This data processing agreement ("DPA") is entered into between the business that connects its e-conomic agreement to Omnie Connect (the "Controller") and BLXMP, CVR 43440489, Hvidovrevej 92C, 2650, Hvidovre, Denmark (the "Processor"). It forms part of the end-user licence agreement and is concluded pursuant to article 28(3) of the GDPR.
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller to provide Omnie Connect: reading data from the Controller's Visma e-conomic agreement and producing accounting and project-management reports. The DPA applies for as long as the Processor processes personal data on the Controller's behalf.
2. Instructions
The Processor processes personal data only on documented instructions from the Controller, including this DPA and the configuration of the reports, unless required by EU or Member State law, in which case the Processor informs the Controller beforehand unless prohibited by law. The Processor informs the Controller immediately if an instruction in its opinion infringes data protection law.
3. Confidentiality
Persons authorised to process the personal data are bound by confidentiality.
4. Security
The Processor implements appropriate technical and organisational measures under article 32 GDPR, as described in Appendix C.
5. Sub-processors
The Controller gives general authorisation for the sub-processors in Appendix B. The Processor notifies the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object on reasonable grounds and, if no solution is found, terminate the Service. The Processor imposes the same data protection obligations on each sub-processor by contract and remains liable for its performance.
6. Transfers to third countries
Personal data is transferred outside the EU/EEA only in accordance with chapter V GDPR, for example under the EU-U.S. Data Privacy Framework or the Commission's standard contractual clauses.
7. Assistance
Taking into account the nature of the processing, the Processor assists the Controller with responding to data subject requests, with security, breach notification, data protection impact assessments and prior consultation (articles 32 to 36 GDPR).
8. Personal data breaches
The Processor notifies the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its obligations under articles 33 and 34 GDPR.
9. Deletion and return
When the Service ends, or when the Controller disconnects, the Processor deletes the stored e-conomic access grant within 30 days at the latest. The connector stores no copy of the Controller's accounting data. Reports already delivered remain with the Controller.
10. Audit
The Processor makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it, on reasonable notice.
11. AI and data use
The Processor uses the AI sub-processors in Appendix B only to analyse data and draft reports for the Controller, through API services whose terms exclude training on customer data. The Processor does not use the Controller's data to train, fine-tune, adapt or optimise AI models, and does not use it for any purpose other than providing the Service to the Controller.
12. Liability and law
Liability follows the end-user licence agreement. This DPA is governed by Danish law.
Appendix A: Processing details
- Purpose
- Producing accounting and project-management reports for the Controller.
- Nature
- Read-only retrieval from Visma e-conomic, transient transfer to the reporting workflow, analysis and drafting of report text by AI models (Anthropic, OpenAI and Mistral AI) via their APIs, and report generation.
- Data subjects
- The Controller's customers, suppliers, contact persons, employees and project participants.
- Personal data
- Names, business contact details, invoice and transaction details, and project time and cost entries, to the extent they appear in the Controller's e-conomic data. No special categories of data are intended to be processed.
- Duration
- For the term of the Service.
- Location
- EU for stored data; see Appendix B.
Appendix B: Approved sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, network delivery and encrypted storage of connection tokens | Stored data: EU (Cloudflare D1, EU jurisdiction). Requests are served from Cloudflare's edge network. |
| Anthropic (Claude API) | AI analysis of report data and drafting of report text, via the API under commercial terms that exclude training on customer data | United States. Transfers under the provider's data processing addendum and the EU standard contractual clauses. |
| OpenAI (OpenAI API) | AI analysis of report data and drafting of report text, via the API under business terms that exclude training on customer data | United States. Transfers under the provider's data processing addendum and the EU standard contractual clauses. |
| Mistral AI (Mistral API) | AI analysis of report data and drafting of report text, via the paid API under terms that exclude training on customer data | European Union (Mistral AI is established in France). |
Appendix C: Technical and organisational measures
- Read-only access: the service only issues HTTP GET requests to e-conomic and rejects any other method.
- No replica of customer data: accounting data is fetched on demand for each report and is not written to a database by the connector.
- Encryption in transit (TLS/HTTPS with HSTS) and at rest: e-conomic grant tokens are encrypted with AES-256-GCM, bound to their agreement number, with keys held as platform secrets outside the database.
- Data residency: the token database is restricted to Cloudflare's EU jurisdiction.
- Access control: the reporting workflow authenticates with a long random API key, compared in constant time; secrets are never logged.
- Browser protection: strict Content-Security-Policy, no third-party scripts, no tracking or analytics cookies, HttpOnly/Secure/SameSite cookies, CSRF protection on state-changing actions.
- Least privilege and minimisation: only the agreement number and company name are stored alongside the encrypted grant; user details returned by e-conomic are discarded.
- Incident handling: suspected breaches are investigated immediately and reported to the customer, and where applicable to Visma e-conomic, without undue delay.