DATA GOVERNANCE AND GDPR PROTECTION SCHEDULE
1. Data Governance & Definitions
"Controller" refers to the user of this application (the person controlling their own personal data). "Processor" refers to the application and its hosting/service providers. "Personal Data" means any information relating to an identified or identifiable natural person, as defined under the GDPR (Art. 4).
2. Data Governance Framework
- Data ownership & classification: All data you enter (accounts, categories, transactions, budgets, recurring items) is owned by you. Data is classified as financial personal data and processed strictly for the purpose of providing the service.
- Roles & accountability: You are the Controller of your data. The Processor acts only on your documented instructions. Both parties implement appropriate technical and organisational measures per GDPR Art. 24.
- Processing purposes: Your data is processed solely to operate the application (storing, displaying and analysing your financial records) and to communicate service related messages (e.g. verification emails, Telegram alerts).
- Data retention: Your data is retained for as long as your account is active. You may request deletion at any time, and deleting your account permanently erases your data.
- Lawful basis & rights: Processing is based on Art. 6 (consent and performance of a contract). You retain your rights under GDPR Arts. 12–22: access, rectification, erasure, restriction, portability and objection. You may exercise them at any time.
- Children: The service is not directed at individuals under 16, and we do not knowingly process their data.
3. Security & Incident Management (Art. 32 & 33)
The Processor applies appropriate security controls including encryption in transit, strong password hashing, rate limiting and access controls. In the event of a personal-data breach, the Processor will notify the Controller in accordance with Art. 33.
Please note: the application is provided free of charge until notified otherwise. No data transmission over the internet can be guaranteed 100% secure — despite reasonable safeguards, there is always a residual risk of data leakage through cyberattacks or other security incidents.
4. Sub-processors & Third-Party Transfers (Art. 28 & 44)
The Processor may use sub-processors (e.g. email delivery and hosting providers) to deliver the service. Any transfer of personal data to a third country is carried out only with appropriate safeguards in accordance with GDPR Chapter V.
By creating an account you acknowledge that you have read and agree to the above Terms & Agreement.