Data Processing Agreement (DPA)

Save this version (TXT) · 2026-11-03

The customer is the controller and OzyCore GmbH is its processor. For the duration of the engagement OzyCore receives, stores, validates, processes and exports invoices. Data includes identifying, contact, banking, invoice and usage details of suppliers, customers, employees and other people named in documents.

Bindingness

The organization enters into this agreement with OzyCore by express electronic acceptance. Individual instructions and amendments can be documented in text form.

Instructions, safeguards and audits

OzyCore processes data only on documented instructions, including transfers outside the EEA. If the law requires processing, OzyCore informs the customer in advance where permitted. OzyCore immediately flags instructions it considers unlawful. Authorized staff are bound to confidentiality. OzyCore applies appropriate Article 32 measures, assists with data subject requests and Articles 32–36, and reports personal data breaches without undue delay with available information. It provides evidence and allows audits including inspections by the customer or its auditor.

Subprocessing and return

The customer generally authorizes listed subprocessors. OzyCore gives advance notice of changes with time to object, imposes equivalent data protection duties and remains responsible for their performance. After processing ends, OzyCore returns or deletes personal data at the customer’s choice and deletes remaining copies unless EU or member state law requires storage. Customers can communicate their choice through support.

Support access and misdirected data

Authorized staff access is limited to service delivery and necessary support or incident handling. Account impersonation is time-limited and logged. Customers may request information about access and report private or improperly submitted data for separate return or deletion.

Subprocessors (full list)

• Supabase Pte. Ltd. (Singapore) – database, object storage and authentication; primary storage in Frankfurt (AWS eu-central-1). Contractual basis: Supabase DPA of 1 August 2026 with EU Standard Contractual Clauses, Module 2 or 3 according to the role. Other processing locations follow the DPA. • Vercel, Inc. (USA, EU-US Data Privacy Framework) – hosting of the web and API layer in the EU region Frankfurt (fra1); account and log data may be processed in the USA; EU Standard Contractual Clauses • Mailgun Technologies, Inc. (USA) – receiving and sending email via the EU region; EU Standard Contractual Clauses • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses • Inngest, Inc. (USA) – execution of background jobs (job metadata, no invoice content); location per vendor, EU Standard Contractual Clauses • Upstash, Inc. (USA) – rate limiting (hashed keys, no content); location per vendor, EU Standard Contractual Clauses • Fly.io, Inc. (USA) – operation of the KoSIT validator and the PDF review sandbox in the Frankfurt region; EU Standard Contractual Clauses • Microsoft Ireland Operations Limited – Azure Document Intelligence (OCR) in the Germany West Central region

Annex: professional secrecy for tax advisors

Where OzyCore participates in a tax advisory firm’s professional work as its service provider, section 62a StBerG together with section 203 StGB applies in addition. OzyCore undertakes an unlimited duty of confidentiality for client and professional secrets it can access and may learn them only to the extent necessary for the commissioned technical service. Unauthorized disclosure may be punishable under section 203 StGB. This duty survives termination. OzyCore does not thereby provide tax or legal advice.

OzyCore may engage further persons only as necessary. Before potential access to secrets, they must be bound to confidentiality in text form and informed of the criminal consequences; the same requirements must be ensured for further participants. The DPA list describes data-protection subcontracting. It replaces neither proof of the professional-secrecy obligation chain nor the assessment of comparable secrecy protection for foreign services under section 62a(4) StBerG. OzyCore provides information needed for the firm’s careful selection. Secrets may be disclosed only once required evidence and any necessary permissions are in place.

A firm may access only expressly authorized clients and necessary tasks. A referral code does not replace client authority or any otherwise required consent. Authorization, acting role, scope and revocation must be traceable. Clients may revoke platform access in account settings. Revocation ends future platform access but does not recover copies already lawfully exported. Their further treatment follows the advisory engagement and applicable statutory duties. Access to secrets must end if confidentiality can no longer be ensured.

Mail-relay / email reception for customer domains

If the customer delegates its own domain (e.g. invoice@samplecompany.com) to the processor or points MX records to the processor's mail servers for inbound e-invoice reception, the following supplementary clause to the data-processing agreement pursuant to Art. 28 GDPR applies to the associated processing of personal data. This clause is a binding part of the data-processing agreement.

Subject matter and duration

The customer forwards only the dedicated invoice mailbox or subdomain. Processing continues until return or deletion under the DPA.

Nature and purpose of processing

Receipt and technical processing of invoice emails, storage of originals and metadata kept in the account, supported-format validation and plan-dependent exports. The customer uses a dedicated invoice address.

Types of personal data

• Sender and recipient addresses including display names • Data on invoice issuers and recipients (name, company, address, VAT ID, bank details) • Free-form content in email bodies and attachments • Technical metadata (SMTP headers, timestamps, IP addresses of submitting mail servers)

Categories of data subjects

• Suppliers, service providers and business partners of the customer • Customer employees responsible for incoming invoices and accounting • Third parties named in invoices or accompanying email correspondence

Subprocessors

The following subprocessors are engaged for the reception and storage of email. All processing takes place within the EU or under EU standard contractual clauses: • Mailgun Technologies, Inc. – reception and acceptance of inbound email • Supabase Pte. Ltd. (Singapore) – database, object storage and authentication; primary storage in Frankfurt (AWS eu-central-1). Contractual basis: Supabase DPA of 1 August 2026 with EU Standard Contractual Clauses, Module 2 or 3 according to the role. Other processing locations follow the DPA. • Vercel, Inc. – hosting of the web and API layer (EU region, location fra1) • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses The processor contractually binds subprocessors to an equivalent level of protection and notifies the customer before engaging or replacing additional subprocessors. The full list is available in the “Subprocessors (full list)” section.

Technical and organisational measures

• Encryption in transit via TLS (STARTTLS where the sending server supports it) • Encryption at rest (AES-256 in object and database storage) • Tenant isolation via row-level security at the database layer • Recorded actions with hash and modification protection; no WORM or GoBD certification promise • Access only for necessary tasks; multi-factor authentication for the internal admin interface

Customer obligations and responsibility

• The customer remains controller within the meaning of Art. 4 No. 7 GDPR and ensures that the delegation of its domain (DNS/MX configuration) is lawful • The customer informs affected suppliers and business partners pursuant to Art. 13/14 GDPR about the processing of their data • The mail-relay feature is used exclusively for business invoice reception; private or unrelated email must be excluded • The customer nominates a point of contact for access, rectification and deletion requests by data subjects

Deletion and return of data

Relay data follows the same return and deletion rules as other customer data processed on instructions.