This DPA forms part of, and is incorporated by reference into, the Megorix Terms of Service. It applies automatically upon acceptance of the Terms of Service — no separate signature is required unless a specific customer contract states otherwise.

1. Parties and Definitions

“Megorix”, “we”, “us”: MegaPC Informática e Software, Lda., NIPC 504125931, registered in Ourém, Santarém, Portugal.
“Customer”, “Controller”, “you”: the organization with an active Megorix subscription.
“Data Protection Laws”: the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (nDSG) and its ordinance (DSV), and any other data protection law applicable to the Customer's processing.
“Personal Data”, “Processing”, “Data Subject”, “Sub-processor”, “Personal Data Breach”: as defined under the GDPR and, where applicable, the nDSG.
“Services”: the Megorix ERP platform and its modules, as described in the Terms of Service.

2. Subject Matter and Duration

Megorix processes Personal Data on the Customer's behalf solely to provide the Services. This DPA takes effect when the Customer starts using the Services and remains in effect for as long as Megorix processes Personal Data on the Customer's behalf, including any period after termination during which Megorix retains data under Section 11.

3. Roles of the Parties

For Personal Data the Customer enters into or generates within the Services (its own customers, invoices, employees, inventory, and similar business records), the Customer is the Controller and Megorix is the Processor. Megorix processes this data only on the Customer's documented instructions — given through use of the Services or in writing — except where EU or Swiss law requires otherwise, in which case Megorix will inform the Customer of that legal requirement first, unless prohibited from doing so.

For data Megorix collects to operate its own business relationship with the Customer (account holder identity, billing details, subscription usage, marketing communications), Megorix acts as an independent Controller — see the Megorix Privacy Policy.

4. Categories of Data and Data Subjects

Data Subjects: the Customer's own customers, suppliers, employees, and other individuals whose data the Customer enters into the Services.
Categories of Personal Data: identification data (names, tax/VAT identifiers), contact data (addresses, emails, phone numbers), financial/billing data (invoice line items, IBAN, payment references), employment data (for HR module users), and any other data the Customer records in a Megorix entity or field. Fields the Customer marks as sensitive (e.g. national ID numbers, IBANs) can be stored with field-level AES-256 encryption — see Section 6.
Special categories of data (Art. 9 GDPR / Art. 5 nDSG): the Services are not designed to require these. The Customer is solely responsible for not entering special category data unless it has independently assessed the legal basis and configured appropriate protections.

5. Sub-processors

The Customer authorizes Megorix to engage the following sub-processors:

Hostinger — application and database hosting — Paris, France (EU).
Stripe — subscription payment processing — EU/US, see Stripe's own DPA.
Cloudflare — CDN, DDoS protection, edge network — global edge network.
Google (Firebase Cloud Messaging) — mobile push notifications — EU/US, see Google's own DPA.
Transactional email provider — sending system emails (invoices, notifications) — EU.

Megorix will give the Customer at least 30 days' notice (by email or in-app notice) before adding or replacing a sub-processor with access to Personal Data, and the Customer may object on reasonable data-protection grounds within that period. Megorix remains responsible for each sub-processor's compliance with obligations equivalent to this DPA.

6. Technical and Organizational Security Measures

Tenant isolation enforced at the database level via PostgreSQL Row-Level Security — one tenant's queries cannot read another tenant's rows.
Field-level encryption (AES-256-GCM) available for sensitive fields, configurable per field by the Customer.
Immutability and integrity controls for Swiss invoicing records: once issued, invoices are locked against modification and deletion, and every change is recorded in an audit trail kept for 10 years, in line with Art. 958f CO / GeBüV.
Encryption in transit (TLS) for all connections to the Services.
Access logging and audit trails for record changes.
Role- and permission-based access control, configured by the Customer.
Regular backups and disaster recovery procedures.

Megorix will not materially reduce its overall level of security during the term of this DPA.

7. Assistance with Data Subject Requests

Megorix will provide reasonable assistance to the Customer, through the Services' own functionality or upon written request, to respond to Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, objection) under applicable Data Protection Laws. Megorix may charge a reasonable fee for assistance requiring work materially beyond the Services' existing functionality.

8. Personal Data Breach Notification

Megorix will notify the Customer without undue delay, and in any event within 48 hours of becoming aware, of any Personal Data Breach affecting the Customer's data, including (to the extent known): its nature, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed.

9. Audits

Upon reasonable written request, no more than once per calendar year (unless required by a supervisory authority or following a Personal Data Breach), Megorix will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation and, subject to confidentiality, responses to a written security questionnaire.

10. International Data Transfers

Megorix's primary infrastructure is hosted within the European Union (Paris, France). Where a sub-processor transfers Personal Data outside the EU/EEA or Switzerland, that sub-processor's own transfer mechanism (such as the EU Standard Contractual Clauses or an adequacy decision) applies, as described in that sub-processor's own DPA.

11. Term, Termination, Data Return and Deletion

Upon termination, Megorix will, at the Customer's choice made within 30 days, make Customer Personal Data available for export in a structured format, or delete it — except to the extent Megorix is legally required (including Swiss commercial retention rules, e.g. Art. 958f CO for invoicing records) to retain it longer, in which case Megorix will isolate that data from further processing.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Megorix Terms of Service.

13. Governing Law

This DPA is governed by the same governing law as the Megorix Terms of Service. Nothing in this DPA reduces either party's rights or obligations under mandatory provisions of Data Protection Laws applicable to the Customer's own processing.

Data Processing Agreement (DPA)