Data Processing Agreement

Parties and roles

This Data Processing Agreement is between Reconge and the customer, which is the organization that uses the service.

Reconge is the Georgian individual entrepreneur named in the seller details at the end of this page, the same person who sells the service and who is the controller under the Privacy Policy.

For the personal data in the files the customer uploads, Reconge processes the data only on the customer's instructions. The random identifiers of the service's records that Reconge keeps for its own purposes are described in the subprocessors section. Roles: the customer is the controller of this data or, where it processes the data for its own clients, their processor; Reconge processes the data for the customer as a processor within the meaning of Article 3 of the Law on Personal Data Protection. By accepting this Agreement, a customer that processes the data for its own clients confirms that, for each client whose data it uploads, it has the necessary authority and the prior written consent of that client, as controller, to engage Reconge and the subprocessors listed in this Agreement (Article 36(7) of the Law on Personal Data Protection). This consent is given by the customer's client whose data the customer uploads, acting as controller, and not by each person named in that client's financial documents. The customer's confirmation is its own statement and is not by itself evidence that the consent exists.

The controller of the personal data in the customer's files determines the purposes and the essential means of their processing. Where the customer is the controller, it bears the controller's responsibilities under the Law on Personal Data Protection: it is responsible for the legal ground for the processing and for being able to justify it, and for informing the persons the data concern. Where the customer, such as an accounting firm, processes the data as a processor for its own clients, each client is the controller of its data and bears these responsibilities, and the customer acts only within that client's instructions and within the client's authorization to engage Reconge. In either case the customer gives Reconge only instructions that comply with the law. The customer may ask Reconge for the information described in the assistance section before it uploads data and while the processing lasts.

Subject matter and duration

Reconge processes the exports of bank statements and accounting ledgers that the customer uploads, to reconcile them, to let the customer's users review the results and to export the results.

Grounds: the controller described in the parties and roles section processes the data on its own ground under Article 5 of the Law on Personal Data Protection, and under Article 6 for special categories of data; Reconge processes them for the customer only under this Agreement and the customer's instructions.

The files can hold names of companies and people, tax IDs, IBANs and account numbers, references, descriptions, amounts and dates. The data subjects are the controller's counterparties, employees and individual entrepreneurs named in statements and ledgers.

Payment descriptions in bank statements and accounting ledgers can reveal special categories of personal data, such as health information or trade-union membership. Reconge does not automatically detect such data. The controller identified under the parties and roles section is responsible for determining whether these data may be uploaded and for the legal basis under Article 6 of the Law on Personal Data Protection.

The processing lasts while the customer uses the service and ends as the end of processing section describes.

Instructions

Reconge processes the customer's data only to reconcile it, to show it for review, to export it and, on the customer's written request, to answer a support request.

The customer's documented instructions are this Agreement, which describes the processing Reconge carries out, and the written instructions that a user of the customer sends from the e-mail address of the user's account to the contact address in the seller details. Reconge keeps each instruction it receives by e-mail with its date. Within these instructions the customer's users start each processing in the service themselves, and the audit log records the actions that start or end it: creating a reconciliation, uploading a file, saving a column mapping, starting a run, recording a decision, downloading an export and deleting a reconciliation.

The customer does not send the content of its files to the contact address. It gives Reconge its files only by uploading them in the service.

During the pilot Reconge does not use customers' files for research, and the operator makes no research copies of them. The research setting of a client company in the service is not the consent of the persons whose data the files contain. Research on customers' data after the pilot would need a separate legal basis, which this Agreement does not give.

Reconge sells no customer data and trains no models on customer data.

Protection in the browser

By default, identifying fields are transformed on the user's device before upload: in the columns whose roles the user confirms, names of companies and people, tax IDs, IBANs, e-mail addresses, phone numbers and postal addresses are replaced by pseudonyms.

Amounts, dates, currencies, directions, references and document numbers are sent exactly as they are in the file, even when a reference contains a name.

Column names, the sheet name and the file name are sent as they are.

Names and e-mail addresses that no identifying column holds, and tax IDs, IBANs, phone numbers and other numbers written inside free text, are sent as they are.

The original files, and which value replaced which, stay on the user's device.

Uploading the original files is a separate action the user chooses explicitly. The identifying data in the original files, names, tax IDs and IBANs included, then reaches Reconge.

Confidentiality and support

Reconge keeps the customer's data confidential. Every person who works for Reconge and has access to it is bound to confidentiality.

Support reads a customer's files only on the customer's written request, recorded in the audit log before any file is read.

Protection of data

• Each organization sees only its own data.
• The values of the columns the user confirms are replaced in the browser before upload, as the protection in the browser section describes.
• Connections to the service use HTTPS.
• Passwords are stored only as a one-way hash.
• Support reads a customer's files only on its written request, recorded in the audit log first.
• Backups are made daily and kept about 15 days.

Subprocessors

A subprocessor in this Agreement is a person that Reconge engages in the processing of the customer's data under Article 36(7) of the Law on Personal Data Protection.

This service processes the customer's data for Reconge:

Reconge's own processing as controller is described in the Privacy Policy: telemetry, product analytics, the site, the waitlist and the mailbox. To find faults and slow parts of the service and to understand how the pilot is used, Reconge records in telemetry and product analytics only counters, codes, durations and the type of each request, with no identifier of a user, an organization or a record of the service, no request address and no User-Agent, so that nothing in them can be linked to the customer or its records. Until this version of this Agreement took effect, they also held random identifiers of the service's records, the customer's records included, and telemetry also the request addresses and the browser's User-Agent; telemetry recorded before 14 October 2026 may also hold the text of the error of a failed run, which can quote values, column names or the first rows of the customer's file. Reconge can still link those older data to the customer's records, which can concern natural persons, and processes them as controller for these purposes only. Pydantic Logfire and PostHog keep them on Reconge's behalf for the periods the Privacy Policy gives.

A subprocessor is engaged only with the customer's prior written consent: the customer gives it for the subprocessors listed above by accepting this Agreement in the service, and for a new subprocessor by accepting the version of this Agreement that lists it. Where the customer processes the data for its own clients, the prior written consent of each client as controller is required as well, as the parties and roles section describes.

Before Reconge adds or replaces a subprocessor, it publishes a new version of this Agreement with the new list. The customer consents by accepting that version in the service, and the new subprocessor receives the customer's data only after that acceptance.

Assistance

Reconge passes on to the customer without delay any request of a data subject it receives about the customer's data, and helps the customer answer it.

The customer can itself export the results of each completed run and delete a reconciliation with its files, runs, results and decisions.

Reconge notifies the customer of an incident that affects the customer's data, a breach of data security as the Law on Personal Data Protection defines it, immediately after Reconge identifies it (Article 29(2) of the Law on Personal Data Protection) and gives the information the customer needs to meet its own obligations.

On the customer's request Reconge gives it in writing the information it needs to check that the processing meets the Law on Personal Data Protection and this Agreement: the version of this Agreement the customer accepted and the date of its acceptance, the subprocessors with their purposes and countries, the measures of the protection of data section, the entries of the audit log about support access to the customer's files and about research exports of its companies' files, and the incidents that affected the customer's data. Reconge answers the customer's further questions about the processing in writing.

On the customer's request, Reconge assists with an assessment of the impact of the processing on personal data protection, using the information reasonably available to it and taking the nature of the processing into account.

End of processing

When the processing ends, Reconge stops processing the customer's data and hands over to the customer, immediately and in full, all data of the customer's reconciliations that it holds, with the uploaded files, the column mappings, the results of the runs and the decisions. It acts on the customer's written instruction, signed with a qualified electronic signature or on paper by a person who may represent the customer according to the public registry or, for an organization registered on app.reconge.com, sent from the e-mail address of the account of the user who accepted this Agreement for it and confirmed by that user's reply to Reconge's answer; the instruction says how the data reach the customer: through a protected channel agreed with the customer, into storage the customer provides or in person. After the customer confirms receipt, or earlier on its documented instruction, Reconge deletes the reconciliations with their files.

If a dispute arises between Reconge and the customer about the processing, Reconge stops the processing at once and hands over to the customer, immediately and in full, all data of the customer's reconciliations that it holds, through a protected channel agreed with the customer (Article 36(8) of the Law on Personal Data Protection).

The customer can also export the results of each completed run itself and delete each reconciliation with its files, runs, results and decisions.

On the customer's written instruction, given as for the handover above, Reconge closes the customer's organization. The service then deletes the reconciliations with their files, runs, results and decisions and the pilot feedback, closes the sign-in of every user, and replaces with placeholders the names and e-mail addresses of the users, except the record Reconge keeps as described below, the names of the companies and their saved column mappings, and the names, e-mail addresses, company names and file names in the audit log; the audit log keeps the actions with their time. An organization registered on app.reconge.com that has never accepted this Agreement, and whose users have not signed in for 12 months, is closed by the service in the same way. A run in progress has to end before the organization can be closed.

Backups expire about 15 days after they are made; deleted data stays in them until then.

• Records of users, of the organization and of its companies: replaced with placeholders when the organization is closed, as described above. For three years after the closing Reconge keeps, as its own record to prove the agreement and its terms (Article 129(1) of the Civil Code of Georgia), the name of the organization, the name and e-mail address of each user who accepted the Terms of Service and this Agreement for it, and the acceptance records; then the service replaces them with placeholders too. The Privacy Policy describes this record.
• The audit log: kept with the actions, their time and the random identifiers of the users and records; when the organization is closed, the names, e-mail addresses, company names and file names it holds are removed.
• Copies the operator made for support or for research: the operator deletes a support copy by hand within 30 days after the support request is resolved, earlier once it is no longer needed for that request, and at the end of the processing at the latest; during the pilot Reconge makes no copies for research.
• The handover package: deleted when the customer confirms its receipt, and in any case no later than 30 days after it is made; this limit caps how long a package may wait and does not postpone the handover.

Acceptance

The customer's organization accepts this Data Processing Agreement in the service together with the Terms of Service and before it uploads any file under them, as the acceptance section of the Terms of Service describes. The user who accepts gives four separate statements: that they may accept for the organization, that the organization accepts the Terms of Service, that it accepts this Agreement, and that it consents to the subprocessors listed in the version it accepts. By the last statement the organization gives its prior consent to those subprocessors, and the record of the acceptance names the version of that list. Where the organization is the controller, this is the consent of Article 36(7) of the Law on Personal Data Protection; where it processes the data for its own clients, the consent of Article 36(7) is each client's, as the parties and roles section describes.

The organization and Reconge agree that the acceptance recorded in the service by the user that the acceptance section of the Terms of Service describes, with the user, the time and the version, language and hash of each document, is the organization's electronic signature of this Agreement and the Terms of Service and has the same force between the organization and Reconge as a handwritten signature on a paper document (Article 3(8) of the Law of Georgia on Electronic Documents and Electronic Trust Services).

The publication of this Agreement on this site is neither acceptance by any customer nor the customer's consent to any subprocessor.

For the processing of the customer's data this Agreement prevails over the Terms of Service.

Changes to this Agreement

Reconge may change this Data Processing Agreement. When a new version that changes the rights or duties of the parties or the list of subprocessors takes effect, the service shows the users of the customer's organization a notice of it the next time they use the service. The notice leads to the text of the new version.

A new version that changes the rights or duties of the parties or the list of subprocessors applies to the customer once its organization accepts it in the service; from the time the new version takes effect until that acceptance, the customer can start no new processing in the service. Until then the customer can still read and export the results of its completed runs under the version it accepted, as long as that version covers it and no subprocessor the customer has not consented to receives its data for that; otherwise Reconge returns the customer's data on its written request. A version that changes neither the rights or duties of the parties nor the list of subprocessors applies without a new acceptance.

The version date at the top of this page shows the version in force.