Data Processing Addendum

Last updated: October 23, 2026

This Data Processing Addendum ("DPA") is between Zenthoria LLC, a Wyoming limited liability company, 30 N Gould St STE R, Sheridan, WY 82801, USA, contact contact@zenthoria.tech("Processor," "we"), provider of the Receviona platform (the "Service"), and the organization that accepted the Terms of Service or signed an order form for the Service ("Customer," "Controller"). It forms part of, and is governed by, the Terms of Service (the "Agreement") and applies automatically to a Customer that processes personal data through the Service. If it conflicts with the Agreement on the processing of Personal Data, this DPA prevails. A countersigned copy is available on request at contact@zenthoria.tech.

1. Definitions

Terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679) and, where relevant, the UK GDPR and the Swiss Federal Act on Data Protection ("FADP"). "Applicable Data Protection Law" means those laws and any other data protection law that applies to the processing under the Agreement. "Personal Data" means personal data contained in Customer Data that we process on the Customer's behalf. "Sub-processor" means a third party we engage to process Personal Data. "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

2. Roles and scope

2.1 For Personal Data in the receivables data the Customer uploads or connects (customer records, invoices, payments, and the contact details of the Customer's own debtors and their staff), the Customer is the controller and we are the processor.

2.2 We are an independent controller for account, billing and security-log data about the Customer's users, as described in our Privacy Policy. This DPA does not apply to that processing.

2.3 Annex I describes the subject matter, nature, purpose, duration, data and data subjects of the processing.

3. Our obligations as processor

3.1 Instructions. We process Personal Data only on the Customer's documented instructions: the Agreement, this DPA, and the Customer's use of the Service's features (including its settings, imports and API) are its complete instructions. If we believe an instruction infringes Applicable Data Protection Law we will tell the Customer, and we may suspend that processing until it is clarified. If law requires us to process otherwise we will tell the Customer first, unless the law forbids it.

3.2 Purpose limitation. We use Personal Data only to provide the Service and to meet our obligations under the Agreement. We do not sell Personal Data, and we do not use it to train models made available to other customers.

3.3 Confidentiality. Everyone we authorize to process Personal Data is bound by a duty of confidentiality, and access is limited to what the work requires.

3.4 Security. We implement the technical and organizational measures in Annex II and review them as the Service changes. We may update them provided the overall level of protection is not reduced.

3.5 Assistance. Taking into account the nature of the processing, we help the Customer to: (a) respond to data subject requests — the Service lets the Customer export and delete data itself (Settings → Data & privacy), and we pass on any request we receive about Customer Data without answering it ourselves; (b) meet its security, breach-notification, data-protection-impact-assessment and prior-consultation obligations, with the information available to us. Assistance beyond the Service's built-in tools that takes more than a reasonable effort may be charged at our then-current rates, agreed beforehand.

3.6 AI features. Where the Customer uses AI-assisted features, the relevant data is sent to an AI model provider (Annex III) to produce a response. Output is only ever shown to a user for review; nothing is sent or executed automatically. Figures such as balances, aging and scores are computed by deterministic application code, not by the model.

4. Security Incidents

4.1 We notify the Customer without undue delay and in any case within 72 hours after becoming aware of a Security Incident affecting its Personal Data, at the email address of the organization's Owner and any security contact the Customer has given us.

4.2 The notice describes, as far as known: the nature of the incident and the data and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed. Where information is not yet available we provide it in phases.

4.3 We take reasonable steps to contain and remediate the incident and to help the Customer meet its own notification duties. Our notice is not an admission of fault or liability.

5. Sub-processors

5.1 The Customer gives general authorization for the Sub-processors in Annex III.

5.2 We give the Customer at least 30 days' notice of any addition or replacement (by email to the Owner and by updating Annex III). The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and we will refund prepaid fees for the unused period.

5.3 We bind each Sub-processor to data protection obligations no less protective than this DPA, and remain responsible for their performance.

6. International transfers

6.1 The Service is operated from the United States. The Customer authorizes the transfer of Personal Data to the United States and to the Sub-processors' locations in Annex III.

6.2 For transfers of Personal Data subject to the GDPR to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, which are incorporated by reference, completed as follows:

• Module Two (controller to processor) applies; where the Customer is itself a processor, Module Three;
• Clause 7 (docking clause): included;
• Clause 9(a): Option 2 (general written authorization), with the notice period in section 5.2;
• Clause 11(a): the optional independent dispute-resolution wording is not included;
• Clause 17: Option 1, the law of Ireland; Clause 18(b): the courts of Ireland;
• Annex I.A (parties): as stated above and in the Agreement; Annex I.B: Annex I of this DPA; Annex I.C (competent supervisory authority): the authority of the Member State where the Customer is established or, failing that, where its representative is;
• Annex II: Annex II of this DPA; Annex III: Annex III of this DPA.

6.3 United Kingdom. For transfers subject to the UK GDPR, the parties enter the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), incorporated by reference: Table 1 (parties) as above; Table 2 selects the Standard Contractual Clauses as completed in 6.2; Table 3 (appendix information) is Annexes I–III of this DPA; Table 4: neither party may end the Addendum on a change to the approved addendum.

6.4 Switzerland. For transfers subject to the FADP, the Standard Contractual Clauses apply with these changes: references to the GDPR are to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; "Member State" does not exclude Switzerland, so data subjects in Switzerland may enforce their rights in Switzerland.

6.5 If the Standard Contractual Clauses are replaced or invalidated, or a successor mechanism (including a valid certification of the Processor to the EU–US Data Privacy Framework, should we obtain one) becomes available, the parties will rely on it. In case of conflict, the Standard Contractual Clauses prevail over the rest of this DPA.

7. Audits

7.1 We make available the information needed to show compliance with Art. 28 GDPR — on request, this DPA, our current security overview and any relevant third-party report we hold (for example from our infrastructure providers).

7.2 If that does not reasonably answer the Customer's questions, the Customer may audit our compliance once a year (or after a Security Incident), on at least 30 days' written notice, during business hours, under confidentiality, without access to other customers' data, and so as not to disrupt the Service. The Customer bears the cost of the audit. Audits are conducted by the Customer or an independent auditor bound to confidentiality.

8. Return and deletion

8.1 During the term the Customer can export and delete Customer Data itself in the Service. On termination, we make Customer Data available for export for 30 days, then delete it, and it is removed from backups and from the point-in-time recovery history of our database provider within a further 35 days, on a rolling basis.

8.2 An Owner can delete the whole organization at any time (Settings → Data & privacy); that deletion is immediate and permanent. Afterwards we keep nothing except what law requires, and a log entry of identifiers and counts, without Customer Data, recording that the deletion occurred.

8.3 On request we confirm the deletion in writing.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of the Agreement, except where Applicable Data Protection Law (including the Standard Contractual Clauses) does not permit it.

10. Term and general

10.1 This DPA applies for as long as we process Personal Data for the Customer, including during the export period.

10.2 If any provision is invalid, the rest remains in force. Changes to this DPA are made under the Agreement's amendment clause, except that we may update Annex II and Annex III as set out above and may update this DPA where required by law, with notice.

10.3 Governing law and venue are those of the Agreement, save for the Standard Contractual Clauses, which are governed as stated in section 6.

Annex I — Description of the processing

Annex II — Technical and organizational measures

Access control and authentication

• Role-based permissions scoped to the organization; permissions are checked on every request. An Admin cannot grant or remove the Owner role.
• Passwords are hashed (bcrypt). Optional two-factor authentication (TOTP) with single-use recovery codes, which an Owner may require for every member of the organization; two-factor secrets are encrypted at rest by the application (AES-256-GCM).
• Sessions are revalidated against the database at least every minute: removing or suspending a member, changing a role or resetting a password ends existing sessions. Sessions expire after 12 hours.
• Rate limiting of sign-in per address and per account, with temporary lockout after repeated failures.
• Password-reset, email-verification and invitation links are single-use, time-limited and stored only as hashes.

Tenant isolation

• Every tenant-owned record carries its organization. Data access goes through repositories that require the organization, and a database-client guard rejects queries on those tables that omit it. Isolation is covered by automated tests.

Encryption

• Encryption in transit (TLS) to the Service. Encryption at rest of the database and file storage is provided by our hosting providers (Annex III). Credentials for connected accounting software are additionally encrypted by the application (AES-256-GCM).

Integrity and audit

• Security-relevant and data-changing actions are written to an audit log that the product does not let users edit. Financial figures are computed by deterministic code; AI output is advisory and is never executed automatically — human approval is a state in the data model.

Availability and resilience

• Managed database with point-in-time recovery (operated by our database provider; the retention window is set by our plan); database migrations are applied automatically on deployment with a guard against destructive changes; rate limits on expensive operations.

Data subject rights and deletion

• Self-service export (organization and personal) and deletion (user and organization), as in section 8.

Organizational

• Access to production systems is limited to the people who operate the Service. Secrets are held in the hosting provider's encrypted environment variables, not in the source repository. Security Incidents are handled under section 4.

Annex III — Sub-processors

Each Sub-processor is bound by data processing terms that incorporate the Standard Contractual Clauses where its processing is a restricted transfer.