Subprocessors and technology providers

1.1This page identifies the main third-party providers that Accquix may use when providing accounting and administrative services, operating the Accquix website, operating Accquix Pro, receiving and storing client documents, processing accounting and transaction data, sending e-mails and system notifications, managing enquiries and client relationships, performing client identification and verification, protecting systems and infrastructure, measuring website or product usage, processing payments, or providing other agreed digital services.

1.2Not every provider listed on this page is used for every client, service or processing activity. Actual use depends on the service ordered by the client, whether Accquix Pro is used, the applicable technical workflow, integrations selected by the client, client configuration or authorization, cookie or analytics consent, security and compliance requirements, and whether optional processing functionality has been enabled. Listing a provider on this page does not by itself mean that the provider receives personal data relating to every Accquix client.

1.3Some providers listed on this page are subprocessors within the meaning of Article 28 GDPR when Accquix processes personal data on behalf of a client. Other providers may instead act as processors of Accquix where Accquix is an independent controller, independent controllers, payment or verification providers with their own regulatory responsibilities, infrastructure providers, or technology providers that do not receive client personal data at all. The legal role therefore depends on the particular processing activity.

3.1Accquix Pro is being developed as Accquix's own accounting and financial-processing infrastructure. Its purpose is to reduce dependence on fragmented external accounting tools while preserving source documents, processing evidence, transaction lineage, accounting decisions, review history and auditability.

3.2The planned production architecture separates different processing responsibilities. Accquix Pro may use Vercel for the web application layer, Neon / Databricks for PostgreSQL database infrastructure, Cloudflare R2 for private object storage, Railway for worker and background-processing infrastructure, and locally executed document-processing components within Accquix-controlled worker environments.

3.3A provider forming part of the Accquix Pro infrastructure does not automatically receive every category of client information. Accquix aims to apply data minimisation and separation of responsibilities so that each provider receives only the information necessary to provide its part of the service. For example, a database provider may hold structured records and references, object storage may hold original source files, the worker runtime may temporarily access files or derived data necessary for a processing job, and analytics providers do not receive accounting documents merely because they are used on the same product.

4.1Accquix Pro is designed so that a substantial part of document intelligence and file processing can be performed within Accquix-controlled infrastructure without sending source documents to an external document-processing SaaS provider. Depending on the production configuration, such processing may include the tasks listed below:

• PDF inspection and rendering
• OCR
• image processing
• barcode and QR-code recognition
• spreadsheet and office-document parsing
• XML validation
• archive inspection
• malware scanning
• structured document extraction
• table and layout recognition
• and other deterministic or machine-assisted document-processing tasks.

4.2Accquix may use the software components and engines listed below:

• Tesseract
• OCRmyPDF
• Poppler
• qpdf
• PaddleOCR
• PP-Structure
• Docling
• llama.cpp or other locally executed models
• AnyDoc
• pdf-inspector
• sharp / libvips
• ZXing
• libarchive
• libxml2
• xmlsec
• YARA-X
• ClamAV
• and similar local libraries or processing engines.

4.3These software components are not treated as subprocessors merely because Accquix uses their software. Where the software runs inside Accquix-controlled infrastructure and no client data is transmitted to the software developer or another external service, the developer does not receive the client's personal data through that processing.

4.4Accquix may replace, update or add locally executed software components without updating the subprocessor table where the change does not introduce a new third party receiving client personal data.

5.1Accquix Pro is designed so that external AI processing is not required for the ordinary storage of documents or for the basic accounting workflow. External AI functionality is an optional capability.

5.2Where an external AI provider is used, Accquix may restrict the information sent to that provider to derived or extracted text, specifically selected portions of a document, sanitized information, selected images where required for interpretation, or another limited representation necessary for the relevant task.

5.3The availability of an AI integration does not mean that client documents are automatically transmitted to an external AI provider. Accquix may require technical policy controls, appropriate authorization and, where applicable, client consent before external AI processing is enabled.

5.4Where an external provider is not enabled or cannot be used, Accquix may instead rely on local processing, deterministic extraction, another permitted processing method, or human review. Failure of an external AI provider does not authorize Accquix to bypass its document, evidence or accounting controls.

6.1Analytics and marketing technologies are logically separate from Accquix accounting data processing. Where applicable, their use is governed by the user's cookie or analytics choices and the Accquix Cookie Policy.

6.2Providers such as PostHog, Google Analytics 4, Meta Pixel / Meta Conversions API and Visitors may therefore be inactive for a particular visitor if the required category of consent has not been granted.

6.3Accquix does not intentionally use marketing pixels for the purpose of transmitting accounting documents, bookkeeping records, uploaded source files or other client financial evidence to advertising providers.

7.1Accquix clients may themselves use third-party platforms such as the services and systems listed below:

• Stripe
• banks and payment institutions
• Wise
• Payoneer
• PayPal
• Upwork
• Etsy
• app stores
• merchant-of-record platforms
• invoicing systems
• crypto payment processors
• Fintoro
• or other financial and commerce platforms.

7.2Such a platform is not automatically an Accquix subprocessor merely because Accquix receives an export, statement, invoice, API result or other information originating from that platform. In many cases, the platform has a direct relationship with the client and acts as an independent controller, processor or service provider under its own agreement with the client.

7.3If Accquix later establishes its own direct integration with a provider and instructs that provider to process personal data on Accquix's behalf, Accquix may add that provider to the main provider list where appropriate.

8.1Accquix may be required to identify or verify clients or other relevant persons under applicable legal, contractual, fraud-prevention or risk-management requirements.

8.2Didit may be used for relevant identity, KYC, KYB or related verification workflows. The exact verification process may depend on the person being verified, the legal requirement, the service ordered, the risk level and the verification method used.

8.3Verification information may include sensitive identity information and may in some workflows include biometric or liveness-related information. Such information is not collected merely because a person visits the Accquix website.

9.1Accquix may process uploaded files through security controls before they are accepted for further document processing. Such controls may include the safeguards listed below:

• File-type validation
• file-size limits
• cryptographic hashing
• MIME and structural inspection
• archive restrictions
• malware scanning
• malicious-pattern detection
• XML security controls
• and isolation or rejection of unsafe files.

9.2Where security tools such as ClamAV or YARA-X execute locally within Accquix infrastructure, their developers do not receive the scanned client documents as part of that local execution.

10.1The following are not subprocessors of Accquix merely because Accquix communicates with them or submits information to them: the Slovak Financial Administration; the Social Insurance Agency; Slovak health insurance companies; courts; regulators; municipalities; statistical authorities; law-enforcement authorities; and other competent public bodies.

10.2These entities act as independent public authorities or statutory recipients of information under applicable law or based on a client's authorization.

11.1Accquix may query public or official data sources in order to verify information relevant to accounting, tax or counterparty processing. These may include the sources listed below:

• Slovak public business registers
• Register of Financial Statements data
• Financial Administration datasets
• EU VAT Information Exchange System (VIES)
• European Central Bank exchange-rate data
• and similar official or authoritative sources.

11.2A public authority or public registry does not become an Accquix subprocessor merely because Accquix sends a search query to it.

12.1Some providers used by Accquix operate infrastructure or support functions outside Slovakia, the European Union or the European Economic Area. This may result in personal data being transferred outside the EU/EEA, remotely accessed from another jurisdiction, processed by an affiliate outside the EU/EEA, or processed by one of the provider's authorized subprocessors.

12.2Where GDPR requires safeguards for such transfers, Accquix expects the relevant provider relationship to rely on an applicable lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where applicable, or another mechanism permitted under applicable data-protection law.

12.3A label such as “EU region” in the table describes the intended or configured location of relevant infrastructure and should not be understood as a representation that no operational, support, security or subprocessor access can ever occur outside that region.

13.1Accquix aims to minimise the amount of information disclosed to each technology provider. Where technically and operationally appropriate, Accquix may use the measures listed below:

• Pseudonymous identifiers
• internal object references
• derived data instead of source documents
• restricted service accounts
• separate production environments
• private object storage
• role-based access controls
• tenant isolation
• and limited provider-specific credentials.

13.2A provider should receive only the information reasonably required for the function it performs.

14.1Accquix may add, replace or remove providers where necessary to improve reliability, improve security, reduce processing risk, improve data residency, introduce Accquix Pro functionality, replace a discontinued service, or otherwise provide the contracted services.

14.2A change to a software library that processes data locally and does not introduce a new third-party recipient of client personal data does not normally constitute a new subprocessor.

14.3A material change involving a new third party processing personal data on behalf of Accquix may be reflected in an updated version of this page. For recurring services, Accquix may also notify affected clients by e-mail or another appropriate communication method.

15.1Where the Accquix Data Processing Agreement applies and grants the client a right to object to a new subprocessor, the applicable objection procedure and deadline are governed by that DPA.

15.2An objection should be based on reasonable grounds relating to personal-data protection. Where reasonably possible, Accquix and the client may seek an alternative arrangement. If a provider is technically necessary for the relevant service and no reasonable alternative is available, the consequences are governed by the applicable agreement between Accquix and the client.

16.1Technology providers may change corporate entities, subprocessors, infrastructure regions, transfer mechanisms, service architecture or contractual terms. The provider names, entities and locations on this page therefore describe the relevant Accquix configuration and publicly available provider information as of the effective date of this version.

16.2Where there is a difference between a general description on this page and the binding contractual terms governing a specific provider relationship, the applicable contractual terms and data-processing agreement with that provider determine the provider's obligations.

17.1Questions concerning subprocessors, technology providers or the processing of personal data may be sent to:

• Accquix
• Serhii Shokha
• Lermontovova 911/3
• 811 05 Bratislava - Staré Mesto
• Slovakia
• E-mail: serhii.shokha@gmail.com