Data Processing Agreement: Toldo

Between:

• The controller: the merchant that installs the Toldo app in its Shopify store. Its name, address and NIP are taken from the app's "Seller details" when this agreement is accepted.
• The processor: Pending: [Company legal name], Pending: [Registered address], Pending: [Registration number and tax ID].

This agreement forms part of the Toldo terms of service (https://toldo.io/en/legal/terms), "the Terms". Terms not defined here have the meaning given in Regulation (EU) 2016/679 ("GDPR").

1. Subject matter and duration

1.1 The processor processes personal data on behalf of the controller in order to provide the Toldo service described in Annex I: issuing invoices from the controller's Shopify orders, sending them to KSeF, and storing the related documents.

1.2 This agreement applies for as long as the processor processes personal data for the controller. Its deletion duties continue after the Terms end.

2. Instructions

2.1 The processor processes personal data only on the controller's documented instructions. These are:

• this agreement and the Terms;
• the settings the controller chooses in the app, such as issuing rules, whether to invoice consumers, and which KSeF environment to use;
• written requests sent to support.

This includes instructions on transfers to third countries, unless EU or Member State law requires otherwise. In that case the processor tells the controller before processing, unless the law forbids it.

2.2 Connecting a KSeF token and enabling issuing is the controller's instruction to send its invoices to KSeF in its name.

2.3 The processor will tell the controller at once if it believes an instruction infringes the GDPR or other data protection law.

3. Confidentiality

The processor ensures that everyone authorised to process the personal data has committed to confidentiality, or is under a statutory duty of confidentiality.

4. Security

The processor applies the technical and organisational measures in Annex II (Article 32 GDPR). It may update them, as long as the overall level of protection doesn't decrease.

5. Sub-processors

5.1 The controller gives general authorisation for the sub-processors listed in Annex III.

5.2 The processor will announce any new or replacement sub-processor at least Pending: [Days of notice] days in advance, in the app and by email to the store's contact address. The controller may object on reasonable data protection grounds within that period. If the parties can't resolve the objection, the controller may end the service by uninstalling the app, and no fees apply for the remaining period. Pending: [Refund rule]

5.3 The processor binds each sub-processor to data protection obligations at least as protective as this agreement. The processor stays responsible to the controller for its sub-processors.

6. Recipients that are not sub-processors

6.1 The Ministry of Finance (KSeF). Invoices sent to KSeF are received by the Polish tax administration under Polish law. It acts as a separate controller, not as the processor's sub-processor. Invoices accepted in KSeF's production environment can't be deleted or changed; they can only be corrected by a corrective invoice.

6.2 Narodowy Bank Polski. The processor downloads public exchange rates from NBP. No personal data is sent to NBP.

6.3 Shopify. Shopify provides the controller's store under the controller's own agreement with Shopify. Shopify isn't a sub-processor of the processor.

6.4 Test environment. The processor uses KSeF's TEST environment (the app's Sandbox mode) only with fictional data: before sending, seller and buyer details are replaced with fictional ones, and only Shopify test orders are sent. The ministry requires this, and the TEST environment is shared between integrators. The processor doesn't use KSeF's Demo environment.

7. Help with data subject rights

7.1 Taking into account the nature of the processing, the processor helps the controller answer data subject requests.

7.2 This includes acting on the privacy requests Shopify sends (customers/data_request, customers/redact, shop/redact) within 30 days, as described in the Toldo privacy policy.

7.3 Where Polish tax law requires invoice data to be kept, the processor tells the controller what it kept and why.

8. Help with security, breaches and impact assessments

8.1 The processor helps the controller meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to it.

8.2 Breaches. The processor notifies the controller of a personal data breach without undue delay, and in any case within Pending: [Hours] hours of becoming aware of it. As far as it is known, the notification includes the information in Article 33(3) GDPR. The processor then gives updates, and helps with containment and with notifying data subjects.

9. Deletion and return

9.1 Return. Before uninstalling, the controller can export all invoices and documents in monthly ZIP files (XML, UPO, PDF). Invoices accepted by KSeF also remain available to the controller in KSeF.

9.2 Deletion. After the app is uninstalled and Shopify sends shop/redact, the processor deletes the controller's personal data within 30 days. Backups are overwritten within Pending: [Backup retention period]. This applies unless EU or Member State law requires the processor to keep the data.

9.3 The processor deletes the controller's KSeF token at once when the controller disconnects it or uninstalls the app.

10. Information and audits

10.1 The processor makes available all information needed to show compliance with Article 28 GDPR.

10.2 It allows audits, including inspections, by the controller or an auditor the controller appoints, on these terms:

• at most once every 12 months, unless there has been a breach or a supervisory authority asks for it;
• with Pending: [Days of notice] days' notice;
• during business hours;
• under confidentiality;
• at the controller's cost.

10.3 The processor may first offer recent audit reports, certifications or written answers instead.

11. Transfers outside the EEA

The processor stores personal data in the European Economic Area. It transfers personal data outside the EEA only with a valid mechanism under Chapter V GDPR, such as the Standard Contractual Clauses, and only for the sub-processors listed in Annex III.

12. Liability, precedence and law

12.1 Liability is governed by the Terms, subject to Article 82 GDPR. Pending: [Liability cap]

12.2 Precedence. On data protection matters, this agreement prevails over the Terms if they conflict.

12.3 Law. This agreement is governed by Pending: [Governing law]. The courts of Pending: [Courts with jurisdiction] have jurisdiction.

---

Annex I: Description of the processing

Annex II: Technical and organisational measures

1. Encryption. TLS for all traffic. The database and backups are encrypted at rest. KSeF tokens and KSeF access tokens are encrypted with AES-256-GCM, using a key held in Pending: [Where the encryption key is kept], separate from the database. Only the token's last 4 characters are ever shown again.
2. Access control. Least privilege. Production access is limited to Pending: [Who has production access]. Accounts use unique strong passwords and two-factor authentication, and access is removed promptly when no longer needed.
3. Logging. Access to production data and administrative actions are logged. Logs are kept for Pending: [Log retention period] and reviewed Pending: [Review frequency].
4. Separate environments. Test and production are separated. Production data is never copied to test or development systems. KSeF TEST receives fictional data only, and KSeF Demo isn't used.
5. Data minimisation. Only the fields an invoice needs are stored. Buyer email and phone are not stored. Logs and error reports are configured to leave out invoice and buyer data.
6. Data loss prevention. No production data exports to personal devices. Database access only through Pending: [Database access method]. Bulk exports are allowed only through the in-app ZIP export, for the store's own data.
7. Backups and recovery. Backups are encrypted, kept in the EEA, retained for Pending: [Backup retention period] and test-restored Pending: [Test frequency].
8. Vulnerability management. Dependencies are updated and security patches applied within Pending: [Patch time].
9. Incident response. There is a written policy with severity levels, roles, escalation, evidence collection and timelines for notifying controllers (section 8.2).
10. People. Confidentiality commitments, and privacy and security training for anyone with access.
11. Deletion. The deletion procedures run on Shopify's privacy webhooks and on uninstall (section 9).

Annex III: Sub-processors

These are not sub-processors (see section 6): the Ministry of Finance (KSeF), Narodowy Bank Polski and Shopify.