Data processing agreement

This agreement governs Integravizija’s processing of personal data contained in documents you upload when you use the Apskaita5 invoice-scanner add-on. It is incorporated by reference into the terms of service (Article 28(3) GDPR). The Lithuanian text prevails if it conflicts with this English translation.

1. Parties and roles

MB „Integra vizija“ (trading as “Integravizija”), company code 306998587, registered office V. Krėvės pr. 80B-37, LT-50385 Kaunas, the Republic of Lithuania. Registered in the Register of Legal Entities of the Republic of Lithuania. Email: info@integravizija.lt. Phone: +370 699 52662. The seller is not a VAT-registered person and has no VAT ID.

The customer (you) is the controller of personal data contained in the documents you upload, including where you act for your own clients (for example, an accountant processing clients’ supplier invoices). For that data we act only as a processor, on your documented instructions. For account, licence and billing data we remain a separate controller under our privacy policy.

2. Subject-matter and duration

The subject-matter is the invoice-scanner add-on: extraction of structured data from supplier-invoice files you upload through the authenticated API. The agreement applies for the duration of your licence or subscription to the add-on and ends when that licence or your account ends.

3. Nature and purpose of processing

You upload a supplier-invoice file (PDF, JPG or PNG, max 10 MB) over TLS from the add-on. We transmit the file to Mistral AI, which extracts the invoice fields in the European Union under zero data retention; we return the extracted data to your Apskaita5 installation. The file and its content are processed in memory only, for the sole purpose of producing the extraction, and are not written to our storage or databases.

4. Categories of data and data subjects

Categories of personal data: the content of the invoice documents you upload and of the data extracted from them — supplier names, addresses, phone numbers and email addresses of natural persons where present, personal data of sole traders, amounts, dates and line-item descriptions.

This agreement covers only that content. Operational scan metadata (file size, file type, model identifier, processing time, timestamp, account identifier) is outside this agreement: we process it as a separate controller under our privacy policy, for security, quota enforcement and abuse prevention (legitimate interests).

Categories of data subjects: persons identifiable in the documents you upload, such as supplier contact persons and sole traders, and your own clients where you act for them.

5. Processor obligations

We process the data only on your documented instructions (this agreement and the add-on’s functionality), and inform you if an instruction appears to infringe GDPR. Persons authorised to process the data are bound by confidentiality. We implement appropriate technical and organisational measures under Article 32 GDPR, including TLS transport, per-account token authentication, per-IP rate limiting, a file-size cap, and the exclusion of document content from persistence.

6. Sub-processors

We engage these sub-processors for the invoice-scanner service: Mistral AI, SAS (AI extraction, hosted in the European Union, zero data retention — inputs and outputs are not retained once the response has been returned); Amazon Web Services, eu-north-1 region (hosting). By this agreement you give a general written authorisation (Article 28(2) GDPR) for the sub-processors listed here.

With each sub-processor we conclude a written contract requiring it to comply with data-protection obligations substantially the same as those set out in this agreement (Article 28(4) GDPR). We will notify you of intended changes to sub-processors in advance, giving you the opportunity to object; if the objection cannot be resolved, you may terminate the invoice-scanner service without penalty. Where a sub-processor fails to fulfil its data-protection obligations, we remain liable for that failure.

7. Rights assistance and transfers

We assist you, so far as possible, in responding to data-subject requests concerning uploaded documents, and in ensuring compliance with Articles 32–36 GDPR.

Uploaded-document content is processed on infrastructure hosted in the European Union: extraction runs on Mistral AI’s EU-hosted API under zero data retention, and our hosting is in the eu-north-1 region. Under our agreement with Mistral AI all data is hosted in Europe; if in exceptional circumstances data were processed outside the European Union, we ensure appropriate safeguards under Article 46 GDPR so that the processing complies with the GDPR. We make available to you all information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, on reasonable notice.

8. Personal data breaches

We notify you of a personal data breach affecting data processed under this agreement without undue delay after becoming aware of it (Article 33(2) GDPR), so that you can meet your obligations under Article 33(1) GDPR.

9. Return and deletion

When the processing ends, at your choice we delete the uploaded-document content and the data extracted from it, or return it to you, and delete existing copies, unless the law requires us to keep them. In practice there is usually nothing to return or delete: neither we nor Mistral AI retain the document content (zero data retention — inputs and outputs are not retained once the response has been returned).

10. Conclusion of the agreement

This agreement is concluded in electronic form and becomes binding when you start using the invoice-scanner add-on. A countersigned copy is available on request at info@integravizija.lt.