Skip to content
Cekira

Data processing agreement

Last updated 2 October 2026

This agreement covers personal data your business stores in Cekira about other people, such as your clients, their contacts and your team. Your business decides what happens to that data, and we process it for you. It is part of our terms and applies automatically, with nothing to sign.

Roles

You are the controller of this data and MASA SOLUTIONS LLC is your processor. If you process data for your own clients, we are your subprocessor. This agreement applies wherever data protection law applies, including the GDPR, UK GDPR, Swiss law and Serbian law. If it conflicts with our terms, this agreement wins; if it conflicts with the EU standard contractual clauses, the clauses win.

What we process

  • People: your clients and their contacts, your team and workspace users, and others named in your invoices, work records and uploaded documents.
  • Data: names, contact details, tax and registration numbers, bank details, invoice contents, work records and comments, and uploaded documents. Cekira is not meant for sensitive data such as health information.
  • Purpose and activities: providing Cekira to you: storing and showing your data, sending emails, generating PDFs and reading invoices you choose to import.
  • Duration: for as long as you use Cekira, until the data is deleted.

Our commitments

  • We process the data only on your instructions, which are our terms, this agreement and what you do in Cekira, unless the law requires otherwise. We tell you if an instruction seems unlawful.
  • We do not sell the data, use it for advertising or use it to train AI models.
  • Everyone who can access it is bound by confidentiality. Staff see a workspace only in read-only support sessions that are logged.
  • We protect it with appropriate security, described on our security page.
  • We help you answer requests from people about their data, and help with impact assessments and regulators where reasonable.
  • We tell you without undue delay if a data breach affects your data.
  • When you ask us to delete your account, we delete the data, unless the law requires us to keep it. Backup copies expire as described in our privacy policy.
  • We give you the information you need to check that we keep this agreement, and allow audits on reasonable notice and at your cost.

Subprocessors

You agree that we may use the hosting, storage, email and AI providers listed in our privacy policy, and our email provider for support messages. Each is bound by a contract that protects your data, and we remain responsible for them. We will tell you before adding or replacing one. If you object and we cannot resolve it, you may stop using Cekira. Services you connect yourself, such as Google or Linear, are not our subprocessors.

Transfers outside Europe

We are a US company, our staff work from Serbia, and some providers are in the United States. Where the law requires a safeguard for these transfers, the EU standard contractual clauses (Commission Decision 2021/914) are part of this agreement: Module Two, or Module Three where you are a processor, with you as exporter and us as importer. The optional clauses do not apply, Clause 9 option 2 applies, and Irish law and courts govern them. This page and our security page complete their annexes. For UK data, the UK addendum to those clauses applies; for Swiss data, they apply as adapted for Swiss law.

Liability and contact

The liability limits in our terms apply, except where data protection law or the standard contractual clauses do not allow it. Questions: support@cekira.com. Our company details, which complete the clauses' list of parties, are in our terms.