Data Processing Agreement (DPA)
This data processing agreement (DPA) under Art. 28 GDPR applies to all customers of e-Rechnung Inbox and governs the processing of invoice and contact data on our behalf.
Bindingness
This agreement applies to all e-Rechnung Inbox customers from contract conclusion onward. Individual amendments can be agreed in writing.
Subprocessors (full list)
• Supabase, Inc. (USA) – database, object storage, authentication; processed in the EU region Frankfurt (AWS eu-central-1); EU Standard Contractual Clauses • Vercel, Inc. (USA, EU-US Data Privacy Framework) – hosting of the web and API layer in the EU region Frankfurt (fra1); account and log data may be processed in the USA; EU Standard Contractual Clauses • Mailgun Technologies, Inc. (USA) – receiving and sending email via the EU region; EU Standard Contractual Clauses • Stripe Payments Europe, Ltd. (Ireland) – payment processing and invoicing • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses • Inngest, Inc. (USA) – execution of background jobs (job metadata, no invoice content); location per vendor, EU Standard Contractual Clauses • Upstash, Inc. (USA) – rate limiting (hashed keys, no content); location per vendor, EU Standard Contractual Clauses • Cloudflare, Inc. (USA, EU-US Data Privacy Framework) – bot protection (Turnstile) on public forms • Fly.io, Inc. (USA) – operation of the KoSIT validator and the PDF review sandbox in the Frankfurt region; EU Standard Contractual Clauses • Microsoft Ireland Operations Limited – Azure Document Intelligence (OCR) in the Germany West Central region • Google Ireland Limited – Google Analytics 4 and Google Ads only after consent via the cookie banner; no processing of invoice data (website usage only, not a subprocessor under Art. 28 GDPR for customer data)
Mail-relay / email reception for customer domains
If the customer delegates its own domain (e.g. invoice@samplecompany.com) to the processor or points MX records to the processor's mail servers for inbound e-invoice reception, the following supplementary clause to the data-processing agreement pursuant to Art. 28 GDPR applies to the associated processing of personal data. This clause is a binding part of the data-processing agreement.
Subject matter and duration
Processing covers the reception, acceptance and technical pre-processing of inbound emails on a domain controlled by the customer. It starts with delivery of the first email and ends once the statutory retention periods under §147 AO and GoBD have expired, at the latest with termination of the main contract plus the migration periods defined in the deletion clause.
Nature and purpose of processing
• Reception of inbound invoices via email on a domain controlled by the customer • Extraction and validation of structured invoice data (XRechnung, ZUGFeRD, Factur-X) • Audit-proof archiving of the original email including attachments • Provision of data for transfer to the customer's accounting systems (e.g. DATEV Unternehmen online) • Exclusion: the feature is strictly inbound; active sending of marketing or bulk email on the customer's behalf is not covered by this clause
Types of personal data
• Sender and recipient addresses including display names • Data on invoice issuers and recipients (name, company, address, VAT ID, bank details) • Free-form content in email bodies and attachments • Technical metadata (SMTP headers, timestamps, IP addresses of submitting mail servers)
Categories of data subjects
• Suppliers, service providers and business partners of the customer • Customer employees responsible for incoming invoices and accounting • Third parties named in invoices or accompanying email correspondence
Subprocessors
The following subprocessors are engaged for the reception and storage of email. All processing takes place within the EU or under EU standard contractual clauses: • Mailgun Technologies, Inc. – reception and acceptance of inbound email • Supabase, Inc. – database, object storage and authentication (EU region) • Vercel, Inc. – hosting of the web and API layer (EU region, location fra1) • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses The processor contractually binds subprocessors to an equivalent level of protection and notifies the customer before engaging or replacing additional subprocessors. The full list is available in the “Subprocessors (full list)” section.
Technical and organisational measures
• Encryption in transit via TLS (STARTTLS where the sending server supports it) • Encryption at rest (AES-256 in object and database storage) • Tenant isolation via row-level security at the database layer • Audit-proof logs for access, modification and deletion • Access to production systems strictly on a need-to-know basis with multi-factor authentication
Customer obligations and responsibility
• The customer remains controller within the meaning of Art. 4 No. 7 GDPR and ensures that the delegation of its domain (DNS/MX configuration) is lawful • The customer informs affected suppliers and business partners pursuant to Art. 13/14 GDPR about the processing of their data • The mail-relay feature is used exclusively for business invoice reception; private or unrelated email must be excluded • The customer nominates a point of contact for access, rectification and deletion requests by data subjects
Deletion and return of data
After termination of the main contract, the emails processed via the mail-relay feature and the invoice data extracted from them will be deleted once the statutory retention periods under §147 AO have expired. Prior to expiry of these periods, the customer may retrieve the data at any time in a standardised export format (ZIP archive containing original email, PDF/A and structured XML invoice). Return in any other form is provided only on explicit request and against reimbursement of effort.