Data Processing Agreement

3.1 Nature and Purpose of Processing

PayMatch processes Personal Data for the following purposes:

• Providing invoice management and QR-bill generation services
• Payment reconciliation
• Customer and product management
• Subscription billing and account management
• Platform maintenance and support
• Security monitoring and fraud prevention

3.2 Types of Personal Data

• Contact information (names, email addresses, phone numbers)
• Business information (company names, addresses, VAT numbers)
• Financial data (invoice amounts, payment records)
• Bank account information (IBAN, transaction history - if connected)
• User credentials (email, encrypted passwords)
• Technical data (IP addresses, device information, usage logs)

3.3 Categories of Data Subjects

• Customer's employees and authorized users
• Customer's business clients and customers
• Customer's suppliers and vendors
• Customer's business contacts

3.4 Duration of Processing

Personal Data will be processed for the duration of the service agreement and retained according to the retention periods specified in our Privacy Policy (generally 10 years for business records as required by Swiss commercial law).

4.1 Processing Instructions

PayMatch will process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. The provision of services as described in the Terms and Conditions constitutes the Controller's complete instructions.

4.2 Confidentiality

PayMatch ensures that all persons authorized to process Personal Data are bound by confidentiality obligations and receive appropriate training on data protection requirements.

4.3 Security Measures

PayMatch implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls and authentication (including MFA support)
• Regular security assessments and vulnerability testing
• Automated backup and disaster recovery procedures
• Security monitoring and incident detection systems
• Regular security patches and updates
• Physical security of data centers (via certified hosting providers)
• Network security measures (firewalls, DDoS protection)

4.4 Data Breach Notification

In the event of a Personal Data breach, PayMatch will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include:

• Nature of the breach and categories of data affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact point for further information

4.5 Data Subject Rights

PayMatch will, to the extent legally permitted, promptly notify the Controller of any requests from data subjects. PayMatch will assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) by providing appropriate technical and organizational measures.

4.6 Data Protection Impact Assessment

PayMatch will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) where required by applicable law, by providing information about the processing activities and security measures.

4.7 Deletion and Return of Data

Upon termination of services, PayMatch will, at the Controller's choice, delete or return all Personal Data to the Controller and delete existing copies (except where retention is required by law). Personal Data can be exported in machine-readable format (JSON/CSV).

4.8 Audit Rights

PayMatch will make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, by the Controller or an independent auditor. Such audits will be conducted upon reasonable notice and during business hours, no more than once per year unless required by a data breach or regulatory requirement.

5.1 General Authorization

The Controller provides general authorization for PayMatch to engage Sub-Processors. PayMatch will ensure that Sub-Processors are bound by data protection obligations equivalent to those in this DPA.

5.2 Current Sub-Processors

PayMatch currently uses the following Sub-Processors:

5.3 Changes to Sub-Processors

PayMatch will inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors at least 30 days in advance. The Controller may object to such changes on reasonable grounds relating to data protection. If the Controller objects, PayMatch will either not proceed with the change or the Controller may terminate the affected services.

5.4 Sub-Processor Liability

PayMatch remains fully liable to the Controller for the performance of Sub-Processor obligations under this DPA.