Data processing.

This is the standing data processing agreement for Cimalys software integrations and services. It follows the clause structure required by Article 28(3) GDPR. Where you have signed a separate DPA with Cimalys, that signed agreement prevails and this page is informational. This page is not legal advice, and it does not create a controller-processor relationship on its own. That relationship arises from your services agreement with Cimalys.

Processor: Cimalys ApS, CVR 46502493, Næstvedvej 34 st., 4100 Ringsted, Denmark.

Controller: the client organisation that engages Cimalys and whose data is processed.

The controller determines the purposes and means of processing. Cimalys acts only as processor, on the controller's documented instructions. Third-party services the controller holds directly, such as e-conomic, OpenAI, Slack, or its own hosting, are the controller's own processors under the controller's separate agreements with them, and are not Cimalys sub-processors.

Subject matter: delivery, configuration and support of Cimalys integrations and assistant systems.

Nature and purpose: accessing, reading, structuring and configuring the controller's own business data so its systems and staff can use it. Integrations marked read-only do not write to the source system.

Connectors operate as pass-through. The e-conomic connector relays a request from the controller's own assistant to the controller's accounting system and returns the answer. It does not copy, cache, mirror, index, or otherwise retain the accounting data it relays. Processing is limited to transmission for the duration of each request. Nothing about the controller's accounting data persists after a request completes.

Duration: the term of the engagement. Because no data is retained, duration bears on stored credentials rather than on stored data. See clause 9.

Data subjects: the controller's staff, and individuals appearing in material the controller connects or loads, such as its customers, suppliers and correspondents.

Types of data: ordinary personal data such as names, business contact details, and the content of business documents, invoices, correspondence and records the controller includes.

The services are not intended for special-category data under Article 9, criminal-offence data under Article 10, or national identification numbers such as CPR. Where an integration reads a source system that contains such fields, Cimalys filters them out before they reach any assistant or model context wherever technically possible. If the controller nonetheless introduces such data, it does so on its own responsibility and must inform Cimalys in advance.

(a) Documented instructions. Cimalys processes personal data only on the controller's documented instructions, including this agreement and the services agreement, unless required otherwise by EU or Danish law, in which case Cimalys informs the controller first where legally permitted.

(b) Confidentiality. Personnel authorised to process the data are bound by confidentiality obligations.

(c) Security. Cimalys implements appropriate technical and organisational measures under Article 32. See clause 5.

(d) Sub-processors. Cimalys does not engage sub-processors to process the controller's personal data without prior written authorisation, and imposes equivalent obligations on any it does engage. The sub-processors currently engaged are named in clause 8, and the controller is given the opportunity to object to changes.

(e) Data subject rights. Cimalys assists the controller, by appropriate technical and organisational measures, in responding to requests to exercise rights under Chapter III.

(f) Articles 32 to 36. Cimalys assists the controller in ensuring compliance with security, breach notification, and data protection impact assessment obligations, taking into account the nature of processing and the information available.

(g) Deletion or return. On termination, or on the controller's request, Cimalys deletes or returns the personal data and deletes existing copies, unless EU or Danish law requires retention.

(h) Audits. Cimalys makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates.

Credentials are stored in root-only environment files with restrictive permissions, never in source control and never in a database. Access to production systems is by SSH key only, with password authentication disabled. Network access is restricted at the infrastructure edge to the ports required to operate the service. Traffic is encrypted in transit with TLS. Automatic security updates are enabled. Where an integration is read-only, that boundary is enforced by exposing only read operations rather than relying on credential scope alone.

For pass-through connectors the strongest control is architectural rather than procedural. Cimalys retains neither the accounting data nor the credential that reaches it. The controller's access token accompanies each request from the controller's own system, is held in memory only for the duration of that request, and is never written to disk. There is consequently no store to breach, no backup to leak, no credential database to compromise, and no retention period to get wrong.

The controller's accounting data, and the personal data within it, are processed on infrastructure located in the European Union (Hetzner, Germany). Where a named sub-processor operates outside the EEA (Cloudflare, Resend), it processes only limited connection or licence metadata, or transactional email, under a valid Chapter V transfer mechanism: the EU-US Data Privacy Framework where the recipient is certified, and the EU Commission's Standard Contractual Clauses otherwise. Transfers arising from the controller's own third-party services are governed by the controller's agreements with those providers.

Cimalys notifies the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and provides the information reasonably available to assist the controller in meeting its own obligations under Articles 33 and 34.

Cimalys engages the following sub-processors to deliver the services, each bound by a data processing agreement imposing obligations equivalent to those in this DPA:

• Hetzner Online GmbH (Falkenstein, Germany, EU) — server infrastructure hosting the e-conomic connector and the client pods that process personal data on the controller's behalf. Processing takes place in the EU.
• Cloudflare, Inc. (United States; EU-US Data Privacy Framework certified) — edge proxy, DNS, and the licence-validation service. Processes connection and licence metadata, not the controller's accounting data.
• Resend, Inc. (United States; Standard Contractual Clauses) — transactional and sign-in email for the pod services. Processes the recipient's email address only.

The controller's own accounting system (e-conomic, a Visma company) and the controller's own AI assistant provider (for example Anthropic or OpenAI) are the controller's own processors under the controller's separate agreements with them, and are not Cimalys sub-processors. The controller is notified of intended changes to this list in advance and may object on reasonable data protection grounds; requests can be sent to hello@cimalys.com.

For pass-through connectors there is nothing to return or delete. No accounting data is retained, and no access credential is retained either. The controller's token travels with each request from the controller's own system and exists on Cimalys infrastructure only for the moment that request is being served.

Disconnection is therefore performed by the controller rather than requested from Cimalys. Removing the token from its own assistant configuration stops it being sent, and revoking the grant inside e-conomic ends access at the source. The second step is authoritative and takes effect immediately, with no action required by Cimalys and no way for Cimalys to prevent or delay it.

Where an engagement involves Cimalys holding the controller's data outside a pass-through connector, for example material the controller loads into a system Cimalys operates for it, Cimalys deletes or returns that data and deletes existing copies on termination or on written request, unless EU or Danish law requires retention.

This agreement is subject to the liability terms of the services agreement between the parties and is governed by Danish law. Where this agreement and the services agreement conflict on the processing of personal data, this agreement prevails. Exclusive venue is the courts of Copenhagen, Denmark.

Data protection enquiries: hello@cimalys.com. For a countersigned copy of this agreement for your records, request one at the same address.