Data Processing Agreement

Version: 1.0 · Published: 2 October 2026

Controller: the Customer that subscribes to the Service (“Controller”)
Processor: Tiquento (“Processor”)

1. Scope and interpretation

This Data Processing Agreement (“DPA”) forms part of the agreement under which Processor provides the Tiquento expense-management service (“Agreement”). It applies where Processor processes Personal Data on behalf of Controller. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings in Regulation (EU) 2016/679 (“GDPR”).

2. Controller instructions

Processor shall process Personal Data only on documented instructions from Controller, including transfers to a third country or international organisation, unless EU or Member-State law requires otherwise; Processor will inform Controller of that requirement unless prohibited by law. The Agreement, use of the Service, configured permissions and written support requests are Controller’s documented instructions. Processor will promptly notify Controller if an instruction appears to infringe applicable data-protection law.

3. Confidentiality and security

Processor shall ensure that persons authorised to process Personal Data are bound by confidentiality obligations. Processor shall implement appropriate technical and organisational measures under Article 32 GDPR, taking account of the state of the art, costs, nature, scope, context and purposes of processing and the risks to individuals. The current measures are described in Annex 2.

4. Subprocessors

Controller grants Processor general written authorisation to engage the subprocessors listed in Annex 3. Processor shall give Controller at least 30 days’ prior notice of an intended addition or replacement, allowing Controller to object on reasonable data-protection grounds. Processor shall impose written obligations on each subprocessor that are no less protective than the applicable obligations in this DPA and remains liable for its subprocessors’ performance to the extent required by law.

5. Assistance

Taking account of the nature of Processing, Processor shall provide reasonable assistance through appropriate technical and organisational measures for Controller to respond to Data Subject requests. Taking account of the nature of Processing and information available, Processor shall reasonably assist Controller with Articles 32–36 GDPR, including security, breach notification, DPIAs and prior consultation. Processor may charge reasonable fees for assistance beyond the Service’s standard functionality where permitted by the Agreement.

6. Personal Data Breaches

Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data, and provide available information reasonably needed for Controller’s legal obligations. Processor shall not notify Data Subjects or a Supervisory Authority about Controller Personal Data unless instructed or required by law.

7. Audits and information

Processor shall make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by Controller or an independent auditor mandated by Controller, subject to reasonable notice, confidentiality, business-continuity, security and frequency restrictions. Audit requests must be made in writing with at least 30 days’ notice. Processor will first respond with written information and documentation; an on-site or remote inspection may follow where that information is reasonably insufficient. Audits are limited to once per year unless required by a Supervisory Authority or following a Personal Data Breach. Each party bears its own audit costs.

8. International transfers

Processor shall not transfer Controller Personal Data outside the EEA except on Controller instructions or using a valid transfer mechanism under Chapter V GDPR. Service data is hosted in Google Cloud EU regions. Transfers to the United States may occur through the subprocessors listed in Annex 3 and rely on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses incorporated in those subprocessors’ data processing terms.

9. Return and deletion

At Controller’s choice on termination, Processor shall delete or return Personal Data, unless EU or Member-State law requires storage. Return is provided as an export of expense records (CSV) and receipt files. Personal Data is deleted within 90 days after termination of the Agreement, except billing records that must be kept for up to six years under Spanish commercial and tax law.

10. Priority and term

This DPA continues for as long as Processor processes Personal Data for Controller. In the event of conflict, this DPA prevails over the Agreement concerning data-protection obligations. Changes required by applicable law may be made by written amendment.

Acceptance

This DPA is accepted by Controller when it accepts the Agreement or subscribes to the Service. Controller may request a countersigned copy by emailing admin@tiquento.com.

Annex 1 — Processing details

Item	Description
Subject matter	Provision, hosting, security, support and maintenance of the Tiquento expense-management web and mobile Service.
Duration	For the Agreement term and any agreed return/deletion period.
Nature and purpose	Receive, store, organise, retrieve, transmit and otherwise process expense records and receipts; account administration; approvals; reports/exports; notifications; security; and support. Optional receipt extraction may use EU Document AI to generate suggested expense fields.
Categories of Data Subjects	Controller’s employees, contractors, administrators, approvers, finance personnel and, where personal data appears on a receipt, merchants, suppliers or other individuals identified in it.
Categories of Personal Data	Name, work email, user ID, role and organisation; authentication/session data; receipt image/file and contents; expense, merchant, amount, currency, category, description, status and timestamps; approval decisions/comments; notification and report/export data; technical/security logs. Controller should not submit special-category data unless specifically agreed in writing with appropriate safeguards.
Controller’s rights and obligations	Determine lawful purposes and means; ensure transparent notice and legal basis; manage user access and instructions; respond to Data Subject requests; ensure data accuracy and retention; assess whether a DPIA is required.

Annex 2 — Technical and organisational measures

Role-based account access and organisation-level scoping.
Authenticated service-to-service communication and encrypted transport.
Private cloud storage for receipt files; access is authorised by the Service and viewing uses time-limited signed links.
Receipt type/size validation; permitted formats include PDF, PNG, JPEG and HEIC, with a 10 MB limit.
Managed cloud infrastructure in Google Cloud EU regions (Belgium and Spain); access logging and operational monitoring.
Secret-managed credentials and least-privilege access controls.
Security fixes are applied as they are identified; suspected incidents are investigated and Controller is notified in line with section 6; deleted data is removed from the production database and storage.

Annex 3 — Approved subprocessors

Subprocessor	Service/purpose	Location/transfer safeguard
Google Cloud	Application hosting, database, private receipt storage, operational services; optional Document AI OCR.	EU regions (Belgium and Spain); Google Cloud data processing terms.
Stripe	Subscription payments and billing.	EU, with possible US transfers under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses.
Postmark	Transactional email (verification, password reset, notifications).	United States; EU–US Data Privacy Framework and/or EU Standard Contractual Clauses.