Data Processing Agreement
Updated: 2026-10-04
This agreement is concluded under GDPR Art. 28 and defines how sors, acting as a data processor, processes personal data contained in documents uploaded to the Service on behalf of the Client (the data controller).
1. Parties and their roles
This Data Processing Agreement (hereinafter the DPA) is concluded under GDPR Art. 28 between:
- Data controller - the Client: the organization using the Service and determining the purposes and means of processing personal data contained in document content (the Client acts in its own name and/or in the name of the client companies whose documents are being processed);
- Data processor - UAB Codus (company code 306635689, registered office Sakalaičių Sodų 5-oji g. 6, LT-02216 Vilnius) - sors.
The DPA is accepted at registration together with the Terms of Use and forms an integral part of them.
2. Subject matter, duration, nature and purpose of processing
| Element | Content |
|---|---|
| Subject matter | Provision of the document digitization service: receipt and storage of documents uploaded or sent by email, automatic content recognition and field extraction using AI models, verification against public registries, mapping to accounting codes and export to the Client's accounting systems or files |
| Duration | The term of the service contract and the 30 days after it ends or is terminated, during which the controller can request a data export; for a controller that concluded no service contract - the period of use of the Service and 30 days from its deletion request |
| Nature | Automated processing with the Client's review and confirmation interface (each document is confirmed by the Client's user) |
| Purpose | Performance of the accounting processes of the Client and/or its client companies |
3. Categories of data and data subjects
The following categories of data are processed under this DPA:
- party names and codes: company codes, VAT codes, names and personal codes of self-employed and natural persons, addresses;
- bank accounts (IBAN);
- data of messages carrying documents sent by email: sender email address and name, subject, the original message and attachments;
- document content: dates, numbers, amounts, VAT data, line descriptions and quantities;
- document files and their digital copies.
Data subjects: the counterparties of the Client or its client companies - suppliers and buyers, including self-employed individuals and natural persons named in the documents.
4. Processor obligations (GDPR Art. 28(3))
- process personal data only on the controller's documented instructions, including international transfers; if an instruction appears to infringe the GDPR, inform the controller without delay before carrying it out;
- ensure that persons authorized to process data (employees and other authorized persons) are bound by confidentiality;
- implement appropriate technical and organizational measures (GDPR Art. 32): encryption in transit, tenant-scope data isolation, AES-256-GCM encryption of accounting system keys, role-based access, audit logs and a private document storage whose files are reachable only through a link containing a random, unguessable token - anyone holding the link can open the file; at the controller's instruction the link is embedded in exports to its accounting system; the link stops working when the document is deleted, and because of edge caching the file may remain reachable for up to 24 hours longer (detailed in the Privacy Policy);
- engage sub-processors only under the sub-processor section of this DPA;
- assist the controller in fulfilling data subject rights: provide the necessary information and carry out technical actions within 10 business days of the controller's request;
- assist the controller in carrying out data protection impact assessments and obligations under GDPR Arts. 32-36;
- notify the controller of a personal data breach without undue delay and no later than 72 hours after becoming aware of it, providing available information on the nature of the breach, the data potentially affected and the measures to be taken;
- for 30 days after the service contract ends or is terminated, provide an export of the controller's data at its request (a downloadable archive via a link), and when those 30 days end, delete the controller's documents and data, except data whose retention is required by applicable law and the data described in the master data of legal entities section; data remaining in backups is deleted in the course of backup rotation (no later than within 35 days);
- make available to the controller all information necessary to demonstrate compliance with the GDPR and allow for audits: no more than once a year, with at least 30 days' prior notice, except where an audit is reasonably required by an actual or suspected security breach.
The processor accesses the controller's data only where needed to provide support, fix a fault or keep the Service secure. The processor asks the controller's permission first, except where urgent action is needed to protect security or data integrity or where the law requires it - in those cases the controller is informed afterwards. The processor's staff are bound by confidentiality.
5. Master data of legal entities
The controller acknowledges and instructs that general master data of legal entities extracted from documents (names, codes, VAT codes, addresses, bank accounts) is added to sors's shared counterparty master-data database, which sors runs as a separate data controller under the Privacy Policy. The obligation to delete data at the end of the DPA does not cover this data.
This clause does not apply to data of natural persons (including sole traders): it is never added to the shared database, is processed only under this DPA, is visible only to the controller's organization and is deleted together with the controller's data.
6. Sub-processors (GDPR Art. 28(2) and (4))
The controller grants general written authorization for the processor to engage the sub-processors listed in the Sub-processor list.
The controller is informed of new or changed sub-processors at least 14 days in advance (by updating the list and/or by email), with the right to raise a reasoned objection in writing within that period; if an objection is justified, the parties discuss alternatives (for example, another provider or a different mode of service delivery), and if no solution is found, the controller may terminate the service contract for that reason without contractual penalties.
The processor ensures that sub-processors carry out only those processing activities that this DPA allows the processor itself, and that they are bound by data protection requirements no less protective than those set out in this DPA; the processor remains liable for their performance as for its own actions.
7. International data transfers
The processor may transfer data outside the European Union only on the controller's documented instructions and under the conditions of this DPA. Current transfers: OpenAI (USA) - the provider's DPA and the EU Standard Contractual Clauses (SCCs), with transferred data not used for model training; Cloudflare (USA; document link delivery and receipt of inbound email) - the provider's DPA and the EU-US Data Privacy Framework (DPF); Google and Apple (USA) - the DPF (sign-in identifiers only). All other sub-processors process data within the European Union. The full list is provided in the Sub-processor list.
8. Liability and final provisions
Each party is liable for damage caused by its own breach of GDPR obligations. The processor is liable for damage caused by processing only where it has not complied with obligations of the GDPR directly imposed on processors or where it has acted contrary to the controller's lawful instructions (GDPR Art. 82(2)). Other conditions of liability are set out in the limitation of liability section of the Terms of Use.
The DPA forms part of the Terms of Use; in the event of a conflict regarding the processing of personal data, this DPA prevails. The DPA is amended under the amendment procedure of the Terms of Use. The law of the Republic of Lithuania applies. The DPA is provided in Lithuanian and English; in the event of any discrepancy, the Lithuanian version prevails.