Version 2026-10-14.1 · English original · Applies to customer-controlled personal data (Art. 28 GDPR)
This Agreement applies where a customer of Fier-Cashbook enters personal data of other people into the Service (for example names of persons in reminders or item loans, or notes referring to individuals). For that data the customer is the controller and Fier-Cashbook, Alaimo Aleandro, Grabenstrasse 6, 45888 Gelsenkirchen, Germany (“Processor”), is the processor. For its own account, contract, payment, support and security data the Processor acts as an independent controller under the Privacy Notice; that data is outside this Agreement.
The Processor processes controller personal data only on the controller’s documented instructions, including for transfers to third countries, unless required otherwise by Union or Member State law; in that case the Processor informs the controller before processing, unless the law prohibits it. The Service’s configuration and use by the controller constitute the initial instructions. The controller is responsible for the lawfulness of the data entered and for giving information to data subjects.
Persons authorised to process the data are bound by confidentiality. Access to production systems and data is limited to the operator to the extent necessary for operation, support and security.
Appropriate technical and organisational measures (Art. 32 GDPR) include in particular: encryption of data in transit (TLS); encryption of the TOTP secrets at rest (AES-256-GCM); hashed storage of one-time codes and recovery codes; strict tenant isolation (every query is scoped to the account); signed session cookies (httpOnly, Secure, SameSite=Lax); rate limiting and anti-abuse controls; restricted administrator access; automatic weekly database backups and point-in-time recovery; and security headers (CSP and related).
The controller gives general written authorisation for the sub-processors listed below. The Processor will give at least 30 days’ prior notice of an intended addition or replacement by email or account notice, allowing the controller to object for documented data-protection reasons. If no reasonable solution is possible, the controller may terminate the affected Service before the change takes effect. The Processor imposes materially equivalent data-protection duties on every sub-processor and remains responsible for its obligations.
PayPal processes the Processor’s payment relationship as an independent controller, not as a sub-processor of controller data.
Taking into account the nature of the processing, the Processor assists the controller with appropriate technical and organisational measures, insofar as possible, for the fulfilment of the controller’s obligations to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection) and for the security, breach-notification, impact-assessment and prior-consultation duties under Arts. 32–36 GDPR. The built-in Excel export supports access and portability. Data-subject requests addressed directly to the Processor will be passed on to the controller without undue delay.
The Processor notifies the controller without undue delay after becoming aware of a personal data breach affecting controller data, with the information reasonably available to meet the controller’s Art. 33 obligations.
At the controller’s choice, on termination the Processor returns or deletes controller personal data, unless Union or Member State law requires storage. Deletion follows the documented backup cycles; no blanket indefinite archive is created. The controller can export its register at any time with the built-in Excel export.
The Processor makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the controller or an auditor mandated by it, subject to reasonable notice, confidentiality and the protection of other customers’ data. The security and compliance documentation available in this repository’s operating procedures may be used as a starting point.
This Agreement runs for as long as the Processor processes controller personal data. The liability provisions of the Terms of Service apply, with priority of Art. 82 GDPR. In case of conflict between this Agreement and the Terms regarding controller personal data, this Agreement prevails.