1. Parties and subject matter
This agreement is concluded between Ei3 Software Solution shpk, NIPT L62221018T, with its registered office in Tirana, which provides the Fature.al service (hereinafter "the Processor"), and the business that has opened an account on Fature.al (hereinafter "the Controller").
The agreement is an integral part of the Terms of use. By opening an account or continuing to use the Service, the Controller accepts it. On request to [email protected], we send a copy signed by the Processor.
It sets out the obligations between controller and processor under Article 28 of Regulation (EU) 2016/679 (GDPR) and Law no. 124/2024 "On personal data protection". Fature.al processes data in compliance with the GDPR.
2. Definitions
- Service: the Fature.al platform, its applications, APIs and POS.
- Controller Data: the personal data that the Controller, its employees or the systems it connects enter into the Service.
- Sub-processor: a third party engaged by the Processor that processes Controller Data on the Processor's behalf.
- Personal data breach: a breach of security leading to the destruction, loss, alteration, disclosure of, or unauthorised access to, Controller Data.
Other terms have the meaning given to them by Law no. 124/2024.
3. Roles of the parties
For the data the Controller enters into the Service (its buyers, suppliers, employees and users), the Controller is the controller and Fature.al is the processor.
For the data it needs to administer the relationship with the Controller (account, subscription, payments, communication), Fature.al acts as a controller in its own right, under the Privacy policy.
The Controller warrants that it has a legal basis for entering the data into the Service and for the instructions it gives.
4. Description of the processing
| Subject matter | Issuing, fiscalising, storing and reporting invoices and other commercial documents, managing customers, products, warehouse and cash register. |
|---|---|
| Nature | Collection, recording, storage, retrieval, use, transmission to the tax authority, export and erasure. |
| Purpose | Providing the Service under the Terms of use and fulfilling the Controller's fiscalisation obligations. |
| Duration | For as long as the Controller has an active account, plus the periods in clause 14. |
| Data subjects | The Controller's buyers and suppliers, its employees and users, and the contact persons of its partners. |
| Categories of data | First and last name, NIPT or personal number, address, email, phone, IBAN, invoice and payment data, identification data when the Controller enters it (e.g. for currency exchange), user credentials. |
| Special categories | The Service is not designed for them and the Controller must not enter them. |
5. The controller's instructions
The Processor processes Controller Data only on the Controller's documented instructions. The instructions are this agreement, the Terms of use and the actions the Controller performs in the Service (for example, issuing an invoice, exporting a report or connecting an integration).
The Processor does not use Controller Data for its own purposes, does not sell it and does not use it for marketing. If the law requires it to process the data otherwise, it informs the Controller beforehand, unless the law prohibits such notice. If an instruction appears to it to infringe the law, it immediately informs the Controller.
6. Confidentiality
Access to Controller Data is granted only to persons who need it to provide, maintain or support the Service. They are bound by law or by contract to maintain confidentiality, including after their employment ends.
The support team accesses the Controller's account only at the Controller's request or when necessary to resolve a technical problem, and every such access is logged.
7. Security
The Processor implements technical and organisational measures appropriate to the risk, described on the Security page, which is an annex to this agreement. The Processor may update these measures, provided that the level of protection is not reduced.
The Controller is responsible for security on its side: safekeeping passwords and API tokens, granting the appropriate rights to its users and closing the accounts of employees who leave.
8. Sub-processors
The Controller gives general authorisation for the Processor to engage the sub-processors listed on the Sub-processors page.
The Processor concludes with each sub-processor a contract with data protection obligations no less protective than these, and remains liable to the Controller for their actions.
For any new or replacement sub-processor, the Processor updates the list and notifies the account administrators by email at least 30 days in advance. The Controller may object on reasonable grounds within this period. If the parties do not find a solution, the Controller may terminate the subscription without penalty and receives a refund of the amount paid for the unused period.
9. Location and transfers
Controller Data is stored in the European Union, on servers in the Netherlands (Amsterdam). Backups are also stored in the EU.
When a sub-processor processes the data outside Albania and the EU, the transfer relies on an adequacy decision or on the EU Standard Contractual Clauses, in accordance with Law no. 124/2024. The Sub-processors page shows the location and safeguard for each one.
10. Data subject rights
The Service allows the Controller to find, rectify, export and erase the data of its customers. Where these tools are not enough, the Processor assists the Controller in responding to data subject requests.
If a data subject contacts the Processor directly about data belonging to the Controller, the Processor forwards the request to the Controller without delay and does not respond itself, unless the Controller instructs it to.
11. Personal data breach
The Processor notifies the Controller without undue delay, and no later than 48 hours after becoming aware of it, of any breach affecting Controller Data. The notification contains, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed.
This allows the Controller to notify the Commissioner within 72 hours, as the law requires. Information that is not yet known is provided later, as soon as it becomes available.
12. Assistance to the controller
Taking into account the nature of the processing, the Processor assists the Controller with the information it needs for data protection impact assessments and for consultations with the Commissioner.
13. Information and audit
The Processor makes available to the Controller the information necessary to demonstrate that it complies with this agreement. The Controller may verify this through a written questionnaire or, where that is not enough, through an audit notified at least 30 days in advance, during working hours, once a year, by the Controller itself or by an independent auditor bound by confidentiality.
The audit does not include access to the data of other businesses or to the systems of sub-processors. For those, the Processor provides the reports of their certifications, where they exist.
14. Termination and deletion
Throughout the subscription, the Controller may export its invoices, customers, products and reports. After the account is closed, the Processor keeps the data for a further 90 days, so that the Controller can export it or reactivate the account.
After this period, the Processor deletes or anonymises the Controller Data, except data that the law requires it to keep. The Controller may request in writing that its fiscal archive be kept for the legal retention period for tax documents; in that case the data is kept for that purpose only.
Backups are deleted according to their regular cycle and until then remain protected by this agreement.
15. Requests from authorities
Invoices are transmitted to the General Directorate of Taxation for fiscalisation, because the law requires it and the Controller itself requests it when issuing the invoice. This is not sharing with third parties.
If another authority requests Controller Data, the Processor asks it to address the Controller, informs the Controller, unless the law prohibits it, and provides only what is required by law.
16. Final provisions
This agreement applies for as long as the Processor processes Controller Data. If it conflicts with the Terms of use on data protection matters, this agreement prevails.
The Processor may update this agreement to adapt it to changes in the law or in the Service, notifying the Controller at least 30 days in advance, provided that data protection is not reduced.
The agreement is governed by Albanian law. Disputes are settled amicably and, where that cannot be achieved, by the competent courts in Tirana.