Data Processing Agreement (Article 28 of the General Data Protection Regulation)

This Agreement is concluded between the business that uses Operitivo, as controller, and Semicolon d.o.o., Rakovčeva ulica 60, 52100 Pula, Croatia, OIB 03411437372, which provides the Operitivo service, as processor (together: the Parties).

The Agreement is part of the Terms of Service. It is concluded when the business accepts the Terms of Service and this Agreement; the owner of the business's account in Operitivo accepts it on the business's behalf. There is one Agreement for each business, whatever the number of its users and branches.

The Agreement covers the personal data that Operitivo processes on behalf of the business, as described in Annex II, including the data of its users and workers, while the business uses the service and after that until the data is deleted or returned (Clause 10(d)). It does not cover data for which Semicolon d.o.o. is itself the controller: the account owner's sign-in details and billing contact, the subscription and its payment, and sign-in and security logs; the Privacy Policy applies to that data.

The Agreement consists of these Introductory provisions, the Clauses in Sections I to III, the Additional provisions and Annexes I to IV. The Clauses are drawn up on the standard contractual clauses of Commission Implementing Decision (EU) 2021/915 of 4 June 2021 and take its official text, with the provisions that refer to Regulation (EU) 2016/679.

On matters of processing personal data, this Agreement prevails over the Terms of Service and the Privacy Policy.

The business can print this Agreement or save it as a PDF from this page at any time. We send earlier versions on request to info@operitivo.com.

The purpose of these Clauses is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

These Clauses apply to the processing of personal data as specified in Annex II.

Annexes I to IV are an integral part of the Clauses.

These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

These Clauses are not the standard contractual clauses of Implementing Decision (EU) 2021/915 but are drawn up on them: clause 5 is not taken over, and clause 7.7 has no point (e). The other clauses and points keep the numbers they have in that Decision.

The Additional provisions and the Annexes may not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

The processor shall assist the controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller's instructions.

In addition to the processor's obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, taking into account the nature of processing and the information available to the processor.

Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

The business is responsible for having a legal basis for processing the personal data it enters in Operitivo or that Operitivo receives for it, and for having informed the data subjects of the processing (Articles 6, 13 and 14 of the GDPR).

The business's documented instructions under clause 7.1 are the Terms of Service, this Agreement and the actions the business and its users take in Operitivo, such as entering a client, sending a quote by e-mail, issuing an invoice or connecting Minimax. The business gives other instructions in writing to info@operitivo.com.

The business decides which of its users have access to Operitivo and with which role, and is responsible for their actions in Operitivo.

The business does not enter sensitive data within the meaning of clause 7.5 in free-text fields (notes, descriptions, remarks), nor a diagnosis or other health data in the note on sick leave. The only health data Operitivo provides for is sick leave, recorded as a type of a worker's absence and as a worker's status (Annex II); the business processes it as an employer under employment law (Article 9(2)(b) of the GDPR).

Operitivo sends the notification under clause 9.2 no later than 48 hours after becoming aware of the breach, by e-mail to the account owner and the business's administrators. If not all the information is known yet, the first notification contains what is known, and we send the rest as soon as we learn it.

The business, as controller, notifies the supervisory authority and the data subjects of the breach (Articles 33 and 34 of the GDPR). Operitivo assists it under clause 9, and notifies them on its behalf only if the business authorises it in writing.

We send the notice under clause 7.7(a) by e-mail to the account owner and the business's administrators, show it in the app and add it to the change log in Annex IV, at least 30 days before the new sub-processor starts processing the business's data. The notice names the sub-processor, its task, where it processes the data and on what basis the data is transferred outside the European Economic Area, if it is.

The business objects in writing to info@operitivo.com before that period ends. On an objection, Operitivo does not use the new sub-processor for that business, for example by switching off the function that needs it. Where that is not possible, the business may terminate the contract without cost by the date of the change, and Operitivo refunds the unused part of the prepaid subscription. Until then that business's data does not reach the new sub-processor.

We provide the information under clause 7.6(c) first as documentation: the description of the measures in Annex III, the sub-processors' SOC 2 or ISO 27001 reports as far as they allow us to share them, and answers to the business's questionnaire.

If the documentation is not enough, the business may carry out a remote audit or one at the premises of Semicolon d.o.o., announced at least 30 days in advance, as a rule once a year. Where there are indications of a breach of this Agreement or a supervisory authority asks for the audit, neither the limit of one audit a year nor the 30 days apply, and the audit is announced with reasonable notice.

The audit is carried out by the business itself or by an auditor it chooses who has committed in writing to confidentiality. The audit does not cover other businesses' data.

The Agreement lasts while the business uses Operitivo and after that until Operitivo deletes or returns its data under this point.

While it uses the service and for 30 days after the service ends, the business can download its data from Operitivo (for example invoice and quote PDFs). On a written request sent within that period, Operitivo sends it an export of all its data in a machine-readable format (CSV or JSON), with its files. This is the return of data under clause 10(d).

No later than 60 days after the service ends, Operitivo deletes the business's data from the database and the file storage the service runs on and confirms this by e-mail to the account owner.

After that the business's data remains only in these copies, until they are gone:

Records at the sub-processors (e-mails sent, error reports, server logs) are deleted when their retention periods end.

On the business's written instruction given before the period in point 5.2 ends, Operitivo keeps, instead of deleting, a read-only archive of its invoices and other records the business must keep by law, until the statutory retention period of each record ends. Before that, Operitivo disconnects the business's Minimax and other connected services, so the archive no longer changes. This Agreement continues to apply to that archive for that time.

Without such an instruction Operitivo does not keep the business's data after the periods in this point. Keeping invoices and business records is the business's duty (Article 66(18) and Article 108 of the General Tax Act, Article 82 of the VAT Act, Articles 10 and 13 of the Accounting Act and Article 35 of the Fiscalization Act), so the business downloads them before deletion.

The list of sub-processors changes under clause 7.7 and point 3 of these Additional provisions.

Operitivo announces any other change to this Agreement by e-mail to the account owner and in the app at least 30 days before it takes effect, with a summary of the changes. A change applies to the business once the business accepts it. A business that does not accept the change may terminate the contract without cost by the date the change takes effect, and Operitivo refunds the unused part of the prepaid subscription.

This Agreement is governed by the law of the Republic of Croatia. The court named in the Terms of Service has jurisdiction over disputes. The Croatian text prevails; the English and German texts are translations.

Name, OIB and address: the business that has accepted this Agreement, as entered in Operitivo (Settings, business details).

Contact person: the owner of the business's account in Operitivo, at the e-mail address of their user account. The business's administrators also receive the notices under this Agreement.

Data protection officer: if the business has appointed one, it sends their details to info@operitivo.com.

Acceptance: the account owner accepts the Agreement in Operitivo, and Operitivo records the date and the version accepted.

Name: Semicolon d.o.o., OIB 03411437372

Address: Rakovčeva ulica 60, 52100 Pula, Croatia

Contact person: Bojan Dragojević, director, info@operitivo.com

Data protection officer: not appointed; Article 37 of the GDPR does not require one of Semicolon d.o.o.

Acceptance: Semicolon d.o.o. accepts the Agreement by publishing it on this page, and it applies with a given business from the day that business accepts it.

the business's clients and their contact persons

prospective clients and people who send the business an enquiry

recipients of the business's quotes, invoices and other documents

people who sign work orders and people who appear in photos taken on site

the business's workers and the users of its Operitivo account

suppliers' contact persons and people named in suppliers' documents (scanned supplier invoices and received eInvoices)

name, OIB or VAT identification number, address, e-mail and phone

IBAN, amounts, payment method and payment status

the content of quotes, jobs, work orders, invoices, enquiries, notes and attached documents

the business's vehicles (plate, VIN, mileage, registration and insurance) and the work orders they were used on

service locations (addresses, coordinates and access notes) and clients' properties and equipment

signatures on work orders, with the signer's name, e-mail, IP address and device, and photos taken on site

workers' data: user account, role, position, hourly rate, assigned jobs and time worked on work orders, schedule, annual leave and other absences

for users who issue invoices: the operator's OIB, which is sent with a fiscalized invoice, and, when Operitivo adds them to Minimax as cashiers, their gender

supplier and line data from scanned supplier invoices and received eInvoices

The service is not meant for processing sensitive data within the meaning of clause 7.5, with one exception: sick leave, recorded as a type of a worker's absence (with its dates) and as a worker's status, without a diagnosis, which is data concerning health. The business processes it as an employer under employment law (Article 9(2)(b) of the GDPR). Only users whose role may see workers see it, and the worker also sees their own absences; Operitivo uses it for nothing else. The business enters no diagnosis or other health data, not even in the note on sick leave (point 1.4 of the Additional provisions).

Signatures and photos are not biometric data, because they are not processed through specific technical means that allow the unique identification of a person (Article 4(14) and recital 51 of the GDPR).

The business does not enter other sensitive data (point 1.4 of the Additional provisions).

storing data and showing it in the web and mobile app

storing files (photos, attachments, scanned invoices, PDF documents)

generating PDF documents

sending e-mails and push notifications

fiscalizing invoices with the Tax Administration and sending eInvoices through the information intermediary the business chooses

reading the text of scanned supplier invoices and extracting lines from them and from lists of materials a worker dictates or types, with an artificial intelligence language model

error monitoring, user support and backups

transferring data to services the business connects itself, such as Minimax or Google Calendar, on its instruction

Providing the Operitivo service to the business under the Terms of Service: managing clients, enquiries, quotes, jobs, work orders, invoices, the warehouse, vehicles, equipment, workers and the calendar, issuing and fiscalizing invoices, sending and receiving eInvoices, and supporting the business's users.

While the business uses Operitivo, and after that until the data is deleted or returned under point 5 of the Additional provisions; for an archive the business requests under point 5.6, until the statutory retention periods end.

The subject matter, nature and duration of the processing by each sub-processor are set out in Annex IV. A sub-processor processes the data only for the task named there and only while the processing by Operitivo lasts, except for the records in point 5.5 of the Additional provisions.

The app is reached only over HTTPS (TLS). The app connects to the database, the file storage, the Tax Administration and the sub-processors over encrypted connections (TLS), and to the Tax Administration also with the business's certificate.

The database, the file storage and the backups are encrypted at rest at the providers (Annex IV).

The app additionally encrypts the fiscalization certificate and its password, the eInvoice intermediary's keys, the Minimax password and the access to Google Calendar (AES-256-GCM) with a key that is not kept in the database.

User passwords are stored only as a hash (bcrypt).

Database backups are encrypted (AES-256) before they are stored at a separate location.

Every record in the database belongs to one business, and on every request of a signed-in user the app reads and changes only the records of that user's business; the exception is the client's signing link, described in the next point.

The business's files (photos taken on site, signed work orders, attachments, scanned invoices) are in a private storage, in that business's folder. They open through the app after the sign-in and the permission are checked, through links the mobile app gets signed for 6 hours, or, for a work order sent to the client for signing, through the client's signing link, which opens the signed work order and that work order's photos without a sign-in. Only images the business puts in its quote layout (for example its logo) and users' profile pictures are public.

Sign-in with a password, after the e-mail address is confirmed, or with a Google account.

On the server the app limits every request of a signed-in user to the data of that user's business; the exception is the client's link for signing a work order. Within a business every user has a role (administrator, sales, accountant, worker) that limits access to most data: for the main parts of the app (invoices, received invoices, quotes, enquiries, clients, jobs, warehouse, workers, tasks, appointments, team and settings) the app also checks on the server whether that role may do it. Parts that do not have such a check yet (for example clients' equipment, properties and activities, and the list of workers on a work order, which shows their contact details and hourly rates) are open to every user of the business.

Changing or resetting a password ends that user's sessions on other devices.

Today only the director of Semicolon d.o.o. has access to the production database and the file storage; access to test versions of the app and their database copies is described in point 5.4 of the Additional provisions. Anyone else gets it only after a written commitment to confidentiality and only as far as their work requires.

We access the business's data only to provide the service, for support the business asks for or to fix an error.

App errors are sent to the error monitoring service without the user's IP address and cookies. Before sending, OIBs, the values of fields holding a tax or VAT number or gender, VAT numbers in requests to VIES and Minimax, and one-time codes and tokens written in a link as parameters are removed from the error record. A token written in the link's path itself (for example in a link to sign a work order or to accept an invitation) is not removed.

A session replay is recorded only for a share of errors (10 %), with text and images hidden; the page and request addresses in a replay do not go through that removal, so an OIB or VAT number can remain in them (for example when a VAT number is checked).

For an invoice Operitivo issues itself, the app records the user who issued it and the time of issue. For an invoice issued through Minimax, it records the operator (cashier) Minimax puts on the invoice, with their OIB, when Minimax returns one, the Operitivo user with that OIB if there is exactly one, and the issue day Minimax reports. A reversal made directly in Minimax and confirmed in Operitivo records no operator.

The database provider allows restoring the database to an earlier point in time within its recovery window.

Every day we make an encrypted backup of the database at a separate location (Cloudflare R2): we keep daily backups for 7 days, weekly ones for 4 weeks, and monthly and manual ones for 12 months.

We change the database structure so that the previous version of the app keeps working, and remove columns and tables only in a later, separate change.

Every code change passes automated tests and a review before it is released.

We review the measures in this Annex when the service or a sub-processor changes, and at least once a year.

Data subject requests: the business itself finds, corrects and deletes the data of clients, enquiries, workers and other records in the app and downloads their documents. What it cannot do itself, we do at its request without undue delay, so that it can reply within the period in Article 12(3) of the GDPR.

A data subject request that reaches us directly we forward to the business and do not answer ourselves (clause 8(a)).

Impact assessment and consulting the supervisory authority: at the business's request we provide the description of the processing, the measures and the sub-processors it needs for that.

Breach notification: besides the information in clause 9.2, it states when the breach happened and when we became aware of it, which functions and sub-processors it concerns and what the business can do itself, for example change passwords.

Breach procedure: we establish its scope, stop the breach and keep the records, notify the businesses concerned within the period in point 2.1 of the Additional provisions, and record every breach with its facts, effects and the measures taken.