These Data Processing Terms govern our processing of personal data that you, as a user of BravoLisa, upload or enter about your clients, suppliers, invoice recipients and other third parties. For that data you are the controller and BravoLisa acts as your processor within the meaning of Article 28 GDPR.
These Terms do not apply to personal data for which BravoLisa is itself the controller – your account, authentication, billing, support and security data. That processing is described in our Privacy Policy.
1. How these Terms apply
These Data Processing Terms are incorporated into the Terms of Use. They are accepted electronically when you accept the Terms of Use during registration and apply when you use BravoLisa to process personal data about your clients, suppliers, invoice recipients or other third parties.
You may request the current version at any time by writing to privacy [at] bravolisa [dot] lu. Article 28(9) GDPR permits a data processing contract to be concluded in electronic form; a handwritten signature is not required.
These Terms form part of the contractual framework described in clause 1.5 of the Terms of Use. They remain in force for as long as we process personal data on your behalf.
In these Terms, “you” and “your” mean the BravoLisa user acting as controller; “we”, “us”, “our” and “BravoLisa” mean the person or entity identified in the About Us section, as set out in clause 1.2 of the Terms of Use. “GDPR” means Regulation (EU) 2016/679. Terms such as “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject” and “personal data breach” have the meanings given in the GDPR.
2. Subject matter and details of the processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
3. Processing on your instructions
We process personal data on your behalf only on your documented instructions, including in relation to transfers of personal data to a third country, unless we are required to process it by Union or Member State law to which we are subject. In that case we will inform you of the legal requirement before processing, unless that law prohibits us from doing so on important grounds of public interest.
Your instructions are given by:
- these Terms and the Terms of Use;
- your use of the features and settings available in BravoLisa, including uploading documents, creating records and using AI-assisted features; and
- any further written instruction you send to privacy [at] bravolisa [dot] lu that we accept.
We will inform you if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law. We may decline to act on an instruction that is unlawful, technically impossible, or outside the scope of the service.
4. Confidentiality
We ensure that persons authorised to process personal data on your behalf are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to provide the service.
5. Security
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures under Article 32 GDPR. The measures in place at the date of these Terms are described in Annex 2.
We may update these measures as the service develops. We will not reduce the overall level of security provided.
6. Sub-processors
You give us a general written authorisation to engage sub-processors for the processing carried out on your behalf. A current list of sub-processors and relevant processing locations is available on request at privacy [at] bravolisa [dot] lu.
We impose on each sub-processor, by contract, data protection obligations that are no less protective than those set out in these Terms. We remain fully liable to you for the performance of each sub-processor's obligations.
We will inform you before we add or replace a sub-processor, by email or through the service. If you do not accept the change, your remedy is to stop using the affected feature.
7. International transfers
Some sub-processors may be established outside the European Economic Area or may process personal data outside it. The current sub-processor list and relevant processing information are available on request at privacy [at] bravolisa [dot] lu.
Where personal data processed on your behalf is transferred or made accessible outside the EEA, we use one of the lawful transfer mechanisms permitted by Chapter V GDPR, as appropriate to the relevant transfer. This may include an adequacy decision, the European Commission's Standard Contractual Clauses and supplementary safeguards. Information about the safeguards applicable to a given sub-processor is available on request at privacy [at] bravolisa [dot] lu.
8. Assistance with data subject rights
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.
If a data subject contacts us directly in relation to personal data processed on your behalf, we will not respond on the substance. We will inform you without undue delay and refer the data subject to you, unless you have instructed us otherwise in writing.
The functions available in BravoLisa and written requests to privacy [at] bravolisa [dot] lu are the primary means by which you exercise access, rectification and erasure in respect of the data you control.. Until a self-service export is available, we provide your data on request to privacy [at] bravolisa [dot] lu in a structured, machine-readable format. Assistance beyond the available functions is provided at reasonable cost where the request is repetitive, complex or manifestly excessive.
9. Assistance with security, breach notification and impact assessments
Taking into account the nature of the processing and the information available to us, we assist you in complying with your obligations under Articles 32 to 36 GDPR, namely security of processing, notification of a personal data breach to the supervisory authority and to data subjects, data protection impact assessments and prior consultation.
10. Personal data breaches
We notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf.
Our notification will describe, to the extent known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the information is not available at once, we provide it in phases as it becomes available.
As controller, you are responsible for deciding whether the breach must be notified to the supervisory authority under Article 33 GDPR or communicated to data subjects under Article 34 GDPR, and for making any such notification.
11. Information and audit
We make available to you the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR.
We ordinarily provide compliance information and audit support remotely or in documentary form, including a description of our technical and organisational measures, the current sub-processor list, written responses to reasonable security and data-protection questionnaires, and any third-party certification or audit report we hold. We provide it within a reasonable period of a written request, and not more than once in any twelve-month period unless a personal data breach has occurred or a supervisory authority requires otherwise.
Where this is insufficient to demonstrate compliance with Article 28 GDPR, or where required by a supervisory authority or applicable law, we will allow for and contribute to an audit, including an inspection, conducted by you or an independent auditor mandated by you, subject to reasonable prior notice and appropriate confidentiality, security and non-disruption safeguards.
12. Return and deletion of personal data
At the end of the provision of services relating to processing, we will, at your choice, return to you or delete the personal data processed on your behalf and delete existing copies, subject to the exceptions set out below.
You may communicate your choice by writing to privacy [at] bravolisa [dot] lu. If you request the return of personal data, we will provide it in a reasonably accessible format, taking into account the nature of the data and the technical functionality available at that time. If you do not communicate your choice, we will proceed with deletion.
Personal data will be removed from active systems within 30 days after the end of the relevant service or, where you submit a valid deletion request before that date, within 30 days after that request. Where you request the return of personal data, we will use reasonable efforts to provide it before its removal from active systems.
The personal data may remain inaccessible in protected backups until the relevant backups are overwritten, but for no longer than 90 days after the end of the relevant service or the applicable deletion request. Personal data retained in backups will not be restored or otherwise processed for ordinary business purposes after deletion, except where restoration is required for disaster recovery, security or legal compliance, in which case the deletion process will be reapplied.
Notwithstanding the above, we may retain personal data to the extent and for the period that Union or Member State law requires its storage. Any personal data retained for this reason will be isolated or otherwise access-restricted and processed only for the applicable legal purpose.
Personal data retained by a professional accountant under a separate engagement is outside the scope of these Terms and is governed by the relevant engagement letter and applicable legal and professional obligations.
13. Your obligations as controller
You warrant that:
- you have a lawful basis under Article 6 GDPR for the personal data you upload or enter into BravoLisa about third parties;
- you have provided the information required by Articles 13 and 14 GDPR to the data subjects concerned;
- your instructions to us comply with applicable data protection law;
- you upload only personal data that is relevant to your business administration, and you do not upload special categories of personal data within the meaning of Article 9 GDPR, or photographs of individuals, unless strictly necessary for a business record you are required to keep; and
- you have taken reasonable steps to check the accuracy of the personal data you provide.
Where free-text fields or uploaded documents incidentally contain special categories of personal data, we process that data only as necessary to provide the service and on your instructions. We do not seek out such data and do not use it for any other purpose.
14. Liability and order of precedence
The limitations of liability set out in clause 9.6 of the Terms of Use apply to these Terms, except where the GDPR provides otherwise. Article 82 GDPR governs liability towards data subjects and is not affected by these Terms.
If there is a conflict between these Terms and the Terms of Use or the Privacy Policy in relation to the processing of personal data on your behalf, these Terms prevail. In all other respects the Terms of Use prevail.
15. Term, changes, governing law and contact
These Terms take effect when you electronically accept the Terms of Use during registration and remain in force for as long as we process personal data on your behalf. Clauses 4, 11, 12 and 14 survive termination.
We may update these Terms where the service, our sub-processors or the law change. If a change materially affects your rights, we will give you notice before it takes effect.
These Terms are governed by the laws of Luxembourg. The courts of Luxembourg have jurisdiction, unless mandatory law provides otherwise.
Contact for all matters under these Terms: privacy [at] bravolisa [dot] lu.
Annex 1 – Details of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the BravoLisa bookkeeping and business administration service to you. |
| Duration | For as long as your BravoLisa account is active and, after the end of the service, for the deletion or return cycle described in clause 12. |
| Nature of the processing | Collection, recording, organisation, structuring, storage, retrieval, extraction from documents, categorisation, calculation, analysis, display, export, transmission to sub-processors, erasure and destruction – carried out by automated means, including AI-assisted processing, receipt of documents sent by email to the Workspace inbox. |
| Purpose | Enabling you to record, organise and report on your business transactions with your clients, suppliers and other counterparties, and to prepare related invoices, VAT information and tax documentation. |
| Types of personal data | Names; business names and legal names; postal addresses; email addresses; telephone numbers where provided; VAT and tax registration numbers; IBAN, BIC and account holder names; invoice and payment data including amounts, dates, currencies, references and line-item descriptions; bank statement lines including counterparty names, IBANs, transaction descriptions and the original bank-file payload; the contents of uploaded documents such as invoice scans, receipts and bank statements; free-text content you enter, including in AI prompts and responses, metadata of all inbox email. |
| Special categories | Not processed intentionally. Such data may appear incidentally inside free-text fields or uploaded documents. It is then processed only as necessary to provide the service. |
| Categories of data subjects | Your clients; your suppliers; other counterparties of your business; any natural person named in a document you upload, in a bank statement line, or in free text you enter. |
Annex 2 – Technical and organisational measures
These are the measures in place at the date of these Terms. We may change them, provided the level of protection is not reduced.
Hosting
The service and its production database are hosted in the EU region. Uploaded files are stored in object storage in the EU jurisdiction.
Encryption
Encryption in transit (HTTPS/TLS) between the browser, our application servers and our sub-processors over the hosting provider's private, encrypted network.
Encryption at rest for the production database and for uploaded files, provided by the relevant infrastructure providers.
Access control
Authentication and session management are delegated to a specialist identity provider; we do not store passwords. The production database has no public interface and no browser-accessible credential.
Named individual accounts are used for the hosting, database, storage and identity consoles, and access is limited to those who need it to operate the service.
Separation of Customer data
Every business record is scoped to a Workspace. The Workspace is determined server-side from the authenticated user and is never accepted from client input, so a request cannot ask for another Workspace's records.
File handling and integrity
Uploaded files are not publicly addressable; access is granted through individually signed links with a short expiry. A SHA-256 hash is recorded for every uploaded file and used to detect duplicates within a Workspace.
Personnel
Everyone with technical access is subject to confidentiality obligations and is contractually prohibited from downloading production personal data to local devices.
Availability, resilience and restoration
Regular backups of the production database are taken on a regular basis.
Availability and application errors are monitored with alerting.
We maintain an incident-response procedure and will notify you without undue delay after becoming aware of a personal data breach affecting personal data.
Sub-processor governance
Each provider's security posture and data-processing terms are reviewed before engagement and periodically thereafter.
Annex 3 – Sub-processors
The current list of sub-processors, purposes, processing locations and relevant transfer information is available on request at privacy [at] bravolisa [dot] lu. It may be updated in accordance with clause 6.
Where a sub-processor is located outside the EEA, or may process personal data outside it, the transfer safeguards described in clause 7 apply.
Other providers may process personal data for which BravoLisa is itself the controller. They are not sub-processors under these Terms and are described in the Privacy Policy or available on request.