Data Processing Agreement
Last updated 28-09-2026
This Data Processing Agreement governs the Supplier's processing of personal data on behalf of the Customer in connection with the web-based budgeting, reporting and financial-management service. It is based on the Danish Data Protection Agency's standard contractual clauses, version 1.2, and adapted to a self-service B2B SaaS service with integrations to accounting systems.
| Information | Must be inserted or confirmed |
|---|---|
| Supplier | ESIO ApS CVR 45129756 Snedronningen 32 5240 Odense NØ |
| Service | ESIO; https://budget.esio.dk |
| Subprocessors | All Appendix C.2 measures assumed implemented; reviewed 28 September 2026. |
| Security | Confirm that every measure in Appendix C.2 is actually implemented. |
| Deletion and backups | Customer Data, including historical records containing personal data, is deleted or irreversibly anonymised within 30 calendar days after the 90-day post-termination access period expires, or within 30 calendar days after receiving the Customer’s earlier deletion instruction. Remaining backup copies expire within a further 30 calendar days. |
| Third-country transfers | None. All processing and support access remains within EU. |
1. Parties and application of the Agreement
1.1 The controller is the legal entity or sole proprietorship that creates or uses a customer account for the Software Service (the "Customer"), as identified in the order, subscription or customer account.
1.2 The processor is the supplier identified as the supplier in the then-current Terms and Conditions for the Software Service (the "Supplier").
1.3 The Customer and the Supplier are each a "party" and together the "parties". This agreement and its appendices constitute the Data Processing Agreement.
1.4 The Data Processing Agreement applies automatically when the Supplier processes personal data on behalf of the Customer as part of providing the Software Service. It forms an integral part of the parties' overall agreement.
1.5 If provisions concerning the processing of personal data conflict, the Data Processing Agreement takes precedence over the Terms and Conditions and other contractual documents. It does not limit mandatory rights or obligations under the GDPR or other applicable data-protection law.
2. Purpose and interpretation
2.1 The Data Processing Agreement establishes the Supplier's rights and obligations when processing personal data on behalf of the Customer and is intended to satisfy Article 28(3) of the GDPR.
2.2 Appendix A describes the purposes and nature of the processing, types of personal data, categories of data subjects and duration. Appendix B governs subprocessors. Appendix C contains the Customer's documented instructions and minimum requirements for security, deletion, locations, assistance and audits. Appendix D governs supplementary commercial and practical matters.
2.3 Terms including "personal data", "processing", "controller", "processor", "subprocessor", "personal data breach" and "third country" have the same meanings as under the GDPR.
3. Customer rights and obligations
3.1 The Customer is responsible for ensuring that the processing it instructs the Supplier to perform has a valid legal basis and otherwise complies with the GDPR, other relevant EU law and national law.
3.2 The Customer determines the purposes and essential means of the processing and is responsible for lawful collection, appropriate information to data subjects, and the necessary permissions and instructions.
3.3 The Customer must not use the Software Service intentionally to process special categories of personal data under Article 9, data relating to criminal convictions and offences under Article 10, or Danish civil registration numbers, unless agreed with the Supplier in writing in advance and the appendices have been updated with appropriate safeguards.
3.4 The Customer is responsible for managing its users' access, including creating, changing and closing user access promptly and protecting credentials.
4. The Supplier acts on instructions
4.1 The Supplier may process personal data only on documented instructions from the Customer, unless processing is required by EU law or the national law of a Member State to which the Supplier is subject. The instructions are set out in this Data Processing Agreement, including Appendices A and C, the Customer's documented use of the Software Service's functions, and later written instructions accepted by the parties.
4.2 The Supplier processes personal data only to provide, host, maintain, secure, troubleshoot, support and develop the agreed functions on the Customer's behalf. The Supplier must not use Customer Data for its own marketing, pricing or profiling purposes.
4.3 The Supplier may use statistics that have been rendered genuinely anonymous so that neither the data subjects nor the Customer can be identified by reasonably available means. Aggregation alone is insufficient if the information can still be attributed to an individual.
4.4 The Supplier shall notify the Customer without undue delay if, in the Supplier's opinion, an instruction infringes the GDPR or other applicable data-protection law. The Supplier may suspend the affected processing until the instruction has been clarified where necessary to avoid unlawful processing.
5. Confidentiality
5.1 The Supplier shall grant access to personal data only to persons acting under the Supplier's authority who require access for their work and are bound by contractual or statutory confidentiality obligations.
5.2 Access shall be granted according to the principle of least privilege, reviewed regularly and removed without undue delay when no longer required. On request, the Supplier shall be able to demonstrate that relevant persons are subject to the confidentiality obligation.
6. Security of processing
6.1 The Supplier shall implement and maintain appropriate technical and organisational measures under Article 32 GDPR, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of data subjects.
6.2 The minimum measures are set out in Appendix C.2. The Supplier may change specific technical solutions provided the overall level of protection is not reduced. Material changes that reduce the security level or alter the processing risk require the Customer's documented approval.
6.3 The Supplier shall assist the Customer with relevant information about the security measures so the Customer can comply with Article 32. Special measures requested by the Customer beyond those agreed must be documented and may be subject to separate payment unless they are required because of the Supplier's breach.
7. Subprocessors
7.1 The Customer grants the Supplier general written authorisation to use subprocessors subject to this Section and Appendix B.
7.2 The Supplier shall ensure that an accurate and up-to-date list of relevant subprocessors in the supply chain remains continuously available to the Customer. The list must state each subprocessor's name, function, processing country or countries and, where relevant, the basis for transfers to third countries.
7.3 The Supplier shall notify the Customer in writing at least 30 days before a planned addition or replacement of a subprocessor. The notice must give the Customer a genuine opportunity to object on reasonable data-protection grounds before the change takes effect.
7.4 If the parties cannot resolve a justified objection before the change takes effect, the Customer may terminate the affected service with effect from the change date without further payment for the period after termination. This right does not entitle the Customer to reimbursement for services already provided.
7.5 By written agreement, the Supplier shall impose on each subprocessor data-protection obligations materially equivalent to the Supplier's obligations under this Data Processing Agreement, including appropriate security, confidentiality, assistance, deletion, audits and onward-transfer requirements.
7.6 The Supplier remains fully liable to the Customer for each subprocessor's performance of its data-protection obligations. On request, the Supplier shall provide the Customer with relevant documentation of the subprocessing agreement; commercial terms and other confidential information unrelated to data protection may be redacted.
8. Transfers to third countries and international organisations
8.1 The Supplier may transfer, remotely access or otherwise make personal data available in a third country or to an international organisation only on the basis of clear, documented instructions from the Customer and in compliance with Chapter V of the GDPR.
8.2 Approved transfers and the relevant transfer mechanism must be stated in Appendices B and C.6. A general or ambiguous statement that a transfer may occur does not, by itself, constitute an instruction.
8.3 If EU law or the national law of a Member State requires the Supplier to carry out processing or a transfer that the Customer has not instructed, the Supplier shall inform the Customer before the processing unless that law prohibits such information on important grounds of public interest.
8.4 If an approved transfer mechanism requires supplementary measures or a transfer impact assessment, the Supplier shall assist with the information and measures reasonably necessary.
9. Assistance to the Customer
9.1 Taking account of the nature of the processing, the Supplier shall assist the Customer, insofar as possible through appropriate technical and organisational measures, in responding to requests concerning data-subject rights under Chapter III GDPR.
9.2 The Supplier shall forward without undue delay any request from a data subject concerning the Customer's personal data and shall not respond itself unless instructed to do so by the Customer.
9.3 Taking account of the nature of the processing and the information available to it, the Supplier shall assist the Customer with compliance under Articles 32-36, including security, breach notification and communication, data-protection impact assessments and prior consultation with a supervisory authority.
9.4 Ordinary assistance through the Software Service's functions and reasonable standard responses is included in the subscription. Extensive Customer-specific assistance may be invoiced by prior agreement unless required because of the Supplier's breach or another matter for which the Supplier is responsible.
10. Personal data breaches
10.1 The Supplier shall notify the Customer without undue delay and, where possible, no later than 24 hours after becoming aware of a personal data breach affecting the Customer's personal data.
10.2 To the extent the information is available, the notification shall describe the nature of the breach, the affected categories and approximate numbers of data subjects and records, the likely consequences, measures taken or proposed to address the breach, and a relevant contact point. Information may be provided in phases without further undue delay.
10.3 The Supplier shall document the breach and cooperate in good faith with the Customer. The Supplier shall not notify a supervisory authority or communicate with data subjects on the Customer's behalf without documented instructions unless the Supplier is itself legally required to do so.
11. Deletion and return
11.1 The Customer may export Customer Data through the available functions during the subscription and the agreed post-termination access period.
11.2 At the end of the processing services, the Supplier shall, at the Customer's choice, return the personal data and then delete existing copies, or delete the personal data, unless EU law or the national law of a Member State requires continued storage.
11.3 If the Customer does not communicate another choice before the access period expires, the Customer is deemed to have instructed the Supplier to delete the data in accordance with Appendix C.4. Personal data in backups may be kept only in isolation until automatically overwritten and must not be used for other purposes; if a backup is restored, previously deleted data must be deleted again.
11.4 On reasonable request, the Supplier shall confirm that deletion has been completed in accordance with Appendix C.4.
12. Documentation and audits
12.1 The Supplier shall make available the information reasonably necessary to demonstrate compliance with Article 28 and this Data Processing Agreement and shall contribute to audits and inspections performed by the Customer or an independent auditor authorised by the Customer.
12.2 Audits shall be carried out under the procedure in Appendix C.7 and in a manner that protects other customers' information, the Supplier's confidential information, and the security and operation of the service. An audit must not provide access to information the Customer is not entitled to receive.
12.3 The Supplier shall immediately inform the Customer if it considers an audit instruction to infringe the GDPR or other applicable data-protection law.
12.4 Competent supervisory authorities shall have the access to which they are entitled under applicable law.
13. Liability and other terms
13.1 The parties' liability is governed by applicable law and the Terms and Conditions. No limitation of liability may restrict liability or an obligation to the extent it cannot lawfully be restricted or impair data-subject rights under the GDPR.
13.2 If terms concerning liability, governing law or jurisdiction in the Terms and Conditions conflict with mandatory data-protection rules or the core obligations of this Data Processing Agreement, the latter prevail.
14. Entry into force duration and termination
14.1 The Data Processing Agreement enters into force when the Customer accepts the Terms and Conditions that incorporate it, or when the parties otherwise enter into it electronically or in writing. The Supplier must be able to document the version accepted by the Customer and the time of acceptance.
14.2 The Data Processing Agreement remains in force for as long as the Supplier processes personal data on behalf of the Customer. Provisions that by their nature are intended to survive, including confidentiality, deletion, documentation and liability, continue after termination.
14.3 The Supplier may update the Data Processing Agreement where necessary because of changes in law, regulatory requirements or changes to the Software Service. Material changes shall be notified in writing at least 30 days in advance. A change must not reduce the agreed level of data protection or override the Customer's right to object to new subprocessors.
15. Contact
15.1 Notices under the Data Processing Agreement shall be sent to the Customer's administrator or registered data-protection contact and to the Supplier's data-protection contact stated in Appendix D.
15.2 The parties shall keep their contact details up to date.
Appendix A Information about the processing
A.1 Purpose
The purpose is to provide the functions of the Software Service to the Customer, including importing or receiving accounting and budget data, creating and maintaining budgets, performing agreed calculations and projections, comparing budgets with actual figures, presenting reports and visualisations, administering user access, and providing technical support, security, backups, exports and deletion.
The Supplier's processing of account, subscription, billing, support and its own analytics data in the role of independent controller is outside this Data Processing Agreement and must be described in the Supplier's Privacy Policy.
A.2 Nature of the processing
The processing may include collection through Customer entry, file import or an authorised API integration with accounting systems; recording, structuring, organisation, storage, adaptation, calculation, combination, display, search, retrieval, export, support access, backup, restriction and deletion. The Supplier must not sell Customer Data or use it for third-party advertising.
A.3 Types of personal data
| Category | Examples |
|---|---|
| Identity and contact information | Name, company name, position, email address, telephone number, postal address and internal customer or supplier numbers. |
| Company and relationship information | Relationship with the Customer, customer, supplier, contact person, owner, director, employee, adviser or other business connection. |
| Accounting and transaction information | Invoice and voucher references, posting dates, amounts, currency, account names, payment references, bank-account numbers or parts thereof, and free text in entries and descriptions. |
| Budget and reporting information | Budget items, classifications, notes, calculations, comparisons and projections where attributable to an individual. |
| User and access information in Customer Data | Name, email, role, permissions and actions taken within the Customer's area, to the extent the information is processed on the Customer's behalf. |
| Other information in imported fields | Other ordinary personal data lawfully entered by the Customer into supported fields. Special categories, criminal-offence data and Danish civil registration numbers are not intended and may be processed only under a separate written agreement. |
A.4 Categories of data subjects
• The Customer's current and former employees, management, owners, users and advisers.
• The Customer's customers, including sole proprietorships, and contact persons at corporate customers.
• The Customer's suppliers, including sole proprietorships, and contact persons at suppliers.
• Debtors, creditors, investors, business partners and other persons referred to in the Customer's accounting, budget or transaction data.
A.5 Duration
Processing begins when the Customer starts using the Software Service or connects an integration and continues while the subscription or relevant processing service is active, as well as during the limited access and deletion period after termination stated in Appendix C.4. Obligations concerning backup copies continue until they have been deleted under the agreed cycle.
Appendix B Subprocessors
B.1 General authorisation and notice
The Customer grants general written authorisation for the subprocessors stated below or in the continuously available subprocessor list incorporated by reference into this Appendix. The Supplier shall give at least 30 days' written notice of planned additions or replacements.
| Subprocessor | Function and data | Processing country or countries | Transfer outside the EU/EEA |
|---|---|---|---|
| Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany | Hosting and operation of the budgeting application, database and backups, and of the separate restore server on which the backups are test-restored (Appendix C.2, backup and recovery). | Germany, Finland | No. EU/EEA-only hosting and support. |
| Microsoft Danmark ApS Kanalvej 7, 2800, Kongens Lyngby Denmark | Customer support email and document storage, authentication. | European Union (EU Data Boundary) | No. EU/EEA-only hosting and support. |
The list must be accurate and cover relevant subprocessors in the supply chain. The country of a company's registered address is insufficient if processing actually takes place from other countries.
B.2 Customer-directed integrations
An accounting system or another third party with which the Customer has its own agreement and which the Customer instructs the Software Service to exchange data with is not, for that reason alone, the Supplier's subprocessor. If that third party instead processes Customer Data on the Supplier's behalf, it must appear on the subprocessor list. Payment and billing providers that process only the Supplier's own customer and payment information are described in the Privacy Policy rather than this Appendix.
Appendix C Customer instructions
C.1 Subject matter of processing
The Customer instructs the Supplier to carry out the processing necessary for the purposes and functions described in Appendix A, in accordance with the Customer's configuration, user actions, integration choices and other documented instructions. The instructions do not include processing for the Supplier's own marketing, advertising, pricing or profiling purposes.
C.2 Minimum security requirements
The processing covers financial information that may be confidential and could have significant consequences if accessed, altered or lost without authorisation. The parties therefore agree on an appropriate security level for ordinary personal data, with increased attention to confidentiality, integrity and availability. At a minimum, the following requirements apply:
| Area | Minimum requirement |
|---|---|
| Encryption in transit | External communications and API traffic containing personal data are protected using modern, supported TLS. Insecure protocols and weak cipher suites must not be used. |
| Encryption at rest | Production databases, object storage and backup media containing Customer Data are encrypted at rest using industry-recognised mechanisms. Keys and access to keys are protected separately. |
| Identity and access | Unique accounts, role-based access and least privilege. Administrative and production access is protected with multi-factor authentication. Shared administrator accounts are avoided. |
| Access reviews | Privileged access is reviewed at least quarterly and removed immediately following a role change or termination. |
| Passwords and secrets | Passwords are stored only as modern salted hashes. API keys, tokens and other secrets are held in a suitable secrets-management solution and must not be embedded in source code or log files. |
| Environment separation | Production data is separated from development and test environments. Real Customer Data must not be copied into testing unless necessary, approved and equivalently protected; anonymised or synthetic data is preferred. |
| Vulnerabilities and updates | Operating systems, dependencies and components are kept updated under a documented, risk-based process. Critical vulnerabilities are addressed without undue delay. |
| Logging and monitoring | Security-relevant events and administrative actions are logged to an extent that supports troubleshooting, misuse detection and incident response. Logs are protected against unauthorised alteration and do not contain unnecessary personal data or secrets. |
| Backup and recovery | Backups are performed regularly under a documented cycle. Recovery is tested at least weekly by restoring the newest backup onto a separate restore server hosted by the same subprocessor within the EU/EEA. The restored copy is reachable only over the Supplier's private network, has no connection to the internet or to any third party, holds placeholder credentials so that it can send nothing, is used solely to verify that the backup can be restored, and is replaced at the next test. Access to backups and to the restore server is restricted. Actual retention and deletion periods are stated in C.4. |
| Incident response | The Supplier maintains a documented process for detecting, assessing, containing, remediating and reporting security incidents and preserving relevant documentation. |
| Development and changes | Material changes are reviewed and tested before production. Source code and deployment access are protected. Security-relevant defects are prioritised according to risk. |
| Data minimisation and deletion | No more Customer Data is collected or retained than necessary for the agreed functions. Deletion functions and procedures cover active systems and the subsequent expiry of backup copies. |
| Personnel and remote working | Persons with access are instructed in confidentiality and secure processing. Remote access to administrative systems is protected with strong authentication, updated devices and encrypted communications. |
| Supplier management | Subprocessors are assessed before use and monitored on a risk-based basis. Changes to the supply chain are handled under Section 7 and Appendix B. |
C.3 Assistance
The Supplier shall assist through export, search, rectification and deletion functions where available, and through support in locating, disclosing, rectifying, restricting or deleting information. The Supplier shall also provide relevant technical information for security assessments, breach notifications, impact assessments and enquiries from supervisory authorities.
C.4 Retention and deletion procedure
Following the 90-day post-termination access period, or upon the Customer’s earlier deletion instruction, the Supplier shall delete or irreversibly anonymise Customer Data in active systems, including historical records and previous versions, within 30 calendar days, unless applicable law requires retention. Backup copies shall be deleted where technically possible; otherwise, they shall remain isolated from ordinary use and expire within 30 calendar days after deletion from active systems. If a backup is restored, previously deleted data shall be deleted again before ordinary processing resumes. A restore performed solely to verify a backup under C.2 is not a resumption of ordinary processing: the restored copy remains isolated as described there and is discarded at the next verification.
C.5 Processing locations
Processing may take place only from the countries and locations stated in Appendix B or the expressly incorporated, version-controlled subprocessor list. Locations must be identified by specific country and, where necessary for the assessment, region or data-centre area. The Supplier must not change a processing country without complying with the requirements concerning subprocessors and third-country transfers.
C.6 Instructions concerning third-country transfers
The default position is that personal data is processed within the EU/EEA. The Customer does not instruct the Supplier to transfer or make Customer Data accessible outside the EU/EEA unless a specific transfer, recipient, processing activity and valid transfer mechanism are expressly stated in Appendix B or a later documented instruction.
C.7 Audits of the Supplier
At least annually, the Supplier shall perform a documented review of the technical and organisational measures. No more than once in any 12-month period, the Customer may request reasonable documentation, a questionnaire or a remote audit on at least 30 days' notice. This limitation does not apply following a material security breach, where there is a specifically substantiated suspicion of non-compliance, or at the request of a competent supervisory authority.
If the documentation does not provide reasonable assurance of compliance, the Customer or an independent auditor bound by confidentiality may conduct a more targeted inspection during normal business hours. The inspection shall be planned to minimise impact on security and operations. The Customer bears its own costs; the Supplier bears its own reasonable costs of ordinary documentation. Extraordinary costs may be agreed in advance unless the audit reveals a material breach by the Supplier.
C.8 Oversight of subprocessors
The Supplier shall assess relevant subprocessors before use and monitor them on a risk-based basis through contract review, security documentation, audit reports, certifications, questionnaires or other appropriate controls. The Supplier shall make relevant documentation available to the Customer on reasonable request, taking account of confidentiality and the security of other customers.
Appendix D Supplementary information
| Field | Information |
|---|---|
| Software Service name and URL | ESIO; https://budget.esio.dk |
| Supplier's legal name | ESIO ApS |
| Danish CVR number | 45129756 |
| Address | Snedronningen 32 5240 Odense NØ |
| Data-protection contact | Iustinian Olaru, io@esio.dk |
| Security breaches | Iustinian Olaru, io@esio.dk |
| Date or version number | Version 1.0; 21 September 2026 |
D.1 Electronic execution
The Agreement does not require a handwritten signature if the Customer accepts it as an integral part of the Terms and Conditions and the Supplier records the Customer's identity, the agreement version and the time of acceptance in a manner that can be documented. If the parties wish to sign separately, the fields below may be used.
| For the Customer | For the Supplier |
|---|---|
| Name: Position: Date: Signature: |
Name: Position: Date: Signature: |
D.2 Version control
The Supplier shall retain previous versions of the Data Processing Agreement and the subprocessor list, together with documentation showing which version binds each Customer. Material changes shall be communicated under Section 14.3.
Basis
This agreement is based on the Danish Data Protection Agency's standard contractual clauses under Article 28(3), version 1.2. The adaptations do not alter the parties' mandatory obligations under the GDPR. A Danish lawyer should review the agreement after the actual supplier, security and transfer information has been inserted.