Bella Books Data Processing Agreement
Version 1.0 路 27 October 2026
This data processing agreement applies between Bella Books ehf. and a customer that has made an agreement with Bella Books to use Bella and has accepted this data processing agreement, either by signing an agreement that refers to it or by accepting it in Bella.
Scope
This agreement is made under Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 25 of the Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data. It is part of the parties' agreement on the use of Bella.
If the parties have made a separate written agreement on the processing of personal data, that agreement prevails over this one. If this agreement conflicts with the Bella Books Terms of Service or Privacy Policy, this agreement prevails with respect to the processing of personal data.
1. Definitions
- Processor: Bella Books ehf., reg. no. 510825-0710, Dalsbygg冒 10, 210 Gar冒ab忙r, Iceland.
- Controller: a customer that has made an agreement with Bella Books to use Bella and has accepted this agreement.
- The Service (Bella): the Bella Books service, that is, the software that receives and processes Customer Data, together with the systems it runs on.
- Personal data, processing and personal data breach have the same meaning as in the GDPR and Act No. 90/2018.
- Customer Data: invoices, supporting documents and other data that the controller, its users or its connected systems send to Bella, or that Bella fetches from connected systems at the controller's request, together with data created by the processing, such as booking proposals and answers in "Ask Bella!".
- Information about Bella's users themselves, such as name, email address and logins, is processed by Bella Books as controller under its Privacy Policy.
2. Description of the processing
| Item | Description |
|---|---|
| Purpose | Receiving, reading and classifying invoices and supporting documents; booking proposals; approval workflows; sending confirmed entries to the controller's accounting system; queries in "Ask Bella!"; user support and troubleshooting |
| Types of data | Names, national identification numbers (kennitala), email addresses, phone numbers, addresses, bank details, employee numbers and other information that appears in Customer Data |
| Data subjects | The controller's employees and users, approvers, vendors and their contacts, sole traders and others named in Customer Data |
| Special categories | Bella is not intended for processing special categories of personal data (Article 9 GDPR) or data relating to criminal offences (Article 10 GDPR). The controller does not send such data to Bella, unless it appears in invoices or supporting documents that must be booked, and then only to the extent necessary |
| Duration | While the controller uses Bella, plus the return period under clause 10 |
3. Obligations of the processor
3.1 The processor processes personal data only on the documented instructions of the controller. This agreement, the controller's settings in Bella and the booking rules it sets are documented instructions.
3.2 If the processor considers that an instruction infringes data protection law, it informs the controller without delay.
3.3 The processor uses Customer Data only to provide, maintain, secure, support and improve the Service for the controller, including for troubleshooting. Customer Data is neither sold nor used to train AI models.
3.4 Bella's proposals are not automated decisions. A user of the controller confirms each proposal before it is sent to the accounting system. For traceability, Bella records who confirmed the proposal and who sent it to the accounting system, and a link to the processing in Bella goes with the entry or its supporting document, as far as the accounting system allows.
3.5 The processor assists the controller, where relevant, with data protection impact assessments and prior consultation with the Icelandic Data Protection Authority (Pers贸nuvernd), and keeps a record of processing activities under Article 30 GDPR.
3.6 Data protection enquiries may be sent to privacy@bellabooks.ai.
4. Obligations of the controller
4.1 The controller is responsible for having a legal basis for the processing and for informing the data subjects about it.
4.2 The controller is responsible for retaining accounting records under the Icelandic Act No. 145/1994 on Bookkeeping.
4.3 The controller ensures that at least one of its contacts is always subscribed to the Bella Books legal and service updates list (see 11.2), and that the email addresses of the owners and admins of its account in Bella are correct.
5. Confidentiality
5.1 The processor keeps Customer Data and other confidential information it receives from the controller strictly confidential. This applies, among other things, to financial information, accounting records and information about customers, vendors and employees.
5.2 Employees and others with access to Customer Data are bound by a duty of confidentiality and have access only to the extent necessary for their work.
5.3 The duty of confidentiality continues after this agreement ends.
6. Security measures
6.1 The processor takes appropriate technical and organisational measures to ensure the security of the data in accordance with Article 32 GDPR. These include:
- encryption of data in transit (TLS) and at rest;
- role-based access control and least-privilege access for employees;
- user authentication and secure session management;
- logging of actions and monitoring of systems;
- regular backups and a response plan for security incidents and outages.
6.2 The processor's security measures are based on recognised practice under ISO/IEC 27001, and the processor aims for certification under the standard. The security measures are reviewed regularly, and their level of security will not be lowered during the term of this agreement.
7. Sub-processors and transfers of data
7.1 The controller gives general authorisation to use the sub-processors listed in Annex 1.
7.2 The processor gives notice of any intended addition or replacement of sub-processors at least 14 days in advance (see 11.2). The controller may object to the change within that period. If the parties do not reach agreement, the controller may terminate its subscription without notice before the change takes effect, and is then refunded the part of any prepaid subscription that falls after the termination takes effect.
7.3 The processor makes a written agreement with each sub-processor that imposes on it the same obligations as this agreement, and is liable to the controller for the sub-processor's performance.
7.4 Customer Data, including its backups, is hosted by Amazon Web Services within the European Union, and all AI processing takes place there. Other sub-processors in Annex 1 receive only the data that their role there requires. When troubleshooting requires it, the data concerned may be copied temporarily to the processor's equipment in Iceland. There it is stored encrypted and deleted within 7 days after the troubleshooting ends. Customer Data is not transferred outside the European Economic Area (EEA) except to sub-processors listed in Annex 1 or notified under 7.2, and then on the basis of a transfer mechanism under Chapter V GDPR, such as the EU standard contractual clauses.
8. Personal data breaches
8.1 If the processor becomes aware of a personal data breach concerning Customer Data, it notifies the controller without undue delay and no later than 48 hours after becoming aware of it. The notice is sent by email to the owners and admins of the controller's account in Bella.
8.2 The notice describes the nature of the breach, the data and individuals concerned, the likely consequences and the measures taken. Where not all information is available at once, it may be provided in phases without undue further delay.
8.3 The processor assists the controller in notifying the Data Protection Authority and the data subjects of the breach where applicable (Articles 33 and 34 GDPR).
9. Data subject rights and audits
9.1 If the processor receives a request from an individual for access, rectification, erasure or other rights concerning Customer Data, it refers the request to the controller without delay and assists the controller in responding to it.
9.2 The processor provides the controller with the information necessary to demonstrate compliance with the obligations under this agreement.
9.3 The controller, or an independent auditor acting on its behalf and bound by confidentiality, may carry out an audit once a year, or more often if a personal data breach or an instruction from a supervisory authority gives reason to, with at least 30 days' notice. The processor may first provide information under 9.2. An audit gives no access to other customers' data. The controller bears the cost of the audit.
10. Term, termination and deletion of data
10.1 This agreement takes effect when the controller accepts it (see the introduction), and applies while the controller uses Bella.
10.2 The controller can download invoices, supporting documents and booking data from Bella at any time during the term of this agreement. Entries sent from Bella to the controller's accounting system, and their supporting documents as far as the accounting system allows, are also kept there.
10.3 When this agreement ends, Customer Data is kept for 90 days. During that time the controller may request a copy of all data by writing to privacy@bellabooks.ai. The controller may also request that the data be deleted earlier.
10.4 After 90 days the processor deletes Customer Data held in hosting or makes it anonymous, unless the law requires otherwise. Encrypted backups are deleted as they are replaced in the regular cycle, within 30 days. Copies in email and system logs are deleted within 12 months. The processor confirms deletion in writing on request.
11. Changes, notices, governing law and jurisdiction
11.1 The processor may update this agreement, including by replacing it with a data processing agreement published on the Bella Books website. Material changes are notified under 11.2 at least 14 days in advance and take effect when that period ends. Changes that reduce the protection of personal data will not be made except with the controller's consent or where the law requires it. If the controller does not accept a change, it may terminate its subscription before the change takes effect and is then refunded under 7.2.
11.2 Notices under 7.2 and 11.1 are sent by email to subscribers of the Bella Books legal and service updates list (bellabooks.ai/en/legal-updates) and, where appropriate, published in Bella. A notice is deemed given when it has been sent to the list. Notices of personal data breaches are governed by 8.1.
11.3 Earlier versions of this agreement are available on request.
11.4 This agreement is governed by Icelandic law. Any dispute that the parties do not resolve by agreement shall be brought before the District Court of Reykjav铆k (H茅ra冒sd贸mur Reykjav铆kur).
11.5 This agreement is published in Icelandic, English and German. The language version that the controller accepted in Bella or signed is binding, and this also applies to later versions of the agreement under 11.1. The other language versions are provided for convenience.
Annex 1 to the data processing agreement: Sub-processors
| Sub-processor | Role | Data location |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Primary hosting, databases, data storage and all AI processing | EU |
| Twilio Inc. (SendGrid) | Receiving invoices and supporting documents sent by email, and sending notifications from Bella | United States, with EU standard contractual clauses |
| Google Ireland Ltd. (Google Workspace) | Email, including support correspondence and operational notifications from the Service | EU, with EU standard contractual clauses |
| Maventa Oy (Finland), part of the Visma group (Inexchange) | Receiving electronic invoices (Peppol access point and Maventa's own network) for a controller that receives e-invoices through Bella, and delivering them to Bella. Only for controllers that have asked for it | EEA |
| Enable Banking Oy (Finland) | Reading the balances and transactions of the controller's bank accounts (licensed account information service, supervised by the Finnish Financial Supervisory Authority) and delivering them to Bella for reconciliation. Only for controllers that have connected a bank account | EEA |
| Maesn GmbH (Germany) | Connection to Microsoft Dynamics 365 Business Central, for a controller that connects its accounting system to Bella that way | EU |
| Quarter ehf. (Iceland) | Support desk (Cardinal): receiving and answering support requests by email and chat, together with data sent with them | EEA |
Connections to accounting systems, e-invoice message brokers, banks and card companies, as well as MCP clients and other AI tools of the controller, are set up at the controller's request. Data sent there is the controller's responsibility and is governed by its agreements with those parties. When the processor itself receives e-invoices for the controller through Maventa, Maventa is a sub-processor under this Annex. When the processor reads the controller's bank accounts through Enable Banking, Enable Banking is a sub-processor under this Annex. Bella's connection to Microsoft Dynamics 365 Business Central runs through Maesn, which is then a sub-processor under this Annex; the accounting system itself is the controller's responsibility.
For the processor's own operations, outside the Service, Pipedrive (business contacts), Brevo (mailing lists, including the legal and service updates list) and eSigna from [e]core ehf. (electronic signatures and verification of the person who signs for the controller) are also used. These parties do not receive Customer Data.