Data Processing Agreement (DPA)

1. Definitions

• "GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• "Seller Data" means the data about your sellers that you upload to the Service, and anything we derive from it, such as the generated XML report and the validation report.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR. In the context of this DPA, it refers to the personal data contained in the Seller Data.
• "Processing" means any operation or set of operations which is performed on Personal Data.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates, that is, your sellers and the contact persons of your sellers that are entities.
• "Sub-processor" means a third party that we engage to process Personal Data on your behalf.

2. Roles and Responsibilities

Processor (getdac7.eu): We process Personal Data only on behalf of the Controller, as a processor under Article 28 GDPR, and only in accordance with the Controller's documented instructions (Section 5).

Controller (You, the Customer): You are the Data Controller for your sellers' data. You have the sole responsibility for the accuracy, quality, and legality of the Personal Data and the means by which you acquired it. You warrant that you have all necessary rights to provide the Personal Data to us for processing.

Data we control: We are the controller, not your processor, for data about visitors to our website and for your account and billing data. Our Privacy Policy describes how we handle that data.

3. Details of Data Processing

• Subject Matter: Processing Seller Data to validate it and to generate DAC7 XML reports for the Controller.
• Duration: Each processing run lasts from the moment you upload a file until the Seller Data is deleted, which is at most 1 hour after the report is ready and never more than 24 hours after upload (Section 8). This DPA applies for as long as you use the Service.
• Nature and Purpose: We receive the file you upload, check it against the DAC7 field rules and the tax authority's XML schema, generate the XML report and a validation report, make them available to you, and then delete them automatically. The purpose is to produce the DAC7 report that you submit to the tax authority, as directed by you through your use of the Service.
• Types of Personal Data: Seller identity data (names, business names, addresses, dates and places of birth, tax identification numbers, VAT numbers, financial account identifiers such as IBANs), property listing addresses, and payment figures (consideration, fees, taxes, number of activities).
• Categories of Data Subjects: Your sellers, both individuals and entities, operating on your platform, and the contact persons of sellers that are entities.

Checks against EU services: Where the Service performs these checks, it verifies VAT numbers through the European Commission's VIES service and tax identification numbers through the European Commission's TIN on-the-Web service. Only the VAT number or TIN and the country code are sent to these services. They are public-authority services that we use at your instruction, not sub-processors.

4. Rights and Obligations of the Controller

As the Controller, you have the right to:

• Give us documented instructions about the processing (Section 5).
• Object to a new or replacement sub-processor (Section 6).
• Be notified of personal data breaches (Section 7).
• Receive the information you need to verify our compliance, and audit us (Section 10).

As the Controller, you are responsible for:

• Having a legal basis for the processing and informing your sellers about it.
• The correctness of the Seller Data you upload and of the reports you submit to the tax authority.
• Sending Seller Data to us only through the upload in the Service. Do not send Seller Data to us by email.
• Downloading each report and keeping it, together with your other DAC7 records, for as long as the law requires (Section 8).

5. Obligations of the Processor

We, as the Processor, hereby commit to:

• Process data only on your instructions: We process Personal Data only on your documented instructions, including with regard to transfers to third countries. Your instructions are this DPA, the Terms of Service and the actions you take in the Service, such as uploading a file. If EU or Member State law requires us to process Personal Data in another way, we will tell you before we do so, unless that law prohibits it. We will tell you immediately if we believe an instruction infringes the GDPR or other data protection law.
• Ensure confidentiality: Only persons we have authorised may process Personal Data, and each of them has committed to confidentiality or is under a statutory obligation of confidentiality.
• Security measures: We take the measures required by Article 32 GDPR. Annex 1 lists the technical and organisational measures we apply. We may update them, but not in a way that lowers the protection of Personal Data.
• Data Subject Rights: Taking into account the nature of the processing, we help you, as far as possible, to respond to requests from Data Subjects exercising their rights under the GDPR. Because we delete Seller Data after each processing run, we will usually hold no data about the person making the request. If a Data Subject contacts us directly, we will forward the request to you without undue delay and will not answer it ourselves unless you instruct us to.
• Assistance with Articles 32 to 36 GDPR: Taking into account the nature of the processing and the information available to us, we help you meet your obligations on the security of processing, the notification of personal data breaches (Section 7), data protection impact assessments, and prior consultation with a supervisory authority.

6. Sub-processors

You give us a general written authorisation to engage sub-processors. We currently use one sub-processor:

• Amazon Web Services (AWS): Hosting and processing for the Service, in the AWS region eu-central-1 (Frankfurt, Germany).

We will notify you by email at least 30 days before we add or replace a sub-processor. You may object to the change within that period. If we cannot resolve your objection, you may stop using the Service before the change takes effect.

We engage a sub-processor only under a written contract that imposes the data protection obligations required by Article 28(4) GDPR, including sufficient guarantees that it applies appropriate technical and organisational measures. We remain responsible to you for how our sub-processors meet those obligations.

7. Personal Data Breaches

We will notify you of a personal data breach affecting Seller Data without undue delay and within 48 hours of becoming aware of it. The notice will describe, as far as the information is available to us, the nature of the breach, including the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures we have taken or propose to take. If we cannot provide all the information at once, we will provide it in phases without further undue delay. We will help you notify the supervisory authority and, where required, the affected Data Subjects.

Our contact point for data protection matters is contact@getdac7.eu.

8. Deletion and Retention

Deletion is continuous and happens by design. We delete Seller Data after every processing run, within these limits:

Seller data you upload (the file and anything we derive from it, such as the generated XML report and the validation report) is kept only while we process it and while the result is available for you to download, which is at most 1 hour after the report is ready. It is then deleted automatically. We never keep it longer than 24 hours after upload, even if you don't download the result. Seller data is not included in backups, and our logs don't contain the content of your files.

The results of each run are returned to you when you download the report. Because the Seller Data is then deleted automatically, no Seller Data is left to return or delete when the Service ends.

Your records: Because we delete Seller Data, keeping the downloaded report and your DAC7 records is your responsibility. DAC7 rules require platform operators to keep records for years, for example 10 years in Germany under § 24 PStTG. We cannot restore a report once it has been deleted.

Account data: If you create an account, we keep your account data (your name, email address and company, your platform's own details such as name, tax number and address, and your settings such as column mappings) while the account exists. We delete it within 30 days after the account is closed, except billing records, which we keep for as long as tax and accounting law requires. We handle account and billing data as controller, as described in our Privacy Policy.

9. Data Transfers

All Personal Data processed under this DPA is processed exclusively within the European Union (EU), on AWS in the eu-central-1 region (Frankfurt, Germany). There will be no transfers of Personal Data to any third country or international organization.

10. Audits

We make available to you all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and we allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you:

• Questionnaires: We answer your security and data protection questionnaires.
• On-site audits: You, or an auditor you mandate who is bound by confidentiality, may carry out an on-site audit with at least 30 days' written notice. On-site audits are at your cost and take place at most once a year, unless there has been a personal data breach affecting your Seller Data.

11. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in our Terms of Service.

Annex 1: Technical and Organisational Measures

We apply the following measures to Seller Data:

• Location: The Service runs on AWS in the eu-central-1 region (Frankfurt, Germany). Seller Data is processed only there.
• Encryption in transit: Data travels between your browser and the Service over HTTPS (TLS).
• Temporary processing: Each upload is processed in its own temporary working directory, which is deleted automatically within the limits in Section 8. Seller Data is not stored in a database and is not included in backups.
• Logging: Our application logs contain generic messages and error codes. They do not contain the content of uploaded files or generated reports.
• Access control: Access to the systems that process Seller Data is limited to authorised personnel.
• Minimal data for external checks: Where the Service checks VAT numbers or tax identification numbers with the European Commission's services, it sends only the number and the country code.
• No transfers outside the EU/EEA: We use only the sub-processors listed in Section 6 and do not transfer Seller Data outside the EU/EEA.