W System / Data Processing Agreement

W System Data Processing Agreement

Version 1, effective 20 October 2026.

This Data Processing Agreement ("DPA") forms part of the agreement between W System Hungary Kft., Harmat u. 208., 1108 Budapest, Hungary, company registration number 01-09-470081, EU VAT HU33119856 ("W System", "Processor") and the customer that uses the W System e-invoicing services ("Customer", "Controller"). That agreement is the W System Terms of Service (https://wsystem.dev/terms) and, for live Peppol sending, the W System Peppol mandate and live sending terms (https://wsystem.dev/legal/peppol-mandate-terms) (together, the "Agreement").

1. Definitions

1.1 "GDPR" means Regulation (EU) 2016/679. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR.

1.2 "Services" means the W System e-invoicing services: creating, validating, routing, sending and receiving electronic invoices and related business documents (including through the Peppol network), the related API and MCP access, and support.

1.3 "Sub-processor" means a third party engaged by W System to process Personal Data on behalf of the Customer.

2. Scope and instructions

2.1 This DPA applies to Personal Data that W System processes on behalf of the Customer when providing the Services, mainly Personal Data contained in invoices and business documents the Customer creates, validates, sends or receives through W System.

2.2 W System processes this Personal Data only on the Customer's documented instructions, unless EU or Member State law requires otherwise, in which case W System informs the Customer before processing unless that law forbids it. The Agreement, the Customer's API calls and its use of the Services are the Customer's instructions.

2.3 Purposes: providing e-invoicing through the Peppol network; creating, validating, storing and transmitting electronic invoices and related documents; routing and directory lookups; API access and integration; customer support and account management; compliance with legal obligations.

2.4 Types of Personal Data: business contact details (names, e-mail and postal addresses, telephone numbers); company identifiers (VAT, registration and tax numbers); financial data (invoice amounts, payment details, bank account numbers, IBANs); invoice and document data (dates, line items, descriptions, payment references); account identifiers; and any other Personal Data contained in the documents the Customer processes through the Services.

2.5 Data Subjects: employees and representatives of the Customer and of its business partners; the Customer's customers and suppliers; any other individual whose Personal Data appears in those documents.

2.6 Duration: for as long as W System processes Personal Data for the Customer under the Agreement, and then as set out in section 9.

3. Processor obligations

W System will: (a) process Personal Data only in line with the Customer's instructions and this DPA; (b) make sure that persons authorised to process Personal Data are bound by confidentiality; (c) take the technical and organisational measures in Annex B; (d) help the Customer respond to Data Subject requests under Chapter III GDPR; (e) help the Customer comply with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to W System; (f) at the end of the Services, delete or return the Personal Data as set out in section 9; (g) make available the information needed to demonstrate compliance with this DPA and allow for and contribute to audits under Article 28(3)(h) GDPR, with reasonable notice, under confidentiality and at the Customer's cost; and (h) tell the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law. W System keeps a record of processing activities under Article 30(2) GDPR.

4. Customer obligations

The Customer warrants that it has a lawful basis for the processing and the right to provide the Personal Data to W System, that the Personal Data is accurate to the best of its knowledge, and that it complies with the GDPR and other applicable data protection law. The Customer decides the purposes and means of the processing.

5. Sub-processors

5.1 The Customer gives W System general authorisation to engage Sub-processors. The current list is in Annex A. W System binds each Sub-processor to data protection obligations equivalent to this DPA and remains responsible to the Customer for its Sub-processors.

5.2 W System will inform the Customer by e-mail or by updating Annex A at least 30 days before adding or replacing a Sub-processor. The Customer may object in writing within 30 days of that notice; if the parties cannot resolve the objection, the Customer may end the affected Services. Without an objection within that period, the change is accepted.

5.3 E-invoice BV (Belgium) is W System's Peppol Access Point and Service Metadata Publisher. It processes Personal Data under its own Data Processing Agreement (version 2025-10-29) with W System and uses its own sub-processors, which are listed in Annex A to that agreement and are authorised under this DPA. W System will provide that list on request.

6. Data Subject requests

W System helps the Customer, taking into account the nature of the processing, to respond to requests to exercise the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15 to 18, 20 and 21 GDPR). If W System receives such a request directly, it tells the Customer promptly where the law allows.

7. Personal Data Breaches

7.1 W System notifies the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

7.2 The notice describes, as far as known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned; a contact point for more information; the likely consequences; and the measures taken or proposed to address the breach and limit its effects. W System cooperates with the Customer, helps investigate and remedy the breach, and documents every Personal Data Breach.

8. International transfers

W System hosts the Services in the European Economic Area (Annex A). Where a Sub-processor transfers Personal Data outside the EEA, W System makes sure the transfer is covered by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified recipients), Standard Contractual Clauses approved by the European Commission, or another safeguard or derogation allowed under Chapter V GDPR.

9. Retention, return and deletion

9.1 W System keeps Personal Data only as long as needed to provide the Services or as required by law.

9.2 The Customer can retrieve its documents through the API while its account is active and for one month after the Agreement ends. After that month, W System deletes the Customer's Personal Data, unless EU or Member State law requires W System to keep it, in which case W System tells the Customer and keeps only what is strictly necessary. Backup copies are deleted within a further month.

10. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where the GDPR does not allow them. W System is liable for damage caused by processing only where it has not complied with GDPR obligations specifically directed to processors or has acted outside or against the Customer's lawful instructions. The Customer indemnifies W System against claims arising from the Customer's breach of this DPA or of data protection law, from missing consents or authorisations, or from processing carried out on the Customer's instructions that infringes the law.

11. Confidentiality

W System keeps the Personal Data confidential and discloses it only to Sub-processors under this DPA, where required by law or a court order, or with the Customer's prior written consent.

12. General

12.1 This DPA stays in force as long as W System processes Personal Data for the Customer under the Agreement. If this DPA and the Agreement conflict on data protection, this DPA prevails.

12.2 W System may update this DPA and will give 30 days' notice of material changes by e-mail. If a provision is invalid, the rest stays in force.

12.3 This DPA is governed by Hungarian law. The courts of Budapest, Hungary have exclusive jurisdiction, unless mandatory law provides otherwise. The competent Supervisory Authority for W System is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

12.4 Contact for questions about this DPA or the processing of Personal Data: [email protected].

Annex A: Sub-processors

Sub-processor Service Location of processing Transfer safeguard
E-invoice BV, Zemst, Belgium Peppol Access Point and SMP: sending and receiving documents over Peppol, Peppol registration EU/EEA (its own sub-processors as listed in its DPA, Annex A) EU/EEA company; its own transfers covered by its DPA
Render Services, Inc. API hosting and managed PostgreSQL database EU (Frankfurt, Germany) EEA hosting region; Standard Contractual Clauses in the provider's DPA for any access from outside the EEA
Resend, Inc. Transactional e-mail from wsystem.dev addresses (for example notifications) EU (Ireland) EEA sending region; Standard Contractual Clauses in the provider's DPA for any access from outside the EEA
Cloudflare, Inc. Website hosting, DNS and network security for wsystem.dev Global edge network EU-US Data Privacy Framework and Standard Contractual Clauses in the provider's DPA

The Peppol network is a protocol-based network of certified access points. Documents sent to a receiver go to the receiver's access point under Peppol network rules and the Customer's relationship with that receiver; that access point is not a W System Sub-processor.

Annex B: Technical and organisational measures

Version 1, effective 20 October 2026. SHA-256 of this text: 38440370f6413a6c9510097c19e2a3b9b6943754be6a164321f3079f87df192b. Part of the terms of service and the Peppol mandate terms.