Data processing and subprocessors

1. Parties and scope

GENWINIT’s published terms identify the supplier as Genwinit unipessoal, Lda, with published contact address Rua Serpa Pinto nº 74, 1º, 2350-552 Torres Novas, Portugal, and geral@genwinit.pt. Full contractual identification, representatives and contacts for both parties must appear in the signed schedule.

Within the scope defined by this agreement, the customer determines the purposes and acts as controller; GenwinIT acts as processor. If the customer acts on another entity’s behalf, the schedule must identify that chain, the authority to appoint GenwinIT and the applicable instructions. The agreement does not automatically cover GenwinIT’s own processing described in the website and application privacy notices.

2. Subject matter, operations, data and duration

The proposed subject matter is delivery of the contracted SAV modules: collection and upload, storage, organisation, searching, viewing and authorised sharing of financial and document information, text and metadata extraction, authorised integrations and deletion. Processing lasts for the contracted service and the agreed return or deletion period. Local OCR and extraction through an external AI service are separate operations; the latter requires express inclusion in the scope and authorised providers.

Depending on selected modules, data may include identification and business contacts, tax and bank identifiers, invoices, transactions and balances, payroll, leave, expenses, travel and vehicle registration details, SAF-T files, metadata and activity records. Data subjects may be authorised users, workers, representatives, customers, suppliers and others mentioned in documents. The schedule must restrict these categories to actual use, identify any GDPR Article 9 or 10 data and specify corresponding safeguards; there is no general authorisation to upload excessive data.

3. Documented instructions and limits

GenwinIT will process data only under the customer’s documented instructions, including international transfers. The contract and requests from authorised representatives recorded through the agreed channel will constitute those instructions. The customer will ensure lawful collection, information to individuals, applicable legal grounds and access permissions. Enabling an integration does not replace assessing whether its use is lawful.

GenwinIT will immediately inform the customer if it considers an instruction contrary to data-protection law; the affected operation will be suspended pending lawful clarification. Where Union or Member State law requires processing, GenwinIT will inform the customer beforehand unless legally prohibited. Contracting SAV does not authorise documents for advertising, independent reuse or model training; any different purpose requires its own assessment and is not granted by this draft.

4. Authorised people and confidentiality

GenwinIT will restrict access to people who need the data to provide the service and who have a confidentiality commitment or equivalent statutory duty. Access will follow assigned roles and be reviewed when those roles end or change.

The customer will identify administrators, accountants and other authorised users, communicate changes and protect credentials within its control. Operational contacts and support-access rules must be recorded in the schedule, including authorisation and logging of necessary access to customer documents.

5. Technical and organisational measures

The security schedule must describe measures actually applied and appropriate to the risks: access control and customer separation, protection of communications and storage, credential management, updates, logging, recovery and periodic assessment. GenwinIT will maintain agreed measures and document significant changes. These topics require completion; they do not certify unverified controls, encryption or availability levels.

The schedule must also cover plugin installations, local folders, copies of failed files, reports and permissions where used. Each party will maintain measures assigned to infrastructure it controls. Testing and recovery procedures will have verifiable criteria without promising absolute security.

6. Authorisation of subprocessors

Appointing a subprocessor requires the customer’s prior written authorisation. The parties will choose specific or general authorisation in the schedule. Under general authorisation, GenwinIT will give advance notice of additions or replacements, identifying the entity, service, data, countries and safeguards so the customer can object before processing starts.

The channel, advance-notice period and objection deadline will be agreed in the schedule; this draft does not presume an accepted deadline. A reasoned objection will be addressed before activation through a suitable alternative or suspension of the affected operation and an agreed contractual solution. GenwinIT will impose equivalent obligations on the provider and remain responsible to the customer for that subprocessor’s performance of its obligations.

7. Provider inventory requiring verification

This inventory separates capabilities found in source code from confirmed production services; it is not a list of approved subprocessors. The code includes document storage in Amazon S3 and extraction of invoice and bank-statement text through an OpenAI-compatible API. Before inclusion in the schedule, actual use, contracting entity, region, international access, transmitted data, retention and training-use terms must be verified.

Application messages may use customer-configured SMTP or a default mail service. Tawk chat is configurable. Provider identification and allocation of responsibilities depend on the configuration and who contracts the service. Hosting, databases, backups and monitoring services receiving customer data must also be included in the verified inventory.

Cloudflare Turnstile, AWS API Gateway/Lambda and Resend were verified for the public contact form. That use does not automatically make them subprocessors for the SAV archive or notifications. The contact service’s Paris region does not establish the location of customer documents either.

8. Locations and transfers

The schedule will identify storage, backup and support-access countries for each authorised provider. Customer instructions and a valid GDPR Chapter V safeguard will be required where an operation constitutes an international transfer; a European hosting region alone does not rule out other access.

GenwinIT will provide identification of the applicable mechanism and relevant documentation, including assessments and supplementary measures where needed. This draft does not confirm adequacy decisions, contractual clauses or the absence of transfers for any unverified provider.

9. Rights, assessments and cooperation

GenwinIT will notify the customer of individual requests concerning data processed on its behalf and provide appropriate assistance with access, rectification, erasure, restriction, portability and objection, taking account of the processing. It will not determine the request in place of the customer or respond on its behalf without authorisation, unless legally required.

GenwinIT will provide information and cooperation needed for security, impact assessments, prior consultation and other GDPR Articles 32–36 obligations, considering the information available. Contacts, routing and operational response times will be defined in the schedule to support compliance with the customer’s legal deadlines.

10. Personal data breaches

On becoming aware of a personal data breach covered by the agreement, GenwinIT will notify the customer without undue delay through the agreed incident contact. The notification will describe its nature, affected data and individuals as known, likely consequences, measures taken or proposed and a contact point; missing information will follow progressively.

GenwinIT will cooperate in containment, investigation and documentation. The customer will assess its obligations to the authority and individuals. The statutory 72-hour period that may apply to a controller notifying the authority is not a waiting period granted to GenwinIT before informing the customer.

11. Retention, return and deletion

When processing services end, GenwinIT will return or delete data at the customer’s choice and delete existing copies, except where Union or Member State law requires retention. The schedule will define export format, retrieval window, execution and confirmation deadlines, including derived data, email queues, local files and backups.

Backup expiry cycles, access restrictions and handling of data reintroduced through recovery must be agreed and technically verified. Statutory retention will be identified and limited to the purpose requiring it. No immediate deletion of every copy is promised, and the public contact function’s 14-day log period does not apply to documents.

12. Evidence and audits

GenwinIT will make available information needed to demonstrate compliance with this agreement and permit and support audits, including inspections, by the customer or its appointed auditor. Evidence may include security measures, instructions, providers, locations and deletion records.

The parties will agree practical arrangements, confidentiality and protection of other customers’ data without preventing verification required by the GDPR. Providing a report does not by itself remove the right to a necessary audit. Identified deficiencies will require corrective action and documented follow-up.

13. Items to complete before signature

The customer schedule must specify: identity, capacity and representatives of the parties; contract and duration; authorised modules and operations; individuals and data categories; instructions and contacts; security measures; providers with legal entity, role, countries, data and safeguards; authorisation model and change procedure; assistance and incidents; retention, export, deletion and backups; and audit arrangements.

Operational facts and open terms must be completed and reviewed before acceptance by the parties. This page can support preparation, but reading it or using the website does not amount to signature. This draft does not displace individuals’ statutory rights or the parties’ legal responsibilities.