Data processing agreement (DPA)
Last updated: September 10, 2026
This agreement sets out, in accordance with Article 28 of the GDPR, the conditions under which Auditavi processes personal data on behalf of a subscribing accounting firm. It draws on the CNIL's model clauses and on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/915).
This agreement applies automatically to any subscription to Auditavi, with no separate signature required; it is incorporated by reference into the Terms of service. If your firm needs a countersigned copy for its own compliance file, write to support@auditavi.be.
Subject matter
The accounting firm, as controller, entrusts Auditavi, as processor, with the processing of personal data described below, in connection with the provision of the Auditavi service.
Description of the processing
Nature: hosting of uploaded documents, AI-based extraction, arithmetic-check calculations. Purpose: providing the cash book digitisation and verification service. Data concerned: identification details and accounting information contained in uploaded documents (names, amounts, dates, descriptions), as well as the account data of the firm's users. Data subjects: the firm's clients whose documents are uploaded, and the firm's staff who use the service.
Duration
This agreement applies for as long as the subscription is active, and for as long as data is retained in accordance with our Privacy policy.
Auditavi's obligations as processor
Auditavi undertakes to: process data only for the purposes of the service and on the firm's instructions; ensure that anyone authorised to process the data is bound by confidentiality; implement the security measures described below; comply with the conditions for sub-processors set out below; assist the firm in responding to its clients' rights requests; notify any personal data breach without undue delay and at the latest within 48 hours of becoming aware of it; delete or return data at the end of the contract; and make available the information necessary to demonstrate compliance with these obligations.
The firm's obligations as controller
The firm undertakes to: only upload data it is authorised to process as part of its accounting engagement; document in writing any additional instructions to Auditavi; comply with its own GDPR obligations towards its clients; and inform Auditavi without delay of any complaint or request it receives in connection with the processing.
Sub-processors
The firm gives Auditavi general authorisation to use the sub-processors listed below. Auditavi will inform the firm of any intended change (addition or replacement) at least 30 days in advance, during which the firm may object on legitimate data-protection grounds.
Security
Each firm is isolated by database-level security rules (Row Level Security): one firm can never access another firm's data. Data in transit is encrypted (HTTPS). Access is limited to the firm's own members and authorised Auditavi staff.
Transfers outside the European Union
All sub-processors listed below process data within the European Union. Stripe, our payment provider, may carry out certain additional processing outside the EU, governed by the European Commission's standard contractual clauses.
Data at the end of the contract
When the subscription ends, data is deleted within a reasonable timeframe, except where a longer retention period is legally required for accounting purposes. Confirmation of deletion can be provided on request.
Audit
Auditavi makes available to the firm the information necessary to demonstrate compliance with this agreement and allows for a reasonable audit, subject to at least 30 days' written notice.
Contact
For any question about this agreement or data protection: support@auditavi.be
Governing law
This agreement is governed by Belgian law and subject to the exclusive jurisdiction of the courts of the judicial district of Liège, as with the Terms of service.
Authorised sub-processors
| OVHcloud | Storage of uploaded documents | Gravelines, France (EU) |
| Neon | Database | Frankfurt, Germany (EU) |
| Upstash | Processing queue and cache | Frankfurt (Germany) and Dublin (Ireland), EU |
| Vercel | Application hosting | Frankfurt, Germany (EU) |
| Mistral AI | AI-based data extraction | France (EU) |
| Brevo | Transactional email delivery | France (EU) |
| Stripe | Payment processing and billing | Ireland (EU), with additional processing outside the EU under contractual safeguards |