Data processing agreement (Article 28 GDPR)

1. Parties, roles and subject matter

• Processor: AceFisc, publisher of the AceFisc platform (identification details are given in the legal notice). Contact: cedric@acefisc.lu.
• Controller: the Firm, i.e. the organisation for which the AceFisc space was created, represented by the administrator who accepts this agreement (their name, the date and the accepted version are recorded).

For the data the Firm records in AceFisc (its clients, their directors and beneficial owners, its contacts, its staff, the people whose data it enters), the Firm is the controller and AceFisc its processor. For account management, billing of the subscription, platform security and the commercial relationship, AceFisc acts on its own behalf (see the privacy policy): this processing is outside this agreement.

Subject matter: AceFisc provides the Firm with the AceFisc platform (CRM, KYC and AML due diligence, engagements, time, invoicing, documents, BOB50 synchronisation, Ace AI assistant…) and in doing so processes personal data on behalf of the Firm.

2. Duration

This agreement applies for as long as AceFisc processes data on behalf of the Firm: during the subscription, then until the data is deleted (section 11).

3. Description of the processing

The nature, purpose, categories of data and of data subjects and the duration of each processing operation are described in Annex 1. The Firm determines the data it enters. AceFisc does not aim to process special categories of data (Article 9 GDPR); data relating to offences or sanctions may however appear as part of the AML due diligence the Firm must carry out.

4. Instructions

AceFisc processes the data only on documented instructions from the Firm, including with regard to transfers outside the Union: this agreement, the terms of use, the use of the platform by the Firm’s users and the settings the Firm chooses are its instructions. If Union or Member State law requires different processing, AceFisc informs the Firm before processing, unless the law prohibits it.

AceFisc informs the Firm immediately if it considers an instruction to infringe the GDPR.

5. Confidentiality and professional secrecy

The people AceFisc authorises to process the Firm’s data are bound by confidentiality. Their access is limited to what is needed to run the service, to provide the assistance the Firm requests and for security.

The Firm informs AceFisc that some data is covered by the professional secrecy the Firm is bound by. AceFisc treats it with the same level of confidentiality and imposes this obligation on its sub-processors.

6. Security

AceFisc implements the technical and organisational measures described in Annex 2 (Article 32 GDPR) and maintains them at an at least equivalent level throughout the agreement. No change may reduce the overall level of protection.

7. Sub-processors

The Firm gives AceFisc a general authorisation to use the sub-processors listed in Annex 3. AceFisc informs the Firm of any addition or replacement at least 30 days before it takes effect, by a message to the Firm’s administrators and an update of Annex 3, with the same information (identity, purpose, location, safeguards).

The Firm may object, on reasonable data protection grounds, during that period. The parties then seek a solution in good faith; failing that, the Firm may terminate the service concerned.

AceFisc imposes on each sub-processor, by contract, the same data protection obligations as those of this agreement, and remains fully liable to the Firm for their performance.

8. Transfers outside the European Economic Area

AceFisc hosts and processes the data in the European Union. The only transfers outside the European Economic Area, or accesses from outside it, are those in Annex 3; each is covered by appropriate safeguards (Article 46 GDPR): the European Commission’s standard contractual clauses (Decision 2021/914) or the EU–US Data Privacy Framework. The Firm authorises these transfers. On request, AceFisc provides the Firm with the information it needs to assess these transfers.

9. Assistance to the Firm

AceFisc assists the Firm, taking into account the nature of the processing:

• to respond to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection): AceFisc forwards to the Firm any request it receives directly; the Firm has the platform’s export and anonymisation tools (Settings › GDPR compliance) and, for the rest, AceFisc’s help on request;
• to ensure the security of processing, notify data breaches and carry out impact assessments and prior consultations (Articles 32 to 36 GDPR): AceFisc provides the necessary information about its processing, sub-processors and measures, in particular for the impact assessment relating to the AI features.

10. Personal data breaches

AceFisc notifies the Firm, without undue delay after becoming aware of it, of any personal data breach affecting the Firm’s data, at the data protection contact address entered in the Firm’s space, or failing that to its administrators. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and data concerned, the likely consequences and the measures taken or proposed. AceFisc supplements the information as it becomes available and helps the Firm meet its notification obligations.

The Firm remains responsible for notifying the supervisory authority (CNPD in Luxembourg, the Data Protection Authority in Belgium) and the data subjects.

11. End of the agreement

At the end of the subscription, the Firm may export its data. AceFisc then deletes or anonymises the Firm’s data within a maximum of 90 days, unless the law requires some data to be kept, and confirms this on request. Backup copies are deleted according to the database host’s retention cycle. Data kept under a legal obligation is kept under the Firm’s sole responsibility.

12. Evidence of compliance and audit

AceFisc makes available to the Firm the information necessary to demonstrate compliance with this agreement. The Firm, or an auditor it mandates who is bound by confidentiality, may carry out an audit, with reasonable notice, no more than once a year unless a breach is established, at its own cost, without access to other firms’ data. AceFisc may first meet the request with documentary evidence (descriptions of the measures, reports and attestations from its sub-processors).

13. Obligations of the Firm

The Firm, as controller, undertakes to:

• have a legal basis for each processing operation it entrusts to AceFisc and inform data subjects (its clients, their directors and beneficial owners, its staff), including of the use of AceFisc, its sub-processors and artificial intelligence;
• give only lawful instructions and enter only the data that is necessary;
• respect professional secrecy and, where it applies, obtain from its clients the agreements the law requires before using a provider such as AceFisc;
• for the AI features (Ace AI): decide whether to enable them, carry out the impact assessment where required, inform its staff before any use of the logs for monitoring purposes, transcribe a meeting only after informing the participants and obtaining their agreement, and not use AI to evaluate people (creditworthiness, recruitment, performance) or to analyse emotions;
• enter a data protection contact in AceFisc and keep it up to date.

14. Liability and governing law

Each party’s liability is governed by AceFisc’s terms of use, without prejudice to data subjects’ rights (Article 82 GDPR).

This agreement is governed by Luxembourg law, without prejudice to mandatory provisions applicable to firms established in Belgium. The parties may not derogate from it by terms less protective of personal data. A new version is presented to the Firm’s administrator, who must accept it; the old one remains recorded as evidence.

Questions: cedric@acefisc.lu.

Annex 1 — Details of the processing

Annex 2 — Security measures

• Hosting in the European Union, in Germany (database: Frankfurt; application servers: Nuremberg and Falkenstein).
• Isolation between firms: each firm only accesses its own data, through access rules enforced at database level (per organisation), roles and permissions; these controls are covered by automated tests.
• Authentication: password of at least 12 characters (common passwords and passwords built from the user’s identity are refused), two-factor authentication (one-time code) mandatory for users, session expiry after inactivity (4 h for administrators, 8 h for other roles).
• Encryption: communications encrypted in transit (HTTPS); the most sensitive data (IBANs, accounting login credentials) encrypted at application level (AES-256-GCM).
• Traceability: audit log of sensitive actions and activity log; access to personal data is logged.
• Request rate limiting and validation of incoming data.
• Backups: daily backups of the database by the host; documented disaster recovery plan.
• Erasure: anonymisation (not physical deletion) of clients and users, respecting legal retention periods.
• AI: processing by Amazon Web Services within the European Union only; content not used to train models; audio never recorded; no write or send without a staff member’s confirmation; AI data not kept more than 365 days; access subject to enablement by the Firm and acceptance of a notice by each staff member.
• Incident management: internal procedure for classification, containment and lessons learned.

Annex 3 — Sub-processors

Outside this agreement: Stripe processes the Firm’s subscription billing data (AceFisc acts on its own behalf); none of the Firm’s clients’ data is passed to it.