Data Processing Agreement

1. Parties, roles and relation to the Terms

This agreement (the “Agreement”) is an annex to the Terms and Conditions and forms part of them; the definitions in the Terms apply here too. It is concluded between you - the company on whose behalf you use the Service (“you”, the controller) - and “FreeMe” OOD (FreeMe.bg), company ID (EIK) 123432567, Sofia, Sofia Business Park 9 (“we”, the processor). Under Art. 28 of Regulation (EU) 2016/679 (GDPR) it governs how we process, on your behalf, the personal data you enter or upload in the Service.

Roles. For the personal data of your employees, owners, managers, customers and suppliers and of other individuals whose data is in your documents, you determine the purposes and means of processing: you are the controller and we are the processor. For your account data and for the website we are the controller - see the Privacy Policy.

You accept the Agreement together with the Terms when you create a company in the App. We record the acceptance - who, on behalf of which company, which version and when. Whoever accepts on behalf of a company declares that they are entitled to bind it.

Filing with the NRA. When we keep your books and file your returns with the NRA as your representative under a power of attorney, we process the data on your behalf and on your instruction - for that part you are the controller and we are the processor. Responsibility for the accuracy and completeness of the data and documents is as set out in the Terms (sections 6–8).

When we are an independent controller. For processing we carry out on our own legal basis, we determine the purposes and means ourselves and are an independent controller; this Agreement does not apply to it, the Privacy Policy does. This covers: (a) our own accounting and tax records (for example our invoices to you and the payments on them); (b) our obligations as an obliged entity under Art. 4(13) of the Bulgarian Measures against Money Laundering Act - for example customer due diligence and keeping the information collected; (c) answers to requests addressed to us by competent authorities; (d) the records we keep to prove performance of the contract and to defend our rights in a dispute or an inspection - for example the acceptance of the Terms, the completeness declarations and the correspondence about missing data. The legal basis is a legal obligation or a legitimate interest (Art. 6(1)(c) and (f) GDPR). We use this data only for the purpose concerned.

2. Subject matter and duration

The subject matter of the Agreement is the processing of personal data that is necessary to provide the Service under the Terms. It takes effect when accepted and applies for as long as we process data on your behalf - for the term of the contract under the Terms and afterwards until the data is returned or deleted under section 14.

3. Nature and purpose of the processing

Nature: storing, organising and reading the data; automatic recognition of documents with artificial intelligence and review by an accountant; bookkeeping; preparing and filing returns and reports under a power of attorney (VAT, social-security, annual closing); calculating pay, contributions and taxes, preparing payslips and payrolls and filing notifications under Art. 62 of the Labour Code (with the Payroll module); communicating with you in the support chat and by email; export and deletion.

Purpose: solely providing the Service under the Terms, including protecting it (security, abuse prevention) and meeting legal obligations. We do not use the data for our own purposes, do not sell it, do not use it for advertising and do not use it to train models.

4. Categories of data and data subjects

Data subjects

• your company’s employees;
• owners, managers and representatives;
• customers and suppliers, to the extent they are individuals or people behind a company (for example a sole trader);
• other counterparties and individuals whose data is in the documents you give us;
• the people you invite as viewers in the App.

Categories of data

• Identification and contact: names, national ID number (ЕГН/ЛНЧ), ID-document details, address, phone, email.
• Employment and social-security data: data from employment, management and civil contracts, salaries, insurance contributions and registrations, absences and leave, length of service and insurance, deductions and garnishments.
• Bank data: bank account numbers (IBAN), bank statements, payments.
• Business documents: invoices, receipts, contracts and correspondence, together with the personal data they contain.

We do not need to receive special categories of data under Art. 9 GDPR; enter sensitive data only in the fields intended for it (see the Terms, section 6). Some payroll documents (for example sick-leave certificates), however, contain health data. If you give them to us, we process them only as far as needed to calculate salaries and benefits and to file data with the NOI and the NRA, and only by the accountants who work on payroll. Upload only what is needed for that purpose. You, as the controller, are responsible for having a condition for processing them under Art. 9(2) GDPR (usually the performance of employment and social-security obligations). We do not use this data for any other purpose and do not use it to train models.

5. Instructions

We process the data only on your documented instructions. The Terms, the Agreement and the way you use the Service’s features are your complete instructions. You send additional instructions to us in writing at [email protected]; we carry them out to the extent they are reasonable and compatible with the Service.

If, in our view, an instruction infringes the GDPR or other data-protection law, we will tell you immediately. If the law requires us to process data in another way (for example to retain it under accounting law), we will tell you before the processing, unless the law prohibits it.

6. Confidentiality of staff

The people who have access to the personal data - our accountants and other staff - are bound by a duty of confidentiality and have access only as far as their work requires. How our staff open your company is described in section 7.

7. Technical and organisational measures

We apply appropriate technical and organisational measures under Art. 32 GDPR. In short (details and the current status are on the Security page):

• The App, the database and your documents run on Amazon Web Services, Ireland region (EU).
• Communication with the App is over an encrypted connection (HTTPS/TLS); the database and the document storage are also encrypted at rest.
• Sign-in with a Google account or an emailed code, with no passwords of our own; the session expires automatically after a period of inactivity.
• Every request to the server is checked to confirm that it belongs to your company, so no customer sees another’s data; every change in the accounting is recorded - who, when and what.
• Access by our accountants: they have no account of their own in the App; they open your company only from our internal console, with a one-time key valid for 60 seconds; every session is recorded and expires automatically after 2 hours; every change is recorded with their name in the audit trail.
• The database is backed up automatically every day, with point-in-time recovery; documents are kept in versions.

We build our processes on the ISO/IEC 27001 standard and are in the process of certification; we do not yet hold a certificate. We may update the measures but will not lower the overall level of protection.

8. Sub-processors

You give us general authorisation to use the providers in the list below as sub-processors. It is the same as the App list in the Privacy Policy - both pages take it from one source. The sub-processors related only to the Site are listed in the Privacy Policy.

With each sub-processor we have a contract with essentially the same data-protection obligations as in the Agreement (Art. 28(4) GDPR), and we remain liable to you for their performance.

9. Changes to sub-processors

When we add or replace a sub-processor, we email you at least 30 days before the change and update the list in section 8. You can object in writing at [email protected] within that period if you have reasonable data-protection grounds. We will look for a solution together; if we cannot agree, you can terminate the contract under section 10 of the Terms before the change takes effect.

10. Transfers outside the EEA

Data in the App is stored in the EU (AWS, Ireland). Some sub-processors - in particular the artificial-intelligence and email providers - may process data outside the EEA, mostly in the US. Transfers take place only on a basis under Chapter V GDPR: standard contractual clauses (SCC) and/or the EU–US Data Privacy Framework where the provider is certified. The basis for each provider is in the table in section 8.

11. Personal-data breaches

If we establish a personal-data breach affecting your data, we notify you without undue delay and aim to do so within 48 hours of establishing it. The 48 hours is a target, not a guarantee: what matters is that we do not delay without reason, and the time needed to check whether a breach has really occurred and which data it affects does not count. We write to the email of the manager’s account and, where needed, through a notification in the App; you keep these contact details up to date.

The notice contains, as far as we know: what happened; which categories of data and approximately how many records and people are affected; the likely consequences; what we have done and propose to do; a contact for questions. We may supplement it in stages as we learn more. The notice is not an admission of fault or liability.

You, as the controller, decide whether to notify the CPDP (within 72 hours under Art. 33 GDPR) and the affected individuals, and you notify them yourself; we do not notify authorities or affected individuals about your data unless the law requires us to. We give you the information needed for that and reasonable assistance; assistance beyond the ordinary is charged as additional work.

12. Assistance

• Data-subject requests (Art. 15–22 GDPR). If an individual contacts us about data we process on your behalf, we will refer them to you and will not answer on the substance without your instruction. You have access to your data in the App and, where needed, on your instruction we locate, correct, export or delete it.
• Art. 32–36 GDPR. We assist you with the security of processing (section 7), breach notification (section 11), data protection impact assessments and prior consultation with the supervisory authority, by giving you the information about the processing that we have.
• Demonstrating compliance - as set out in section 13.

13. Audits

We give you the information needed to demonstrate that we comply with our obligations under Art. 28 GDPR, and we allow audits, including inspections, by you or by an auditor you appoint. The procedure is as follows:

• Documents first. We first answer your questions in writing and give you the documents we have - a description of our security measures, audit reports and certifications of our sub-processors, and summaries of our own checks. If that is sufficient, no on-site audit is needed.
• Frequency. Up to one audit every 12 months. More often only after a confirmed personal-data breach affecting your data, or if a supervisory authority requires an audit.
• Procedure. A written request to [email protected] at least 30 days in advance, stating the scope, the schedule and the name of the auditor. The audit takes place during our working hours, lasts at most 2 working days and covers only our performance of this agreement in relation to your data.
• Auditor. An independent professional who is not our competitor and who signs a confidentiality undertaking. The audit must not compromise our security or operations or the confidentiality of other customers’ data; we do not give access to other customers’ data, source code, or information whose disclosure would reduce our security.
• Costs. You bear your own costs and those of the auditor. We charge our time and costs for the audit (above 4 hours of preparation and assistance) at the price for additional work in the pricing section or at a price notified in advance. If the audit finds a material breach of this agreement by us, our reasonable costs for it are not charged.
• Outcome. The report is confidential and used only to verify compliance. We resolve the findings together within a reasonable time.

14. End of processing: return and deletion

As in section 11 of the Terms, within 30 days after termination you receive a machine-readable export of the company’s data, a PDF archive of the accounting and documents (including the payrolls, payslips and payroll declarations, if you used the Payroll module), and a handover protocol (приемо-предавателен протокол) for your next accountant.

After that we delete the personal data we process on your behalf, except records we are required to keep under accounting and tax law - for periods from 3 and 10 up to 50 years depending on the document type (see the retention periods in the Privacy Policy). While we keep them, we use them only for that obligation and protect them with the measures in section 7. On your request we confirm the deletion in writing.

Backups. Automatic database backups are kept for at most 35 days and serve only to restore the system after a failure; we do not use them for any other purpose and do not search them for individual data. Deleted data disappears from them when that period expires. If we have to restore a system from a backup, we delete again the data that was deleted in the meantime. Backups of the documents we are required to keep by law follow the periods above.

15. Liability, precedence and governing law

Liability between us under this agreement is governed by section 15 of the Terms, and the limit there also applies to it: our total liability under the Terms and under this agreement together does not exceed one overall cap, not two separate ones. Each party is liable for its own part of the damage under Art. 82 GDPR; you are responsible for the lawfulness of your instructions and of the data you give us, and you indemnify us against Art. 82 GDPR claims caused by them, as set out in section 15 of the Terms. All of this applies to the extent the law allows it to be agreed between us. It does not affect data subjects’ rights under the GDPR or the powers of supervisory authorities.

In case of conflict about the processing of personal data, the Agreement prevails over the Terms (section 14 of the Terms). Bulgarian law applies; disputes are resolved as set out in section 17 of the Terms. Changes are made as set out in section 16 of the Terms, and for sub-processors under section 9.

Version history

• Version 2 (effective from 27 November 2026) - processing for the Payroll module (section 3) and the categories of employment data (section 4).
• Version 1 (effective from 15 October 2026) - first version of the data processing agreement.

The Bulgarian version of this document is legally binding.