This agreement forms part of the Terms of Service between the customer identified in the account or order (“Customer”) and Self Software Systems SIA, registration number 40203713044, Anniņmuižas bulvāris 19–38, Rīga, LV-1067, Latvia (“SelfSIA”). It applies when SelfSIA processes personal data on the Customer's behalf to supply the agreed service (“Customer Data”). GDPR terms have their meanings under Regulation (EU) 2016/679.

The Customer is the controller, or a processor acting with its controller's authority; SelfSIA is respectively a processor or subprocessor. The Customer determines its processing purposes, lawful basis, required notices and authorised instructions. SelfSIA acts as a separate controller for its own account administration, billing, security and legal-compliance purposes described in the Privacy Policy. Actual processing purposes determine each role.

This agreement prevails over conflicting general terms on Customer Data processing. Applicable transfer clauses and mandatory law prevail over it. The Terms' liability provisions apply between the parties only to the extent lawful. They do not restrict data subjects' statutory compensation or other rights, regulatory powers or any liability expressly preserved in section 13 of the Terms.

The subject matter is the financial administration service the Customer selects. Processing lasts for the service relationship and the necessary return or deletion period, with restricted retention only where law requires. Operations include collection, storage, organisation, retrieval, extraction, classification, calculation, transmission, support, export and deletion of the records needed for enabled features.

Data subjects may include the Customer's users, employees, directors, beneficial owners, contractors, customers, suppliers and payment counterparties. Data may include names and contact details, company and identity identifiers, account and transaction references, invoice and receipt contents, payroll and tax records, documents, prompts, outputs and related activity records. The Customer controls the records and integrations supplied. Do not submit special-category data or criminal-offence data unless separately agreed with suitable safeguards and a lawful basis.

The contract, enabled settings, authorised use of features and written support instructions document the Customer's instructions. SelfSIA will process only on those instructions, including for transfers, unless Union or Member State law requires otherwise; we will notify the Customer of that requirement beforehand unless legally prohibited. We will promptly flag an instruction we consider contrary to data-protection law and may suspend that instruction while the parties resolve it.

The Customer's service instructions do not authorise sale of Customer Data, advertising use or training of general-purpose AI models for unrelated purposes. Any new purpose requires its own lawful basis and appropriate agreement; it cannot be introduced merely by changing an internal setting or appointing a vendor.

SelfSIA will restrict access to authorised persons who need it for the service and are bound by confidentiality duties. We will apply measures appropriate to the nature of processing and the risk to individuals and review their effectiveness. Our service security commitments include:

• Authenticated access, workspace-level access checks and role-based permissions for customer records.
• Encrypted storage of supported integration credentials and sensitive authentication fields; encrypted transport for service connections.
• Availability of authenticator-based two-factor authentication and recovery codes; Customers manage enrollment and user access.
• Validation and access controls on supported uploads, document previews and integration requests.
• Operational logging and investigation of security incidents, with access to logs restricted to authorised personnel.
• Backup and restoration arrangements appropriate to the deployed service, and review and testing of security and recovery measures proportionate to risk.

On request, we will provide information about the measures and recovery arrangements relevant to the Customer's service, subject to protection of confidential security information. Changes must not materially reduce the agreed overall level of protection.

The Customer gives general written authorisation for disclosed subprocessors used for the agreed service, subject to this section. The service-provider information identifies service functions. Before using a subprocessor for Customer Data, SelfSIA will disclose its contracting identity, function, processing locations and applicable transfer safeguards and ensure sufficient guarantees and a written agreement imposing the relevant data-protection obligations. A software library or gateway name alone does not authorise undisclosed downstream providers.

We will notify the Customer's account contact of a proposed addition or replacement at least 30 days before it receives Customer Data, giving an opportunity to object on reasonable data-protection grounds. We will work to resolve an objection through safeguards or a suitable alternative. If unresolved before the proposed use, the affected processing will not be transferred over that objection; either party may end the affected service, and we will refund unused prepaid fees for it. An urgent replacement needs specific authorisation if the notice period cannot be observed.

SelfSIA remains responsible to the Customer for its subprocessors' performance of their data-protection obligations. Independent services the Customer contracts with directly are not automatically our subprocessors; their actual role and the relevant data flow determine the obligations.

Taking account of the processing and information available, we will assist the Customer with data-subject requests, security obligations, breach notifications, data-protection impact assessments and prior consultation with supervisory authorities. We will forward a request relating to Customer Data promptly and not decide it on the Customer's behalf unless instructed or legally required.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. Our initial notice will give available information about the incident, affected records and individuals, likely consequences, measures taken or proposed, and a contact for follow-up. We will provide further information as it becomes available, preserve relevant evidence and cooperate in containment and remediation. The Customer decides its controller notifications; this does not remove our independent legal obligations.

Transfers and remote access requiring safeguards under GDPR Chapter V will take place only on documented instructions and with an applicable adequacy decision, appropriate contractual safeguards such as the relevant European Commission Standard Contractual Clauses, or another lawful mechanism. We will assess and adopt supplementary measures where necessary. The Customer may request details and a copy of relevant safeguards, with confidential information appropriately protected. This agreement does not itself assert that any particular deployment or vendor is restricted to the EEA.

At the end of processing, the Customer may choose return or deletion of Customer Data, subject to legally required storage. The Terms provide a 30-day opportunity to request support-assisted return after termination, without reducing mandatory retrieval rights. We will preserve data for a timely return request and then delete remaining copies unless the Customer lawfully instructs otherwise or storage is legally required. An instruction for earlier deletion will be handled without undue delay after verifying authority and applicable retention obligations.

The required scope of deletion includes active records, stored documents and instructed deletion by subprocessors. Return and deletion requests are handled through support and may require manual steps and coordination with providers. Isolated backup copies will be protected, excluded from ordinary use and removed through their applicable retention cycle; if restored, pending deletion instructions must be reapplied. We will explain any legally required retention, its basis and duration or determining criteria, and restrict processing to that purpose. On request, we will report the actual scope and status of work, distinguishing completed deletion from outstanding provider actions, protected copies awaiting expiry and required legal retention.

SelfSIA's own billing and contract evidence may be retained under its controller obligations and Privacy Policy. A Customer's duty to preserve its accounting records is not automatically a legal obligation requiring SelfSIA to retain all Customer Data after instructions to delete.

We will provide information reasonably needed to demonstrate compliance with this agreement and permit and contribute to audits, including inspections, by the Customer or an independent auditor it appoints. The parties will arrange reasonable notice, scope, confidentiality and protection for other customers; these arrangements must not obstruct an audit needed after an incident, on reasonable evidence of non-compliance or by a competent authority. Available documentation may be reviewed first where appropriate.

Any reasonable charges for additional assistance must be agreed in advance and must not obstruct statutory rights or charge the Customer for remedying our own breach. The parties will keep required processing records and cooperate with competent authorities. Send instructions, audit requests, objections or privacy questions to [email protected].

The services below support SelfSIA features. Which services receive data depends on the features and connections used. Service names identify the product or provider; they do not establish a particular contracting legal entity, processing location, vendor retention setting or transfer mechanism. The relevant particulars must be established for the applicable deployment under the Data Processing Agreement.

This page does not authorise unnamed downstream AI providers or assert that every listed service is a subprocessor. A provider may process data for our own controller purposes, act on customer instructions, or be an independent service you connect. Contact [email protected] for the information applicable to your service.

AI requests can be routed through the SelfSIA-operated gateway to a model provider. LiteLLM is gateway software; its name does not identify the receiving model provider. Any downstream provider receiving Customer Data must be identified and covered by the Data Processing Agreement's subprocessor and transfer requirements before that processing.

Supported features can connect to Stripe for billing or connected merchant accounts; Catego or Aiia for banking data; Google or Microsoft for sign-in or connected mailboxes; Shopify for commerce records; and Telegram, WhatsApp or Slack for messaging. Identity and authority connections can include eParaksts, Smart-ID and the Latvian State Revenue Service (VID). Data sent depends on the particular authorisation and operation. These providers' own notices and terms may apply where they act independently.

Optional website analytics and campaign providers are described in the Cookie Policy. That consent process is separate from instructions to process bookkeeping records.

Customer-directed processing requires disclosure of the relevant contracting entity, function, locations and transfer safeguards and the required written processing terms. The service-name inventory above does not by itself establish that those contractual or deployment particulars have been verified. Proposed subprocessor additions or replacements follow the notice and objection procedure in the Data Processing Agreement. A listing here is not a certification, a guarantee of EEA-only processing or a statement that a particular vendor training or deletion setting has been verified.