Service provider
- Legal name
- FARAJ IT SRL
- Tax identifier
- 32687701
- Trade register
- J12/161/2014
- Registered office
- Aleea Padin nr. 32, bl. B2, ap. 43, jud. Cluj, 400557, Cluj-Napoca, RO
- contact@myfactura.ro
- Phone
- +40748547796
Company identity source: ONRC · 2026-10-19. ANAF check: 2026-11-05.
1. Parties and application
This agreement concerns personal data processed through MyFactura on the Client's behalf. The Client is the controller and the Provider identified in the legal information is the processor. Where the Client itself acts as a processor for another organisation, the Provider acts as a subprocessor on the basis of the required authorisation in that chain.
This agreement applies with the service contract and completed annexes covering the parties, operations, security measures, providers and retention. That information and the method of acceptance must be established before processing begins on the Client's behalf. Processing for which the Provider is a controller in its own right is described separately in the privacy policy.
2. Subject matter, nature, purpose and duration
The subject matter is providing the invoicing and document-management functions requested by the Client. Operations may include collection through entry or import, organisation, storage, access, amendment, calculation, document generation, transmission on instruction, export and deletion.
Processing lasts as long as necessary to provide the agreed services and carry out lawful return or deletion instructions on termination, subject to a legal obligation applying to the Provider. Specific periods and backup removal are set in the retention annex; this agreement does not imply unlimited retention.
- Data subjects: the Client's representatives and users, individual customers, partners' contact persons and other individuals whose data lawfully appears in documents.
- Data: names, professional contact details, addresses, tax identifiers where necessary, document and transaction details, banking information and associated metadata.
- Special-category data and criminal conviction or offence data are outside the service's ordinary purpose; their inclusion requires assessment and separately agreed conditions.
3. Instructions and Client responsibilities
The Provider processes data only on the Client's documented instructions, including for international transfers, unless otherwise required by Union or Member State law. In that case it informs the Client of the requirement beforehand where the law permits.
Instructions may arise from the contract, operations initiated by authorised users and documented requests. The Provider immediately informs the Client if, in its opinion, an instruction infringes data protection rules. The Client ensures the legal basis, notices to individuals and authority to provide the relevant data and instructions.
4. Confidentiality and security
Access is limited to persons needing the data for agreed services who are subject to confidentiality commitments or an appropriate statutory obligation. The Provider implements technical and organisational measures appropriate to risk under GDPR Article 32.
The security annex must specify actual measures for access control, separation of client data, authentication and secret protection, communication security, recording relevant operations, backups, restoration and assessment of measure effectiveness. Listing these areas is not a certification and does not replace a description of the agreed measures.
5. Subprocessors and transfers
The Provider uses subprocessors only with the Client's specific or general written authorisation under GDPR Article 28. The completed and accepted register identifies providers, functions, data, locations and relevant safeguards. Merely mentioning a possible service in an information list does not authorise it.
Under general authorisation, the Provider informs the Client before adding or replacing a subprocessor and gives it an effective opportunity to object before the change. Notification and objection procedures are set in the contract, without assuming acceptance through an unannounced list change.
Each subprocessor is contractually bound to at least equivalent data protection obligations for its operations. The Provider remains responsible to the Client for their performance. Transfers outside the EEA require instructions and a valid GDPR Chapter V mechanism, together with the necessary assessment and supplementary measures.
6. Assistance and incidents
Taking account of the nature of processing, the Provider assists the Client with appropriate measures in responding to data subject requests. It does not respond on the Client's behalf without instructions unless legally required, and informs the Client of requests received concerning its data.
The Provider assists the Client with GDPR Articles 32–36 obligations, taking account of the processing and information available: security, incident assessment, impact assessment and prior consultation where required.
The Provider notifies the Client without undue delay after becoming aware of a personal data breach and provides available information on the situation, affected data, consequences and measures, supplementing it as information becomes available. The controller's 72-hour period for any required authority notification is not a waiting period granted to the processor.
7. Return and deletion
When services involving processing end, the Client chooses return or deletion of data and the Provider deletes existing copies, except where Union or Member State law requires retention. Legally retained data is limited to that purpose and appropriately protected.
The return format, verification steps, schedule and backup removal are documented in the applicable annexes. Return must account for originals and relevant metadata, including available XML and tax evidence. The Client remains responsible for its own accounting obligations; this agreement does not promise a legal archiving service for an unagreed period.
8. Information and verification
The Provider makes available the information necessary to demonstrate compliance with GDPR Article 28 and allows for and contributes to audits, including inspections, conducted by the Client or its mandated auditor.
The parties agree reasonable organisational, confidentiality and other-client protection arrangements without rendering verification rights or authorities' powers ineffective. A public policy or general compliance statement does not replace relevant evidence.
9. Annexes and precedence
Annexes must identify the parties and contacts, services and data categories, actual security measures, authorised subprocessors and transfers, retention instructions and termination procedure. Missing information is resolved before using the service for real data on the Client's behalf.
For inconsistencies concerning data protection, this agreement prevails over general terms, and applicable standard contractual clauses for transfers take precedence under their own rules. No provision limits data subjects' rights or supervisory authorities' powers.