Adapted translation from Spanish. In case of discrepancy the Spanish text prevails.
Español · OriginalThis agreement forms part of the Finomo Terms of Service (hereinafter "the Contract") and governs the processing of personal data that the Provider carries out on behalf of the Client. Client (controller): the natural or legal person identified in the subscription. Provider: Evgenii Ustinov, NIF Z2074293C, Juan Caturla Gosalvez 2, 03005 Alicante; gdpr@finomo.es. The Provider acts as processor in respect of third-party data from the Client's business activity and the preparation and transmission of the Client's returns (clause 3.1), and as controller in respect of the Client's account, subscription, billing, payment and security data and the check of the grantor's identity (clause 3.2). Applicable law: Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and any legislation implementing or replacing them. The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in Article 4 GDPR.
1.1 The Client entrusts the Provider with the processing of the personal data necessary to provide the Finomo service described in the Contract, on the terms of this agreement and its Annex I.
1.2 This agreement prevails over any other provision of the Contract concerning data protection.
2.1 The engagement has the same duration as the Contract and extends to the post-closure view-and-download period provided for in the Contract, during which the Provider only retains, displays and exports the data on the Client's instruction.
2.2 At the end of that period, clause 12 applies.
3.1 The Provider acts as processor for the personal data of third parties (buyers, suppliers, employees, collaborators or others) that the Client provides or generates on the platform in the course of their business, and for the automatic preparation of the returns relating to that business and, after the Client's approval of each one, their transmission to the AEAT or the delivery of the file for the Client to file, in accordance with their instructions. This agreement applies to that processing.
3.2 The Provider acts as controller for: (a) the Client's identification, subscription, invoicing, payment and security data; (b) the copy of the identity document (DNI, NIE or TIE) uploaded by the Client and the result of the check that the account holder is the grantor, which are kept for the duration of the Contract and five years after it ends and used solely for that purpose (clause 6.1 of the Contract). The Privacy Policy, not this agreement, applies to that processing.
3.3 The Client's approval of a return and the power of attorney granted before the AEAT do not modify this allocation of roles.
4.1 The processing comprises collection, recording, structuring, storage, consultation, calculation, retrieval, disclosure to the Spanish Tax Agency (AEAT) on the Client's behalf, export, blocking and erasure of the data.
4.2 The purposes are exclusively those necessary to: issue and keep invoices; record income and expenses; check in the VIES system the VAT numbers of intra-Community counterparties; automatically prepare, under the rules coded into the software, the drafts of tax returns and their corrections; where applicable, verify, before making a draft available to the Client, that the calculation follows the coded rules and the uploaded documents, as the software quality control provided in clause 2.4 of the Contract and without modifying the Client's data; after the Client's approval of each return, transmit to the AEAT exactly the approved version, where a registered and sufficient power of attorney exists, or provide the Client with the file for filing; send invoicing records when the Client activates the corresponding mode; keep and export the documentation.
4.3 The types of data, categories of data subjects and operations are described in Annex I.
5.1 Instructions. To process the data only on the Client's documented instructions. The following are considered documented instructions: the Contract, this agreement, the configuration the Client performs on the platform, the provision of documents, the export request and the approval of each return under Annex IV. If the Provider considers that an instruction infringes data protection law, it will immediately inform the Client and may suspend its execution until lawful instructions are received. Mere confirmation does not legitimise an instruction contrary to the law.
5.2 Record of activities. To maintain in writing the record of categories of processing activities carried out on the Client's behalf under Article 30(2) GDPR.
5.3 Confidentiality. To ensure that the persons authorised to process the data (currently, only the Provider personally; there are no staff and no designated substitute) are bound by a duty of confidentiality, including after their relationship with the Provider ends. Any future addition of staff will require a written confidentiality undertaking and prior training.
5.4 Security. To apply the technical and organisational measures of Annex II, review them at least once a year and adapt them when risks change, without reducing the level of protection during the term of the Contract.
5.5 Sub-processors. To use only the sub-processors authorised under clause 6.
5.6 Data subject rights. To assist the Client, through the platform's features and, where necessary, by direct action, in handling requests for access, rectification, erasure, restriction, portability and objection. If a data subject contacts the Provider directly, the Provider will inform them that they must contact the Client and will forward the request to the Client within a maximum of two working days.
5.7 Security breaches. To notify the Client of any security breach affecting the data covered by the engagement without undue delay after becoming aware of it, without waiting to gather all the information and completing it in phases, with the information and procedure of Annex III, and to cooperate in the notifications the Client must make to the Spanish Data Protection Agency and to data subjects.
5.8 Impact assessments and prior consultation. To make available to the Client the information on the processing and security measures needed to carry out, where applicable, impact assessments and prior consultations with the supervisory authority.
5.9 Compliance and audit. To provide the Client with the information necessary to demonstrate compliance with the obligations of Article 28 GDPR and to allow and contribute to audits and inspections conducted by the Client or an auditor mandated by them, subject to reasonable coordination of date, scope and confidentiality, protecting the data of other clients and the Provider's trade secrets. No frequency limits are imposed that would prevent a necessary verification.
5.10 Location and access. To document recipients, roles, countries and operations in accordance with Annex I. The Provider accesses the data covered by the engagement only through a VPN connection, including while travelling and outside the European Economic Area, with no separate regime for travel; access by the operator personally does not constitute a transfer to a third party. Any access by a third party from outside the EEA is examined under the criteria of Chapter V GDPR and the corresponding safeguards.
5.11 Own purposes. Not to use the data covered by the engagement for its own purposes, nor to train artificial intelligence systems, nor to disclose it to third parties except under a legal obligation, in which case it will inform the Client before the disclosure where the law allows.
6.1 The Client gives the Provider general authorisation to use the sub-processors identified in Annex I for the functions described there.
6.2 The Provider notifies the Client, by e-mail and on the platform, of any addition or replacement of sub-processors no less than fifteen days before it takes effect. The Client may object in writing to gdpr@finomo.es before that date, stating reasonable grounds relating to data protection. The Provider examines the objection and, if it cannot offer an alternative that addresses it, the Client may terminate the engagement and the Contract without penalty and obtain the return of their data under clause 12. If the supplier does not give the Provider sufficient notice, the Provider informs the Client as soon as it becomes aware of the change.
6.3 The Provider imposes on each sub-processor, by contract, obligations equivalent to those of this agreement, in particular sufficient guarantees of technical and organisational measures, and remains liable to the Client for the compliance of its sub-processors. A genuine sub-processor is distinguished from a recipient acting as an independent controller, such as the AEAT or the payment service provider in respect of the Provider's own charges.
6.4 No staff or professional substitute is involved in the processing. Any future addition requires determining their function, authorisation and guarantees before granting them access.
7.1 To ensure that the data they provide has been obtained lawfully, that they have a legal basis for its processing and that they have informed their own data subjects in accordance with Articles 13 and 14 GDPR.
7.2 To give lawful instructions and decide on the inclusion of special-category data in the documents they provide.
7.3 To handle their data subjects' rights requests, using the platform's features and the Provider's assistance.
7.4 To comply with their own obligations to keep invoices, ledgers and receipts for the legal periods, regardless of the retention carried out by the Provider.
7.5 To keep their access credentials confidential and use the account protection measures the platform makes available.
8.1 The service is not designed to process special-category data of third parties. If the Client includes in invoices or documents third parties' data concerning health, trade union membership, religion, sexual orientation, ethnic origin, political opinions or biometric or genetic data, they do so under their own responsibility, holding the authorisation of Article 9(2) GDPR, and inform the Provider so that any appropriate additional security measures can be applied.
9.1 The platform allows the Client to locate, rectify, export and erase the third-party data they have recorded, within the limits of the legal obligations to keep invoices and ledgers.
9.2 Where an erasure requested by one of the Client's data subjects affects data the Client must keep under a legal obligation, the Provider will facilitate restriction of processing and blocking, and the Client will inform the data subject of the reason for retention.
9.3 The Provider applies erasures, rectifications and restrictions in the database, in exports generated afterwards and in the logs, and ensures through the deletion register that erased data is not reactivated after a backup restore.
10.1 The Provider keeps the data covered by the engagement for the duration of the Contract and the subsequent view-and-download period, in accordance with the periods by category in the Privacy Policy.
10.2 Temporary technical data (diagnostics, temporary exports, incomplete uploads, ordinary inactive form drafts in the browser) is deleted within the periods stated in the Privacy Policy, without affecting the evidence of filed returns.
11.1 Each party is liable for the damage it causes by breaching the obligations imposed on it by the GDPR and this agreement in its capacity as controller or processor, under Article 82 GDPR.
11.2 The Provider is liable for the breaches of its sub-processors as if they were its own.
11.3 The Contract does not establish a contractual monetary cap on liability (clause 10.4 of the Contract). In no case is liability limited for fines imposed by the supervisory authority on one party for breaches attributable to the other or for damage caused to data subjects.
12.1 At the choice of the Client as controller, the Provider will return or erase the data on their behalf and delete the copies, except for retention required by a legal obligation. The return or erasure instruction is documented; it is not inferred from silence. The post-closure view-and-download service constitutes a limited retention and transition instruction, not an obligation to keep the entire file indefinitely.
12.2 After the service has actually ended, the Client keeps free access to view and download their file for six calendar months if complete receipt of the archive is not on record. Once the first complete download after closure is confirmed, access ends three calendar months later, even if the date is after the initial six-month limit. The Provider notifies the specific end-of-access and planned deletion date and updates it when the download is verified. Later downloads do not restart the period; an incomplete or defective delivery attributable to the Provider is corrected and does not shorten the right of access. A click, a partial export or a failed transfer do not prove complete receipt.
12.3 An initial notice is sent at closure; then reminders every fourteen days during the first three months and every seven days thereafter; during the last calendar month before the planned deletion date, every three days. All e-mails state the specific date. Closure occurs when the service actually ends; cancelling the renewal does not bring it forward. Months are calculated in Europe/Madrid and access lasts until the end of the notified day. The temporary ZIP expires after seven days and can be regenerated while access is open. No payment of a debt, renewal or revocation of a power of attorney is required to view, download or exercise rights.
12.4 When access ends, data that no longer needs to be kept is deleted. Evidence needed under an applicable obligation or to deal with liabilities is separated by category, purpose, access and period, with restriction and blocking where appropriate. The entire file is not kept indiscriminately. Backups follow their own cycle and a restore re-applies deletions and restrictions before data is re-enabled. The archive period does not replace the legal periods.
12.5 Return comprises a structured format and the available original documents, with an inventory and integrity check. The result of each erasure or restriction is recorded and evidence is provided to the Client on request, with reasoned exceptions. Data subjects' rights do not depend on the expiry of the archive.
13.1 This agreement is amended under the amendment procedure of the Contract. Amendments required by regulatory changes or by requirements of the supervisory authority are notified and applied within the period set by the rule or requirement.
13.2 It is governed by Spanish law; jurisdiction is as provided in the Contract.
Subject matter: provision of the Finomo service: invoicing, recording of income and expenses, automatic preparation of returns and transmission to the AEAT of those approved by the Client or delivery of the file for filing, sending of invoicing records when activated, retention and export.
Duration: term of the engagement and limited post-closure transition (six months without complete receipt of the archive or three months from the first complete receipt, even beyond the initial limit), under clause 12.
Nature: collection, recording, structuring, storage, consultation, calculation, retrieval, disclosure to the AEAT, export, blocking and erasure.
Purposes: those of clause 4.2.
Categories of data subjects: the Client's buyers and customers; suppliers and creditors; the Client's employees and collaborators, where applicable; representatives and contact persons of the above; landlords or tenants, where applicable.
Categories of data: identification (name, NIF, address); contact (e-mail, telephone); financial and invoicing (amounts, items, payment methods and dates, IBAN where it appears on the invoice); transaction data needed for the invoice and the ledgers; VAT numbers of intra-Community counterparties and the result of their VIES check; amounts and withholdings on invoices received from professionals where the Client applies withholdings (forms 111 and 190).
Special categories: not envisaged; where applicable, clause 8.
Authorised persons: currently, only the Provider's owner. There are no staff or contracted substitute.
Hosting sub-processor: IONOS SE (Germany) and its group entities, for the virtual private server (VPS) hosting the database, the documents and the local backups. Server location: Spain.
E-mail sub-processor: IONOS SE and its group entities, for Finomo's mailboxes and the sending and receiving of e-mail (notices, support and communications with the Client). The Provider does not claim that the entire IONOS chain (support, filtering, provider-side copies) takes place exclusively in Spain; it relies on the IONOS data processing agreement and its guarantees within the EEA. Documents received by e-mail are not included in the calculation unless the Client uploads them to the platform.
Off-site backup sub-processor (planned, not operational): IONOS Object Storage, Berlin region (Germany, EEA), as the intended destination for a daily encrypted copy with thirty days' retention and object locking preventing deletion during that period. This off-site copy is not operational: its contracting and restore test are pending, and this sub-processor does not currently process any Client data. Backups are currently made only on the server infrastructure in Spain. The Provider will inform the Client when it comes into operation in accordance with clause 6.2.
Recipients that are not sub-processors: the AEAT, as the recipient authority for approved returns transmitted with a power of attorney, for invoicing records when activated and for VIES queries; and Stripe Payments Europe, Limited (Ireland), payment service provider for the Provider's own fees, which does not process the data of the Client's third parties and is identified in the Privacy Policy.
International transfers: the Provider makes no transfers of its own outside the EEA. Access by the owner via VPN from outside the EEA while travelling is access by the operator personally, not a disclosure to a third party. The Provider does not claim the complete absence of support access from third countries by its suppliers; in such a case the Chapter V safeguards provided in those suppliers' contracts apply.
The Provider applies and documents the following measures, proportionate to the risk of the processing. The Provider holds no third-party security certifications and does not claim any; the measures are reviewed at least once a year and after each incident. Measures expressly identified as planned are not operational and are not counted among those applied.
Governance: inventory of assets and data, allocation of responsibilities (currently, only the owner), change management and individual credentials.
Access control: least-privilege principle, strengthened operator authentication, session management, credential protection, access revocation and logical separation between clients, with isolation testing.
Encryption: encryption of communications (TLS), protection of documents and backups, key management separate from the code. The actual scope of encryption at rest is documented per resource.
Provider's electronic certificate: restricted custody, expiry control, usage logging and rotation.
Traceability: protected logging of contracts, returns, powers of attorney, access, exports, exercise of rights and external operations. Ordinary security events are kept for six months; those linked to an investigation, for as long as it lasts and is documented.
Backups. Applied: encrypted local backups on the server infrastructure in Spain, with tested restore; a restore re-applies deletions and restrictions before data is re-enabled. Planned, not operational: daily encrypted off-site copy in IONOS Object Storage (Berlin) with thirty days' retention and object locking; its contracting and restore test are pending and it is not counted among the applied measures.
Rights and deletion: execution by category and service, blocking and a register of deletions and restrictions re-applied on restore; three- or six-month archive with notices every fourteen, seven and three days.
Environments: separation between development, testing and production environments; test environments do not communicate with the real AEAT and use synthetic data.
Updates: assessment and remediation of vulnerabilities according to their severity, exposure and capacity, with decisions recorded.
Operator devices: work within the platform, with no persistent client tax files on the operator's personal devices; data access only via VPN, including while travelling and outside the EEA.
E-mail: communications and support channel protected with domain authentication and delivery-error monitoring; documents received by e-mail are not included in the calculation unless the Client uploads them to the platform.
Incidents: containment, assessment, recording, notice to the Client as controller and cooperation under Annex III.
Suppliers: identification of each supplier, its function, countries, access, contract, changes and exit, under Annex I.
Configuration and internal documents are not disclosed indiscriminately if they reveal trade secrets or other clients' data; the Client is provided with sufficient evidence for their oversight.
1. Detection and recording. Any anomaly that may constitute a security breach (unauthorised access, loss, alteration, disclosure or unavailability of data) is recorded with the date and time of detection, origin and initial description.
2. Containment. The Provider immediately adopts containment measures (revocation of credentials, isolation of systems, blocking of access) and preserves the evidence.
3. Assessment. The categories, data subjects, data affected, likely consequences and measures are assessed without delay. A technical incident does not automatically become a notifiable breach. The facts and the moment of awareness are documented; communication to the Client is not delayed in order to complete the investigation.
4. Notification to the Client. Without undue delay after the Provider becomes aware of the breach and without waiting to have all the information, completing it in phases, the Provider informs the Client by e-mail and on the platform of: date and time of detection and estimated start date; description of the breach; categories of data and data subjects affected and approximate number; likely consequences; measures adopted and proposed; contact point (gdpr@finomo.es); and additional information to be provided in phases.
5. Cooperation. The Provider assists the Client in notifying the Spanish Data Protection Agency (72-hour period from the Client's awareness) and in communicating with data subjects where there is a high risk, providing additional information as it becomes available.
6. Own processing. Where the Provider is the controller, it applies Article 33 GDPR: notification to the authority without undue delay and, where feasible, within 72 hours of awareness, unless the risk is unlikely; any delay is justified. Article 34 requires communication to the data subject without delay in case of high risk, with its exceptions. The decision not to notify is also documented.
7. Recording and review. Every breach, whether notified or not, is documented in the incident register with its facts, effects and corrective measures. The risk analysis and Annex II are reviewed after each incident.
For the purposes of clause 5.1, the following actions carried out on the platform from the Client's authenticated account are considered documented instructions of the Client:
1. Configuration of their tax profile, regime, periods and calculation preferences.
2. Provision, replacement or deletion of documents and recording of transactions.
3. Marking a period's data as ready ("all data ready"), which starts preparation of the draft and does not constitute its approval.
4. Approval of each draft return or correction, which constitutes the order for its transmission or, without a power of attorney, for delivery of the file for filing by the Client, with the record of date, time, IP address and digital fingerprint of the approved draft, and without acceptance of an automatic warning allowing transmission or delivery of the file while substantial data is pending.
5. Activation of the mode for sending invoicing records to the AEAT.
6. Requests for export, rectification, restriction or erasure of data.
7. Acceptance of the addition of a sub-processor or objection to it.
Any instruction other than the above is made in writing to gdpr@finomo.es and added to the dated register of instructions.
Evgenii Ustinov · NIF Z2074293C
Juan Caturla Gosalvez 2, Alicante
Contact: support@finomo.es
Personal data: gdpr@finomo.es