Data Processing Agreement

Version: 1.0, effective 24 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller") and Dmitrii Sinichkin, an individual based in Tashkent, Uzbekistan ("Processor") for the Reconcio cloud service. It applies to personal data contained in files the Controller uploads for reconciliation. It does not apply to self-hosted installations, where the Processor has no access to the Controller's data.

1. Subject matter and duration

The Processor processes personal data only to perform reconciliations requested by the Controller, for the duration of the subscription.

2. Nature of processing

• Categories of data: data contained in the uploaded files, typically payment identifiers, amounts, dates, and possibly names, emails or partial card numbers of the Controller's customers.
• Data subjects: the Controller's customers, payees and employees.
• Operations: storage, comparison, generation of reports and differences files, deletion.

Out of scope of this DPA: analytics of visits to the Processor's website (Umami, hosted by the Processor, without cookies and without personal data) and anonymous telemetry of self-hosted installations. Neither involves personal data contained in the Controller's files. The Processor may compute aggregated, anonymised statistics of service usage (for example, number of reconciliations or file sizes) that do not include the content of the files.

3. Processor obligations

• Process data only on documented instructions of the Controller, given through the use of the service.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures in Annex 1.
• Assist the Controller with data subject requests and with data protection impact assessments, as far as reasonably possible.
• Notify the Controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
• Delete uploaded files after the retention period of the plan, and all remaining data within 30 days after the end of the subscription, unless law requires otherwise.
• Make available information necessary to demonstrate compliance and allow audits, with reasonable notice, no more than once a year unless a breach occurred.

4. Sub-processors

The Controller authorises the following sub-processors: the Processor's hosting provider (data centres in Finland and the Netherlands, EU), Unisender Go (delivery of service emails) and an EU object storage provider for uploaded files, generated differences files and encrypted backups. The Processor will inform the Controller of intended changes at least 30 days in advance; the Controller may object on reasonable grounds.

5. International transfers

Data is stored in the European Union (Finland and the Netherlands). Transfers outside the EEA, if any, are made under the European Commission's Standard Contractual Clauses.

Annex 1. Technical and organisational measures

• Encryption in transit (TLS) for all connections.
• Backups encrypted at rest.
• Passwords stored as salted hashes; optional two-factor authentication.
• Role-based access within the customer workspace; an audit log of user actions.
• Automatic deletion of uploaded and generated files after the retention period.
• Backups: continuous archiving of database changes with weekly full and nightly differential backups, stored encrypted in EU object storage and kept for four weeks.
• Access to production systems limited to one named administrator with two-factor authentication.

Questions: support@reconcio.pro.