This is a translation for convenience. The German version is legally binding. Read the German version →
Last updated: October 2026
This agreement applies between the customer (controller) and Accountax, owner Eyline Päpke-Jakubowski (processor), for the use of Finqo. It is accepted when the contract is concluded and forms part of the terms.
§ 1 Subject and duration
Provision of the Finqo finance cockpit for the duration of the main contract.
§ 2 Types of data and data subjects
Booking data from DATEV, bank transactions and balances, plan values, user data; data subjects are the customer's business partners and employees as well as users.
§ 3 Instructions
Processing only on the customer's documented instructions; we will point out unlawful instructions.
§ 4 Confidentiality
All staff are bound to confidentiality in writing, including under § 203 StGB.
§ 5 Security
Technical and organisational measures under Art. 32 GDPR as set out in the TOMs annex below.
§ 6 Sub-processors
The service providers listed on /subprozessoren (German) are approved. We announce new ones four weeks in advance; the customer may object for good cause.
§ 7 Third countries
Transfers only with safeguards under Art. 44 et seq. GDPR (adequacy decision or standard contractual clauses).
§ 8 Support
With data subject rights, data protection impact assessments and notification obligations.
§ 9 Data breaches
Notification to the customer without undue delay, at the latest 24 hours after becoming aware.
§ 10 Deletion and return
Deletion within 30 days of the contract ending; on request, the customer receives an export beforehand. If the trial ends without a subscription, the data is deleted after 30 days. Statutory retention obligations remain unaffected.
§ 11 Evidence and audits
Evidence of the TOMs and certificates of the sub-processors; on-site audits with four weeks' notice at the customer's expense.
§ 12 Final provisions
In data protection matters, this agreement takes precedence over other agreements. Changes in text form.
Annex: Technical and organisational measures (TOMs)
| Area | Measures |
|---|---|
| Physical access control | Data centres in Frankfurt am Main with ISO 27001 or SOC 2; office lockable, visitors accompanied |
| System access control | Password policy, two-factor login mandatory for all users, automatic logout when inactive, password manager in the team |
| Data access control | Roles (admin, staff, customer), client separation at database level (row level security), least privilege, logging of the admin view „Als Kunde ansehen“ (view as customer) |
| Transfer control | TLS 1.2+ in transit, AES-256 encryption at rest including backups, processing exclusively in the EU (including AI), read-only bank access, pseudonymisation (IBAN, email) before AI processing |
| Input control | Logging of security-relevant events, AI suggestions labelled with approval history |
| Order control | Data processing agreements with all sub-processors (list at /subprozessoren), documented instructions |
| Availability | Daily encrypted backups, monitoring |
| Separation | Separate data sets per customer, separate test and production environments |
| Organisational | Confidentiality obligation incl. § 203 StGB, annual data protection and AI training, data breach process, cyber insurance |