Data Processing Agreement

1. Subject matter

Neithra Technologies – Fabian Lorenz (the processor) processes personal data on behalf of the customer (the controller) to the extent required to provide the TrueDue service as described in the underlying service agreement.

The processor provides software only. It does not collect receivables, does not receive or forward payments and provides no financial, payment, collection-agency or legal services on the controller's behalf; the controller collects exclusively its own receivables (Terms of Service, section 2).

2. Duration of the processing

The processing runs for the term of the service agreement. Return and deletion after it ends are dealt with in section 10.

3. Nature and purpose of the processing, types of data, categories of data subjects

The processing comprises importing and reconciling the customer's receivables data, sending payment reminders from the connected collections mailbox, reading and classifying incoming replies, and surfacing exceptions to the customer's finance team. Reading incoming replies includes the text of PDF attachments: the software reads it (at most 3 PDF files per message, the first 10 pages of each), evaluates it by fixed rules only — for example to recognise a remittance advice for an open invoice — and stores a shortened extract of at most 6,000 characters per file together with the message. The file itself is not stored, and the extract is not transmitted to an AI model.

The categories of data subjects are the contact persons at the customer's business debtors, private persons who are debtors of the customer, and the customer's own users of the platform. The types of personal data are names and contact details, the customer type stated by the customer (company or private person) and the country, invoice metadata and amounts, and email correspondence including the details of its attachments (file name, file type, file size) and the shortened text extract from PDF attachments. Replies from private persons may of their own accord contain information about special personal circumstances, such as health or financial situation. Such information is not collected deliberately. The software recognises such hints by fixed rules solely in order to stop the automated process for that person and to present the message to the controller; no automatic reply is sent to it. Replies from private persons, and from debtors whose customer type has not been confirmed yet, are not sent to an AI model.

4. Instructions

The service agreement, this DPA and settings selected by an authorised administrator constitute documented instructions. Further instructions, including return, correction or deletion, may be given in text form to the contact in the imprint. We document receipt and handling and verify authority where necessary. Processing outside instructions occurs only where Union or Member State law requires it; we notify the controller beforehand unless legally prohibited. If an instruction appears to infringe data protection law, we notify the controller promptly and suspend the affected processing pending lawful clarification (Art. 28(3)(a) and (h) GDPR).

5. Confidentiality

The persons authorised to process the personal data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

6. Technical and organisational measures

The technical and organisational measures under Art. 32 GDPR are set out in an annex to this agreement: Annex: technical and organisational measures (Art. 32 GDPR)

• Access control — people sign in with the controller's own Microsoft Entra ID accounts or with a one-time link sent to their business email address, valid for 15 minutes and stored only as a hash; there is no separate password. Membership and role are read from the database on every request, so a revoked membership or a changed role takes effect immediately, and signing out invalidates every session issued to that person.
• Separation of controllers — every query is filtered by the organization resolved from the verified session, never from anything the browser supplies. Automated tests check tenant separation in views, search and background workflows.
• Transport security — HTTPS only, HTTP Strict Transport Security with preload, a Content-Security-Policy that permits, apart from the site's own origin, only our own measurement server statistik.neithra.dev and – on the order page only – Stripe’s payment form, and framing denied outright.
• Confidentiality of outbound mail — messages are sent and replies read only as the controller's own selected collections mailboxes, over the connections the controller chooses and can revoke at any time. Available today is IMAP/SMTP; the direct connections for Microsoft 365 and Google Workspace are set up on request. In detail: Microsoft 365, using the Microsoft Graph permissions Mail.Send and Mail.ReadWrite, which the controller's administrator can restrict to the selected mailboxes with an Exchange application access policy; Google Workspace, using domain-wide delegation limited to the two scopes gmail.send and gmail.modify, where Google offers no per-mailbox restriction and the software selects the corresponding stored Google mailbox for each operation; multiple addresses may be stored depending on the plan, while the provider authorization remains domain-wide; or IMAP/SMTP, over TLS-only connections, with the mailbox password (preferably an app password) encrypted by the software with AES-256-GCM, never displayed again after saving, and with server addresses in private or internal networks refused.
• Integrity of figures — amounts, due dates and payment status are written only by import reconciliation or an explicit human correction. The language model can neither write a figure into a message nor alter a record; message figures are rendered from stored data.
• Logging — an append-only audit record per organization for every meaningful action: sign-in, approval, send, import, correction, escalation.
• Data minimisation — third-party AI processing can be switched off per organization by its administrator, after which replies are classified by built-in rules and nothing about them leaves the deployment. Replies from private persons and from debtors of unconfirmed customer type are never sent to an AI model, whatever this setting says.
• Return and erasure — administrators can export structured business data. Self-service erasure is available for organisations without billing history after fresh authentication. For billed accounts, return, termination and erasure are coordinated through a request with verified authority; mandatory billing evidence is retained separately.
• Abuse control — rate limits on authentication, the contact form and checkout.
• Protected credentials — IMAP/SMTP mailbox passwords are stored encrypted using AES-256-GCM. Server-side role and organisation checks restrict access to application data, and TLS protects data in transit.

We review the described safeguards when changing the service and provide the controller with the evidence needed for its assessment on request. Technical improvements must not reduce the agreed level of protection.

7. Subprocessors

The providers named on the Subprocessors page are generally authorised for the tasks described there. Before processing, they are contractually bound to at least the data protection duties in this agreement; we remain responsible to the controller for performance of their obligations. Intended additions or replacements are notified in text form at least 30 days before use, identifying the provider, task and processing location. The controller may object within that period on substantiated data protection grounds. We assess the objection and seek a suitable alternative; the disputed processing for that controller does not begin pending resolution. If compliant continuation is not possible, the affected service may be terminated without an additional termination charge when the change takes effect. Prepaid fees for services no longer provided after that date are refunded proportionately.

8. Transfers to third countries

The primary application database is operated in Germany. Transfers by network, email or AI providers outside the EU/EEA take place only in accordance with Chapter V GDPR. Before transfer, the applicable basis is documented: an adequacy decision covering the recipient and the particular processing, or effective standard contractual clauses with the necessary assessment and supplementary safeguards. The provider list describes the tasks and third-country involvement. Evidence and copies of the relevant safeguards are available to the controller on request. If the required protection cannot be ensured, the affected transfer is suspended.

9. Assistance to the controller

Taking account of the nature of processing and available information, we assist the controller with data subject rights and obligations under Art. 32 to 36 GDPR. Requests concerning entrusted data that reach us directly are forwarded promptly; substantive responses follow the controller’s instructions. A personal data breach affecting entrusted data is reported to the recorded contact without undue delay and at the latest within 48 hours after awareness. The report includes available details of its nature and scope, affected data and people, likely consequences, contact and measures taken or proposed; missing details follow without unreasonable delay. Statutory deadlines and the controller’s responsibility for required notifications to authorities or individuals remain unaffected.

10. Return and deletion

After the service ends, the processor returns or deletes personal data processed on behalf of the controller, including existing copies, at the controller’s choice, generally within 30 days. The choice may be notified or changed in text form through the contact in the imprint until service completion. Structured data is available through the export function; other entrusted content is provided on an authorised request. An erasure request is not treated as a waiver of statutory rights. Where Union or national law requires further storage, only necessary data is retained, restricted to that purpose, and the controller is informed of the scope and reason. Protected backups are overwritten under their documented cycle, are not reused for ordinary operations, and are cleaned again after restoration. Completed deletion is confirmed on request.

11. Evidence and audits

The processor provides the information necessary to demonstrate compliance with Art. 28 GDPR and allows and contributes to audits, including inspections, by the controller or an independent auditor bound to confidentiality. Routine assessments are arranged on reasonable notice, using appropriate evidence where possible and avoiding unnecessary disruption; necessary on-site inspections remain possible. Specific security incidents, substantiated concerns or regulatory requirements are not subject to restrictions that would prevent timely review. Other customers’ data and sensitive security information are protected. Reasonable reimbursement for additional routine audits is agreed in advance and must not frustrate statutory audit rights; evidence and remediation of our own breaches are not conditional on advance payment.

12. Rights and obligations of the controller

The controller is responsible for the lawfulness of the processing and of the instructions it issues, and in particular for the legal basis on which the contact persons and the private persons whose data it imports are approached, and for informing those persons about the processing (Art. 13 and 14 GDPR).