accounting runs, and for no more than ten (10) years. Copies in backups disappear in the backup cycle, no later than twelve (12) months after deletion.

14. Audits

On reasonable request, Processor provides the information necessary to demonstrate compliance with this DPA. Formal audits are limited to one per year, except after a breach. They require reasonable prior notice, are carried out by an auditor bound by confidentiality, do not disrupt business operations and give no access to other customers' data.

15. Liability

Liability under this DPA is subject to the limitations of the Terms and Conditions, to the extent the GDPR allows.

16. Term and order of precedence

This DPA applies as long as Processor processes personal data on behalf of Controller, including retention after termination (article 13). In case of conflict between this DPA and the Terms and Conditions, this DPA prevails for data protection.

Annex 1: Processing activities

Annex 2: Sub-processors

A bank, payment service or webshop that the Customer connects itself is not a sub-processor of Processor but a Third-Party Service of the Customer.