Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Terms of Service and applies whenever we process personal data on your behalf. It is the written contract required by Article 28 of the EU General Data Protection Regulation (GDPR), Article 31 of the Andorran Llei 29/2021 and Article 33 of the Spanish LOPDGDD. Accepting the Terms accepts this DPA. Where it conflicts with the Terms on data protection, this DPA prevails.

1. Parties and roles

You (the accountancy firm or the business holding the account) are the controller of the personal data you and your users put into the Service ("Customer Data"). We — KAOS S.L.U, Avinguda Francesc Cairat 22, 1r 1a, AD600 Sant Julià de Lòria, Principality of Andorra — are your processor. When an accountancy firm uses the Service for a business it advises, the firm acts for that business under its own engagement and we are the firm's sub-processor; the business's consent to that connection records what the firm may see. We are a controller only of account, billing and security data about your users (see the Privacy Policy).

2. Subject-matter, duration, nature and purpose

Subject-matter: hosting and processing Customer Data to provide the Service — bookkeeping, invoicing, tax returns, payroll, document storage and AI-assisted extraction, KYC/AML files, bank reconciliation, messaging and the client portal. Duration: the term of your subscription plus the return and deletion period of section 10. Nature: storage, organisation, retrieval, computation, extraction, transmission on your instruction, and deletion. Purpose: solely to provide the Service to you. Annex I lists the types of personal data and the categories of data subjects.

3. Your documented instructions (Art. 28(3)(a))

We process Customer Data only on your documented instructions — the Terms, this DPA, and the actions you and your users take in the Service — including with regard to transfers to a third country (section 11), unless a law to which we are subject requires otherwise, in which case we tell you first unless that law forbids it. We will immediately inform you if, in our opinion, an instruction infringes data-protection law. We do not use Customer Data for our own purposes and do not sell it.

4. Confidentiality (Art. 28(3)(b))

Everyone we authorise to process Customer Data is bound by a duty of confidentiality, contractual or statutory. Access by our staff is limited to what support, security and legal duties require, and is logged.

5. Security (Art. 28(3)(c), Art. 32)

• Encryption in transit (TLS) on every connection; encryption at rest by our hosting, database and file-storage providers; application-level encryption (AES-256-GCM) of stored credentials and bank tokens.
• Tenant isolation enforced on the server for every request; role- and permission-based access; field-level masking of salary, identity and bank data.
• Private file storage: files are served only through authorised, logged download routes.
• Audit logging of access to and changes of sensitive records; rate limiting; two-factor authentication available to every user.
• Backups by the database provider; an incident register with a 72-hour notification clock.

6. AI-assisted processing

Documents you upload — invoices, payslips and identity documents included — are read in full by our AI provider (Anthropic, United States) to extract and classify their data, under its commercial terms, which forbid training models on that content, and its data processing addendum. The output is a proposal for your review: the Service takes no decision producing legal effects about a person on the basis of automated processing alone (GDPR Art. 22).

7. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

You give us a general written authorisation to engage the sub-processors listed on the sub-processor page. We will inform your administrators by email at least 30 days before adding or replacing one; you may object on reasonable data-protection grounds within that period, and if we cannot address the objection you may terminate the affected Service without penalty. We impose on each sub-processor, by contract, data-protection obligations no less protective than this DPA, and remain fully liable to you for its performance.

8. Helping you answer data subjects (Art. 28(3)(e))

Taking into account the nature of the processing, we help you respond to requests to exercise the rights of access, rectification, erasure, restriction, portability and objection. The Service lets a business's administrator export its data and file an erasure request; for a request about one person (an employee, a contact) that the Service cannot yet answer on its own, write to privacy@bluri.ai and we provide the data within 10 working days. If a data subject writes to us about Customer Data, we pass the request on to you and do not answer it ourselves.

9. Security incidents and other assistance (Art. 28(3)(f), Arts. 32–36)

We notify you without undue delay, and where feasible within 48 hours, after we become aware of a personal data breach affecting Customer Data, by email to your administrators, with what we know of its nature, the categories and approximate number of people and records concerned, its likely consequences and the measures taken or proposed — completed in phases as we learn more. You remain responsible for notifying your supervisory authority and the people affected; we help you do so. We also give you the information you reasonably need for a data protection impact assessment or a prior consultation.

10. Return and deletion at the end (Art. 28(3)(g))

At the end of the Service you may export your data for 30 days, through the export in the Service or on request. Afterwards we delete Customer Data, except data that a law to which you or we are subject requires to be kept (for example accounting books and records, six years under Article 30 of the Spanish Código de Comercio; AML files under the applicable AML law). Such data is returned to you on request and, until its period ends, kept blocked: not available to your users, used for nothing else, and made available only to you, courts and competent authorities (LOPDGDD Arts. 32 and 33.4). It is then deleted.

11. Transfers outside the EEA and Andorra

Customer Data is processed in the United States by the sub-processors so marked on the sub-processor page, each under the EU–US Data Privacy Framework (when the provider is certified for that data) or the European Commission's standard contractual clauses (Decision (EU) 2021/914), which Andorran law also accepts (Llei 29/2021 Art. 44.3(c)). A copy of each safeguard is available from privacy@bluri.ai.

12. Demonstrating compliance and audits (Art. 28(3)(h))

We make available to you the information necessary to demonstrate compliance with Article 28 — our record of processing, security measures, sub-processor contracts (commercially sensitive terms removed) and incident records — and allow for and contribute to audits, including inspections, by you or an auditor you mandate who is bound by confidentiality: once a year on 30 days' notice, or at any time after a breach or at a supervisory authority's request.

Annex I — Data subjects and personal data

• Your users — identity, contact, role, sign-in and audit data.
• Your clients, customers and suppliers — names, tax identifiers, addresses, contact details, invoices, payments, bank details.
• Employees of the businesses (payroll) — identity, tax and social-security numbers, contract, salary, bank account, working time, leave; special categories: sick-leave episodes (dates and contingency, no diagnosis) and disability status where tax or social-security law requires it.
• Owners, directors, representatives and beneficial owners (KYC/AML) — identity documents, nationality, ownership, politically-exposed-person status, screening results.
• People named in documents you upload — whatever those documents contain.