Data processing agreement
Most families never need this. It matters when you use isna in a semi-professional context, or when somebody asks you for a DPA — these are the terms, under Article 28 GDPR.
Last updated: 18 October 2026 · If anything on this page does not match what you see in the app, write to info@isna.app — that is a mistake and it will be corrected.
Subject and duration
You are the controller and EDVIN KOVAČEVIĆ PR EK IT SOLUTIONS 2020 is the processor. The subject is the processing of personal data you enter into isna, in order to provide the service described in the Terms. Processing lasts as long as your account does.
We process only on your instruction. Using the application is that instruction.
Types of data and categories of people
Types of data. Identification and contact details, appointments and obligations, documents and files, financial records, vehicle details, and — if you enter them — health data, which is a special category under Article 9.
Categories of people. The members of your household, including children, and the contacts you enter.
The processor’s obligations
- Processing only on your documented instruction.
- A duty of confidentiality for anyone with access — at present that is one person.
- The technical and organisational measures of Article 32; what they are in practice is on the Security and privacy page.
- Help in answering data subject requests — in practice through the export and deletion that already exist as buttons.
- Help with impact assessments and prior consultation, as far as it is available to us.
Subprocessors
General authorisation is given for the subprocessors listed on the Subprocessors page. Any change to that list is announced at least 30 days beforehand to the account’s email address, and within that period you may object and end the agreement.
Breach notification
We notify you of a personal data breach without undue delay and within 72 hours of becoming aware of it, with what is known at that point: what happened, who it concerns, what has been done, and what we recommend.
Deletion or return
When the service ends, data is deleted or returned, as you choose. Export is available throughout, and afterwards for as long as the account exists. After deletion, data also leaves the backups within their 30-day cycle.
Audit
On request we provide the information needed to demonstrate compliance with Article 28 and allow for audits, including inspections, conducted by you or an auditor you appoint, with reasonable notice and without disrupting other users.
For a signed copy, write to info@isna.app. The version on this page and the signed copy say the same thing.
Start with the one deadline you cannot afford to miss.
Set your family up in two minutes. Thirty days of everything, and it does not ask for a card.