Data Processing Agreement (DPA)

1. Roles and Responsibilities

For any personal data contained in the invoices and receipts uploaded to the Application, the User acts as the Data Controller. The Publisher acts exclusively as the Data Processor (under GDPR and Swiss FADP) to perform technical analysis and automated extraction.

2. Legal Basis and Purpose of Processing

Data processing of invoices is based on the execution of the service contract (FADP Art. 13 / GDPR Art. 6(1)(b)). The purposes are limited to:

• Automatic extraction of accounting metadata (vendor, amounts, dates, taxes).
• Generation of naming proposals.
• Temporary grouping for file ZIP export.

3. Retention and Non-Storage

The architecture of BulkInvoice Manager Pro is designed under Privacy-by-Design principles:

• No Server Storage: Original files are never stored on the Publisher's servers.
• Active Client Session: Files exist only in the volatile memory of the User's active browser session and are discarded upon closing the session.
• No Logs: No database logs or server storage retains metadata or details of processed files outside of the active session.

4. International Transfers and Sub-processors

To perform the analysis and extraction, the required data (PDF page images and extracted text) are sent transitively to the API of OpenAI Inc. (USA).

This transfer is governed by:

• The Standard Contractual Clauses (SCC 2021/914) signed between the Publisher and OpenAI Inc.
• OpenAI Inc.'s certification under the EU-US / Swiss-US Data Privacy Framework (DPF).

Note: A migration of AI processing to a local Swiss host (Infomaniak SA) is planned. The Publisher will notify Users by written notice 30 days in advance.

5. Rights of the Data Subjects

To exercise your rights under GDPR or FADP (access, rectification, erasure, or portability of your personal data), you can contact the legal service at:

contact@easyaisolutions.ch

The Publisher commits to handling all requests within the legally required timeframes.