Data Processing Agreement

Rechna. Annex to the Terms. Version 1.0, 6 November 2026. English translation for information; the German version governs.

This agreement is the contract under Article 28(3) GDPR between your business as controller ("you") and Football Path X GmbH as processor ("we"). It is part of the Terms and takes effect on registration. No separate signature is needed. Where we have signed a separate agreement with you, that agreement applies instead of this annex.

1. Subject matter and duration

Subject matter is the processing of personal data that you record, upload or send through your Rechna workspace, so that you can create and manage quotes, invoices and other documents.

Duration. This agreement applies for as long as we process data for you, that is for the term of the contract and until deletion under section 9.

2. Nature, purpose, data and data subjects

Nature of processing: recording, storing, organising, displaying, generating PDF documents, exporting, sending by email and deleting.

Purpose: providing Rechna's features to your business.

Types of data: names, addresses, email addresses and phone numbers; VAT identification numbers and company register details where they relate to individuals; contact persons; the content of quotes, invoices, credit notes and delivery notes; incoming payments and open amounts; expense receipts and their files; names and email addresses of the people you give access to your workspace.

Data subjects: your customers and their contact persons, your vendors and their contact persons, your staff with access to Rechna, and people named in documents.

Special categories of data under Article 9 GDPR are not intended for Rechna. Please do not record such data.

3. Instructions

We process the data only on your documented instructions. Your instruction is your use of Rechna's features; this agreement and the Terms document it. You give further instructions in writing, including by email. We may charge reasonable costs for instructions that go beyond normal operation.

If we consider an instruction unlawful, we will tell you and may suspend it until it is resolved. If EU or Austrian law requires us to process otherwise, we will tell you beforehand unless the law prohibits it.

4. Confidentiality

Everyone at our end with access to your data is bound to confidentiality in writing or by a statutory duty of secrecy, and that duty continues after their work ends. Access is given only to people who need it for operation or for support you request.

5. Security

We take the technical and organisational measures under Article 32 GDPR described in Annex 1. We may develop them further provided the level of protection does not fall.

6. Sub-processors

You give us general authorisation to engage sub-processors. Those currently engaged are listed in Annex 2. We bind every sub-processor by contract to obligations equivalent to this agreement, and we are liable to you for them as for ourselves.

We announce a new or replaced sub-processor at least 30 days in advance by email to your workspace owner. If you object within that period on legitimate data protection grounds and we find no solution, you may terminate the contract effective at the time of the change. We refund fees already paid for the time after that pro rata.

7. Assistance

Data subject rights. Rechna lets you correct and export data yourself and archive directory entries. Where that is not enough, we help you answer requests under Chapter III GDPR. If a data subject contacts us directly, we forward the request to you and do not answer it ourselves.

Issued documents are frozen and cannot be deleted because of the retention duty under section 132 BAO. Take this into account for erasure requests.

Other obligations. We help you with security of processing, breach notifications, data protection impact assessments and prior consultations (Articles 32 to 36 GDPR) to the extent the necessary information is available to us.

8. Personal data breaches

We inform you without undue delay after becoming aware of a breach affecting your data, by email to your workspace owner. As far as known, the notice describes the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken. We provide information not yet available as it becomes available.

9. Return and deletion

During the term, you can download your issued documents as PDF and your customer, vendor and invoice lists as CSV at any time. You can open and save expense receipt files individually.

After the contract ends, your access continues for 30 days so that you can download your data. Within a further 30 days, we delete your workspace's data, including stored files. On request, we confirm the deletion in writing. We delete database backup copies no later than 90 days after they were made. Point in time recovery at Cloudflare reaches back at most 30 days. Where the law requires us to retain data, we delete it when that period ends.

The retention duty for your own documents is yours. Download your documents before deletion.

10. Evidence and audits

We provide the information you need to demonstrate compliance with Article 28 GDPR and allow audits by you or by an auditor bound to confidentiality whom you appoint. Please announce an audit in writing at least 30 days in advance. Audits take place at most once a year, unless there is a specific reason such as a personal data breach or an order of an authority. Each side bears its own costs. We may answer an audit with current reports or certifications from our providers where they answer the question.

11. Your obligations

You make sure that you may lawfully process the data you process in Rechna and that you have informed the data subjects under Articles 13 and 14 GDPR. You send documents and messages through Rechna only where you are entitled to.

12. Transfers outside the EEA

The production database and files are stored in the EU. Some sub-processors are based in the USA, see Annex 2. Transfers there are based on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. By agreeing to this agreement you authorise these transfers.

13. Liability and precedence

Liability follows section 13 of the Terms. Liability towards data subjects and authorities under Articles 82 and 83 GDPR is unaffected. If this agreement and the Terms conflict on a data protection matter, this agreement prevails.

14. Contact

Send questions about this agreement, audit requests, objections to sub-processors and notifications to privacy@rechna.at.

Football Path X GmbH, Othmargasse 34/16, 1200 Vienna, Austria. FN 641126 h.

Annex 1: Technical and organisational measures

Encryption. All connections to Rechna use HTTPS with TLS, with HTTP Strict Transport Security on the production addresses. Cloudflare stores the database and file storage encrypted.

Location. The production database and file storage are set up at Cloudflare in the EU jurisdiction.

User access control. Sign-in with email address and a password of at least 12 characters. Passwords are stored with scrypt and an individual salt. Session identifiers are stored only as hashes and expire after 12 hours. Sign-in attempts are limited per email address and per IP address. Resetting a password ends all existing sessions.

Permissions. Roles Owner, Office and Viewer with different rights. A workspace always keeps at least one active owner.

Separation of workspaces. Every data access is restricted on the server to the workspace of the signed-in person. Files also carry a workspace assignment that is checked before every access. Automated tests check this separation. The only exception is an overview for named Rechna administrators: for each workspace it shows only the name, owner email, access and billing status and the number of users and issued invoices, never content such as customers, receipts or documents. It is read only.

Separation of systems. The publicly reachable part of Rechna has no direct access to the database and files. It goes through a separate service that is not publicly reachable and checks every request itself. Test and production have separate databases and file storage. The application refuses access if environment and database do not match.

Protection against attacks. Checks on the origin of requests, size limits on input, signed payment notifications whose signature is verified before processing, and security headers against embedding in other sites.

Integrity. Issued documents are frozen and stored with the details as at the time of issue. Document numbers are assigned without gaps.

Availability and recovery. Cloudflare runs the database and file storage redundantly. Cloudflare provides point in time recovery for the database. A backup is made before every change to the database structure.

Organisation. Only named people bound to confidentiality have access to production data. Changes to the software are checked with automated tests before release.

Annex 2: Sub-processors

Stripe processes payments for your subscription with us as a controller in its own right and is not a sub-processor for your workspace data.