Data Processing Agreement (DPA)

The beta can only be used productively after individual approval and contractual coordination.

Note on the contract

This DPA draft is provided for transparency. The binding contract version is agreed individually between the parties before production use.

Mail-relay / email reception for customer domains

If the customer delegates its own domain (e.g. invoice@samplecompany.com) to the processor or points MX records to the processor's mail servers for inbound e-invoice reception, the following supplementary clause to the data-processing agreement pursuant to Art. 28 GDPR applies to the associated processing of personal data. The draft below is provided for transparency; the binding contractual version will be concluded individually between the parties prior to productive use.

Subject matter and duration

Processing covers the reception, acceptance and technical pre-processing of inbound emails on a domain controlled by the customer. It starts with delivery of the first email and ends once the statutory retention periods under §147 AO and GoBD have expired, at the latest with termination of the main contract plus the migration periods defined in the deletion clause.

Nature and purpose of processing

• Reception of inbound invoices via email on a domain controlled by the customer • Extraction and validation of structured invoice data (XRechnung, ZUGFeRD, Factur-X) • Audit-proof archiving of the original email including attachments • Provision of data for transfer to the customer's accounting systems (e.g. DATEV Unternehmen online) • Exclusion: the feature is strictly inbound; active sending of marketing or bulk email on the customer's behalf is not covered by this clause

Types of personal data

• Sender and recipient addresses including display names • Data on invoice issuers and recipients (name, company, address, VAT ID, bank details) • Free-form content in email bodies and attachments • Technical metadata (SMTP headers, timestamps, IP addresses of submitting mail servers)

Categories of data subjects

• Suppliers, service providers and business partners of the customer • Customer employees responsible for incoming invoices and accounting • Third parties named in invoices or accompanying email correspondence

Subprocessors

The following subprocessors are engaged for the reception and storage of email. All processing takes place within the EU or under EU standard contractual clauses: • Mailgun Technologies, Inc. – reception and acceptance of inbound email • Supabase, Inc. – database, object storage and authentication (EU region) • Vercel, Inc. – hosting of the web and API layer (EU region, location fra1) • Sentry GmbH – error and performance monitoring (DE region) The processor contractually binds subprocessors to an equivalent level of protection and notifies the customer before engaging or replacing additional subprocessors.

Technical and organisational measures

• Encryption in transit via TLS (STARTTLS where the sending server supports it) • Encryption at rest (AES-256 in object and database storage) • Tenant isolation via row-level security at the database layer • Audit-proof logs for access, modification and deletion • Access to production systems strictly on a need-to-know basis with multi-factor authentication

Customer obligations and responsibility

• The customer remains controller within the meaning of Art. 4 No. 7 GDPR and ensures that the delegation of its domain (DNS/MX configuration) is lawful • The customer informs affected suppliers and business partners pursuant to Art. 13/14 GDPR about the processing of their data • The mail-relay feature is used exclusively for business invoice reception; private or unrelated email must be excluded • The customer nominates a point of contact for access, rectification and deletion requests by data subjects

Deletion and return of data

After termination of the main contract, the emails processed via the mail-relay feature and the invoice data extracted from them will be deleted once the statutory retention periods under §147 AO have expired. Prior to expiry of these periods, the customer may retrieve the data at any time in a standardised export format (ZIP archive containing original email, PDF/A and structured XML invoice). Return in any other form is provided only on explicit request and against reimbursement of effort.