Data processing agreement

This agreement governs the processing of personal data that Dodana vrijednost d.o.o. carries out for a client of the Puls service. It is concluded under Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation, referred to below as the GDPR. If your company uses Puls, your company is the controller and we are the processor who processes the data on your instructions.

1. The parties

The controller is the client of the Puls service, the legal person that opened a workspace in the application and that decides on the purposes and means of processing the data it enters into Puls.

The processor is Dodana vrijednost d.o.o., Ribnjak 56, 10000 Zagreb, Croatia, company identification number (OIB) 28795267248, registered in the court register of the Commercial Court in Zagreb. The address for data protection questions is info@puls-value.com.

The processor processes personal data solely on behalf of the controller and has no right to decide on the purposes of the processing.

2. Subject matter and duration

The subject matter of this agreement is the processing of personal data necessary to deliver the Puls service as that service is described in the Terms of use.

The processing lasts for as long as the Puls subscription lasts. That includes the trial period and any period in which access to the workspace is locked while the user account still exists. When the service ends, Article 13 of this agreement applies.

3. Nature and purpose of the processing

The purpose of the processing is the delivery of the Puls service. That covers the hosting and processing of the controller's financial figures, users and documents in order to present the plan and the result, the indicators, the cost structure, the monthly commentary and the business plan document, and in order to run user accounts, charge the subscription and provide technical support.

When the controller connects its books through e-Računi or imports a list of open items, the processor uses those open items to build the debt ageing by customer and supplier down to the document level and a list of customers who are late in paying, for reminders. With the e-Računi connection it also uses the same items to build a list of the largest customers and suppliers for the bank package, and an overview of commitments and expected inflows falling due in the next 14 days, which holds a total per day and per type of commitment and the names of the largest customers and suppliers.

The processing operations are collection, recording, storage, access, calculation, presentation, export at the user's request, backup and deletion.

The processor does not use the controller's data for its own purposes, does not sell it and does not use it for profiling.

4. Types of personal data

• Names and business e-mail addresses of the workspace users.
• Sign-in data and access records.
• Company and billing data, including the company name, address, identification number and details of the invoices issued.
• Personal data that may appear in ledger line descriptions, in the names of business partners and in the employee count.
• The names of at most the ten largest customers and the ten largest suppliers per year, with turnover, open balance and ageing, for the current and the previous year. They may include sole traders and other natural persons. Only the name is kept, without the partner code or tax number, and only the latest reading.
• The names of the controller's customers and suppliers with their open items, from the e-Računi connection or from a list of open items that the controller imports. They may include sole traders and other natural persons. Only the name is kept, without the partner code or tax number, and only the latest reading.
• The e-mail addresses of customers to which a user sends a reminder, and the record of sending.
• The content of documents and files that the controller uploads to Puls or composes inside Puls.
• The questions a user types into the AI consultant and the consultant's answers. Only the user who asked can see the conversation, and it may contain the company's financial data and personal data the user types. Deletion periods are set out in section 13.

5. Categories of data subjects

• Users of the controller's workspace.
• Employees of the controller.
• Customers, suppliers and other business partners named in the ledger.
• Persons named in documents the controller uploads to Puls or draws up in Puls.

6. Documented instructions

The processor processes personal data only on the documented instructions of the controller. Instructions means this agreement, the Terms of use and every action a user starts inside the application, for example a data import, building a plan, requesting a commentary or an export. The instructions also cover any transfer of personal data to a third country or to an international organisation, which is permitted only where this agreement provides for it or where European Union law or Croatian law requires it.

If European Union law or Croatian law requires the processor to process data beyond those instructions, the processor informs the controller before the processing takes place, unless that law expressly prohibits such notice.

The processor informs the controller immediately if it considers that an instruction infringes the GDPR or another data protection law.

7. Confidentiality

Only persons who need access in order to do their work have access to the controller's data. Every such person is bound to confidentiality by contract or by a statutory duty, and that duty continues after their engagement ends.

8. Security of processing under Article 32 of the GDPR

The processor applies the following technical and organisational measures.

• All traffic between the browser and the application runs over an encrypted connection (TLS).
• The data of each company is separated so that one workspace cannot see the data of another, and only the user who asked can see a conversation with the AI consultant.
• Passwords are stored in a form that cannot be read back. Access tokens for connected services are stored encrypted.
• Data is stored and processed on servers inside the European Union.
• The database has regular automatic backups and a documented restore procedure.
• Sign-ins and data access are written to logs kept separately from that data.
• The least privilege rule applies. Every person and every component of the system receives only the rights that the work at hand requires.
• Access to the servers is restricted to authorised persons and protected.
• Development is separated from production and does not touch production data. The systems receive security updates regularly.

9. Sub-processors

The controller gives a general prior authorisation for the engagement of sub-processors. The list of sub-processors engaged on the date of this version of the agreement is set out in Annex 1.

With every sub-processor the processor agrees data protection obligations that are no weaker than the obligations in this agreement, and the processor remains liable to the controller for the work of a sub-processor as for its own.

The processor gives the controller at least 30 days notice of an intention to add or replace a sub-processor, by e-mail to the workspace owner and by publishing the amended Annex 1 on this page. Within that period the controller may raise a reasoned objection. If the objection remains unresolved, the controller may cancel the subscription before the change takes effect, and access remains active until the end of the paid period.

10. Transfers outside the European Economic Area

The data is processed in the European Union. A transfer to a third country takes place only to the sub-processors listed in Annex 1 and only under the European Commission standard contractual clauses.

If those measures cease to be sufficient for a transfer, the processor suspends the transfer and informs the controller.

11. Assistance to the controller

Taking into account the nature of the processing, the processor assists the controller by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III of the GDPR, that is requests for access, rectification, erasure, restriction of processing, portability and objection.

If a data subject request reaches the processor directly, the processor forwards it to the controller without delay and does not act on it independently.

The processor also assists the controller in meeting the obligations of Articles 32 to 36 of the GDPR, that is security of processing, breach notification, data protection impact assessment and prior consultation with the supervisory authority, to the extent that the information is available to the processor.

12. Personal data breach

The processor notifies the controller of any personal data breach without undue delay after becoming aware of it, and early enough for the controller to meet its own duty to notify the supervisory authority.

The notice describes the nature of the breach, the approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed and the contact person at the processor from whom further information can be obtained.

The processor keeps a record of breaches and of the measures taken and makes it available to the controller on request.

13. Deletion or return of the data

When the service ends the processor, at the choice of the controller, returns the data in a machine readable form or deletes it, together with any existing copies.

The controller communicates that choice within 30 days of the end of the service. After that period, and at the latest 90 days after the end of the service, the processor deletes the data.

For as long as the user account exists the data remains stored, including while access is locked because the trial period expired or the subscription is unpaid.

Conversations with the AI consultant do not wait for the end of the service. Each message of a conversation is deleted 12 months after it was written, and the user can delete it earlier. Deleting a user account also deletes all of that user's conversations, and the end of a user's access to a company deletes that user's conversations about the company.

The list of the largest customers and suppliers keeps no history. Every synchronisation with e-Računi replaces it with the new reading, and it is deleted together with the rest of the company's data.

The open items of customers and suppliers keep no history. Every new reading, from the e-Računi connection or from an imported list, replaces the previous one, and they are deleted together with the rest of the company's data.

The exception to deletion is data the processor is required by law to retain, above all issued invoices and fiscal records. The processor keeps those until the statutory retention period expires and processes them for no other purpose.

Data held in backups is deleted in the regular rotation cycle of those backups.

14. Audit and inspection

The processor makes available to the controller all information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR and allows for audits, including inspections, conducted by the controller or by an auditor the controller mandates.

An audit is announced at least 30 days in advance, takes place during working hours and in a way that does not disrupt the service. An audit may not reach the data of other clients. The controller bears the cost of the audit, unless the audit establishes a material breach of this agreement.

15. Liability

The liability of the parties is governed by the Puls Terms of use and by mandatory law. This agreement neither widens nor narrows the limitation of liability set out in the Terms of use, except where the GDPR provides otherwise.

16. Governing law

This agreement is governed by the law of the Republic of Croatia and by the GDPR. The competent court in Zagreb has jurisdiction over disputes.

17. Acceptance, changes and version

This agreement applies upon acceptance of the Puls Terms of use. The controller accepts it when opening an account, with a confirmation that states the version date, and we record who accepted which version and when. No separate signature is required and there is no separate signing workflow.

A new version of this agreement is in force from the day of its publication, which is also the version date. We notify the controller of it by e-mail on the same day and by publishing it on this page, and at the first sign-in from that day Puls asks for confirmation of the new version. Notice of a change of sub-processors is governed by section 9.

If a provision of this agreement conflicts with the Terms of use, this agreement prevails in matters of personal data processing.

Version: 6 October 2026. This version extends the description of the processing of open items of customers and suppliers (sections 3, 4 and 13), changes the lists of types of data and of persons (sections 4 and 5) and updates Annex 1. The description of the security measures is now more general, and the measures are the same (section 8). Section 10 on transfers is shorter. The rest of the text is the same as in the version of 5 October 2026. The new version follows a change to the Terms of use, because both documents are accepted together.

Annex 1. List of sub-processors

This list is valid as at the version date of this agreement. Changes are announced under Article 9 of this agreement.