Data processing agreement (DPA)

1. Subject matter and duration

The subject matter is the provision of the service under the terms and conditions: creating, calculating and checking e-invoices and, in Pro, storing the customer's working data. The agreement runs as long as we process data on behalf of the customer, in Pro until the account is deleted.

Not covered by this agreement is the data for which we are the controller ourselves: the account's login data, the data of the subscription and payment, usage statistics and requests to us. Our privacy policy applies to it.

2. Nature and purpose of the processing, data and data subjects

• Free generator: we process the entered invoice data in memory only to calculate, create and check the invoice, and deliver the file. After that the data is discarded and not stored.
• Pro: in addition storing and showing the company data, bank details, invoice settings, logo and customers of the customer, and the number, date and customer name of the last generated invoice. We do not store generated invoices.
• Types of data: names, addresses, e-mail addresses and telephone numbers, VAT identification numbers and tax numbers, bank details, Leitweg-IDs and buyer references, invoice lines and amounts.
• Data subjects: customers of the customer and their contact persons, the customer themselves where they are a natural person, and their contact persons.

Special categories of personal data (Art. 9 GDPR) are not intended for the service. The customer does not enter them.

3. Instructions

We process the data only on documented instructions of the customer, unless the law of the EU or Germany requires us to process it; in that case we inform the customer beforehand unless the law prohibits it. The instructions are set out conclusively in the terms and conditions, in this agreement and by the use of the functions of the service (for example saving, changing, exporting and deleting). The customer gives further instructions in text form. We need to follow instructions that go beyond the functions of the service only if they are technically and economically reasonable; we may charge a reasonable fee for the effort.

If in our view an instruction infringes data protection law, we inform the customer and may suspend it until they confirm or change it.

4. Confidentiality

Persons with access to the data on our side are committed to confidentiality or are under a statutory obligation of confidentiality. We do not look at the customer's data except where this is necessary to fix a fault, for the security of the service or on the customer's instruction.

5. Technical and organisational measures

We take the measures under Art. 32 GDPR described in the annex below. We may develop them further as long as the level of protection does not decrease.

6. Subprocessors

The customer gives a general authorisation for the use of subprocessors. We currently use:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: operation of the servers (data centre in Germany).
• [To be added before the launch: provider, address and location of the encrypted database backups.]

Our e-mail and payment providers receive no data that we process on behalf of the customer.

We announce a new or different subprocessor by e-mail to the account's address at least 6 weeks in advance. The customer can object in text form until the change for an important reason of data protection. If we cannot remove the reason, the customer can terminate the contract for Pro with effect from the change. They have no further claims because of it.

We bind every subprocessor by contract to the obligations of this agreement as far as they apply to its service.

7. Place of processing

We process the data in the EU. Processing outside the EU and the EEA takes place only if the conditions of Art. 44 et seq. GDPR are met.

8. Assistance to the customer

The customer answers requests from data subjects. In Pro they can handle most of them themselves: view, change, delete and export data. If we receive a request that clearly concerns the customer, we forward it to them and do not answer it ourselves.

Beyond that we assist the customer with requests from data subjects and with their obligations under Art. 32 to 36 GDPR, as far as they cannot obtain the necessary information from the service, this agreement or the privacy policy themselves. We may charge a reasonable fee for the effort unless it arises from a breach of this agreement or of data protection law on our part.

9. Personal data breaches

If we become aware of a breach of the security of the customer's data, we inform them without undue delay by e-mail to the account's address, with the information under Art. 33(3) GDPR as far as it is available to us; missing information follows later. Notifying the supervisory authority and data subjects is the customer's task.

10. Deletion and return

The data of the free generator is discarded at the end of every request. In Pro the customer can download their data as a file at any time with “Export my data”; this fulfils the return. If the customer deletes their account, we delete all of the customer's data at once. If the access to Pro ends without renewal, we delete the data after 6 months as described in the terms and conditions. Deleted data disappears from the backups when they are overwritten, at the latest after [to be added before the launch] days.

11. Evidence and inspections

On request we provide the customer with the information necessary to demonstrate our obligations under Art. 28 GDPR. Primarily this agreement with its annex, information by e-mail and evidence of our subprocessors (for example certifications) serve this purpose.

If this evidence is not sufficient in an individual case, the customer can carry out an inspection or have it carried out by an auditor bound to confidentiality who is not our competitor. They announce it in text form at least 4 weeks in advance. It takes place during normal business hours, without disturbing operations and without access to data of other customers, and at most once a year except after a breach of the security of their data. The customer bears the costs of the inspection; we may charge a reasonable fee for our effort. Inspections of our subprocessors' data centres follow their terms.

12. Liability and final provisions

Liability towards data subjects is governed by Art. 82 GDPR. Between the customer and us the liability provisions of the terms and conditions (section 12) apply.

In case of contradictions between the terms and conditions and this agreement, this agreement takes precedence for the protection of personal data. Section 9 of the terms and conditions applies accordingly to changes of this agreement; changes required by law or a supervisory authority we may make with a notice by e-mail. The law of the Federal Republic of Germany applies. This agreement is also available in English. The German version is binding.

Annex: technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access: the servers are in data centres of Hetzner Online GmbH in Germany, certified under ISO/IEC 27001. Hetzner controls physical access. We have no servers of our own in offices.
• Access to the systems: only the provider themselves has access to the servers. [To be added before the launch: login to the server and firewall.] The database cannot be reached from outside. The admin view is not publicly reachable, only through an encrypted SSH connection to the server, and requires its own login.
• Access of customers: passwords of at least 12 characters, checked against a list of common passwords and stored only as a hash (Argon2id); lockout for 15 minutes after 5 wrong passwords; a limit of login attempts per IP address; sessions end after 30 minutes without activity; cookies only over HTTPS and not readable by scripts; keys in e-mail links and for “Stay logged in” stored only as a hash and valid only once; after a password change all other sessions end.
• Access to data: strict separation of customers: every database query is restricted to the account of the logged-in customer, which comes only from the login, never from input. Automated tests check this for every query. The application works with a database user that can read and write data but cannot change the structure of the database. The admin view shows only account data, never customers, addresses, bank details, tax numbers, the logo or the last invoice.
• Separation: the data of every customer is separated by an identifier of their account. The free generator stores no data. Development and tests never work with customer data.
• Data minimisation: no invoice content in logs; temporary files of the validation only in memory; no analytics or tracking tools; logs are deleted after 14 days.

Integrity

• Transfer: all connections to the service are encrypted with TLS (HTTPS with HSTS). Database backups are stored encrypted. Customer data goes only to the subprocessors in section 6.
• Input: changes are possible only when logged in, in one's own account, protected against requests from other websites (origin check and token). Security-relevant events (for example logins, failed logins and rejected requests) are logged without content.
• Input is checked: all input is checked on the server for length, format and allowed values; amounts are calculated on the server; every generated file is checked against the rules of EN 16931 and XRechnung before it is delivered.

Availability and resilience

• Daily encrypted backup of the database outside Hetzner; the restore is tested.
• Protection against overload by limits on requests and on the size of input and uploads.
• Automatic restart of the application after a failure.

Review and evaluation

• Every change of the application is checked with automated tests before it goes live, including tests of the separation of customers and of security.
• Libraries in use are updated regularly and checked for known vulnerabilities.
• We review these measures at least once a year and after every significant change.