Data Processing Agreement

This translation is provided for convenience. Only the German version is legally binding.

Agreement on the processing of personal data on behalf of a controller

⬇ Download the DPA as PDF (v4.2)

Note: This version applies from 01.12.2026. Until 30.11.2026, the previous version applies: DPA version 4.1 (PDF).

Contracting Parties

Processing on behalf of a controller pursuant to Art. 28 GDPR (version 4.2, valid from 01.12.2026)

Agreement between

Processor faktoora GmbH, Amselweg 1, 89231 Neu-Ulm – Processor –

and

Controller (customer) (The controller (customer) is determined by the respective contractual relationship.) – Controller (customer) –

01 · General

(1) The processor processes personal data on behalf of the controller (customer) within the meaning of Art. 4(8) and Art. 28 of Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR). This contract governs the rights and obligations of the parties in connection with the processing of personal data.

(2) Where the term "data processing" or "processing" (of data) is used in this contract, the definition of "processing" within the meaning of Art. 4(2) GDPR applies.

02 · Subject Matter and Duration of the Engagement

The subject matter and duration of the engagement are determined entirely by the details given in the respective contractual relationship. In doing so, the processor processes personal data for the controller (customer) within the meaning of Art. 4(2) GDPR (processing) and Art. 28 GDPR on the basis of this engagement.

03 · Scope, Nature and Purpose of the Processing of Data

The scope, nature and purpose of the processing of personal data, the type of data and the categories of data subjects are described in Annex 1, unless they follow from the contractual content of the contractual relationships described in clause 2.

Processing takes place in principle in the EU/EEA. Where sub-processors based outside the EU/EEA are used in the provision of the services, or where access from third countries cannot be completely ruled out technically, this takes place exclusively in compliance with the requirements of Art. 44 et seq. GDPR and under the appropriate safeguards provided for in this agreement.

04 · Technical and Organisational Measures under Art. 32 GDPR

(Art. 28(3)(c) GDPR)

(1) The processor implements appropriate technical and organisational measures in accordance with Art. 32 GDPR in order to ensure a level of protection appropriate to the risk. The measures applicable at the time the contract is concluded are described in Annex 2 and are deemed agreed.

(2) The processor is entitled to adapt and further develop the technical and organisational measures, taking into account the state of the art and the further development of IT security, provided that the agreed level of protection is not undercut as a result. Material changes to the measures are documented.

(3) On request, the processor provides the controller (customer) with the current version of the technical and organisational measures.

05 · Rectification, Restriction of Processing and Erasure of Data

(1) The processor must not erase the data processed on behalf of the controller (customer), or restrict its processing, on its own authority. Where a data subject contacts the processor directly in this regard, the processor will forward this request to the controller (customer) without undue delay.

(2) Where possible, the processor supports the controller (customer) with appropriate technical and organisational measures in fulfilling the rights of data subjects under Chapter III GDPR (Art. 28(3)(e) GDPR). It implements erasure, rectification, data portability and access in accordance with the documented instructions of the controller (customer).

06 · Quality Assurance and Other Obligations of the Processor

In addition to complying with the provisions of this engagement, the processor has statutory obligations under Art. 28 to 33 GDPR; in this respect, it ensures in particular compliance with the following requirements:

• PROLIANCE GmbH has been appointed as the processor's data protection officer: Leopoldstr. 21, 80802 Munich, datenschutzbeauftragter@datenschutzexperte.de

• The current contact details of the data protection officer are readily available on the processor's homepage; any change is published there.

• Maintaining confidentiality in accordance with Art. 28(3)(b), Art. 29 and Art. 32(4) GDPR. When carrying out the work, the processor uses only employees who have been bound to confidentiality and have previously been familiarised with the data protection provisions relevant to them. The processor and any person acting under the authority of the processor who has access to personal data may process this data exclusively in accordance with the instructions of the controller (customer), including the powers granted in this contract, unless they are required by law to process it.

• The implementation of and compliance with all technical and organisational measures necessary for this engagement pursuant to Art. 28(3)(c) and Art. 32 GDPR and Annex 2.

• On request, the controller (customer) and the processor cooperate with the supervisory authority in the performance of its tasks.

• Informing the controller (customer) without undue delay of inspections and measures by the supervisory authority insofar as they relate to this engagement. This also applies where a competent authority investigates the processor in the context of administrative offence or criminal proceedings relating to the processing of personal data in the course of processing on behalf of a controller.

• Where the controller (customer) is itself subject to an inspection by the supervisory authority, administrative offence or criminal proceedings, a liability claim by a data subject or a third party, or any other claim in connection with the processing on behalf of a controller at the processor, the processor must support it to a reasonable extent; clause 14.1 applies.

• The processor regularly reviews its internal processes and the technical and organisational measures to ensure that processing within its area of responsibility is carried out in accordance with the requirements of applicable data protection law and that the protection of the rights of the data subject is ensured.

07 · Sub-processing

Sub-processors are third parties that process personal data on behalf of the processor in connection with the provision of the services. These may also include support services such as hosting, maintenance, support or monitoring, insofar as personal data is processed in the process.

(1) The controller (customer) grants the processor a general authorisation to engage further sub-processors within the meaning of Art. 28(2) GDPR. The processor informs the controller (customer) in text form at least three weeks before any intended change concerning the addition of new or the replacement of existing sub-processors. The controller (customer) has the right to object within three weeks of receipt of the notification, provided that there are legitimate reasons under data protection law. If the controller (customer) raises a justified objection and no mutually agreed solution is found, either party may terminate the main contract and this agreement extraordinarily with effect from the date on which the change takes effect. If neither party terminates before the change takes effect, the processor may implement the change. In urgent cases, in particular for security reasons or if a sub-processor ceases to be available, notification without undue delay after the fact is sufficient; the right to object applies accordingly. Sentences 2 to 6 apply accordingly if an existing sub-processor relocates the processing to a third country.

(2) The processor undertakes to select all sub-processors carefully and to ensure that they meet the requirements of Art. 32 GDPR through appropriate technical and organisational measures (e.g. industry-specific certifications such as ISO 27001). The relevant audit documentation is made available to the controller (customer) on request within a reasonable period, insofar as the sub-processor permits its disclosure.

(3) The processor regularly reviews its sub-processors' compliance with data protection obligations and documents the results. The processor provides evidence of this to the controller (customer) on request, insofar as confidentiality obligations towards the sub-processor do not prevent this. Audits of sub-processors are carried out primarily on the basis of their certifications and audit reports; the audit rights of the controller (customer) under clause 8 and Art. 28(3)(h) GDPR remain unaffected.

(4) The processor contractually imposes on each sub-processor the same data protection obligations as are set out in this contract, in particular sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing meets the requirements of the GDPR (Art. 28(4) GDPR).

(5) The processor is liable to the controller (customer) for the sub-processor fulfilling the data protection obligations contractually imposed on it by the processor in accordance with this section of the contract.

(6) The sub-processors listed in Annex 3 are currently engaged in the processing of personal data to the extent stated there. The controller (customer) consents to their engagement.

08 · Audit Rights of the Controller (Customer)

(1) Audits are carried out primarily by means of information, documentation, security evidence, certificates, audit reports and other suitable evidence. Where, in an individual case, this evidence is not sufficient to adequately verify compliance with the obligations under Art. 28 GDPR, the processor also enables further audits, including inspections to a reasonable extent, following prior coordination. In doing so, the confidentiality, operational and security interests of the processor and the rights of third parties must be safeguarded. On-site audits take place only after reasonable advance notice, during normal business hours and insofar as they are necessary and proportionate in the specific case. The controller (customer) may carry out audits itself or through an auditor appointed by it who is bound to confidentiality and is not a competitor of the processor. Inspections generally take place no more than once per calendar year, unless a specific occasion or a supervisory authority requires a further audit.

(2) The processor ensures that the controller (customer) can satisfy itself of the processor's compliance with its obligations under Art. 28 GDPR. The processor undertakes to provide the controller (customer) on request with the necessary information, insofar as this is not evident from the existing and accessible documents.

(3) Evidence of such measures that do not relate solely to the specific engagement may alternatively be provided by compliance with approved codes of conduct pursuant to Art. 40 GDPR, certification under an approved certification mechanism pursuant to Art. 42 GDPR, current attestations, reports or report extracts from independent bodies (e.g. auditors, internal audit, data protection officer, IT security department, data protection auditors, quality auditors) and/or suitable certification by IT security or data protection audit (e.g. in accordance with BSI IT-Grundschutz, German Federal Office for Information Security).

(4) The provision of existing evidence and of information under paragraphs 1 to 3 is free of charge. For inspections and for individual audits and questionnaires, the processor may claim reasonable remuneration at its applicable hourly rates, unless the audit has become necessary because of a demonstrable breach by the processor of this agreement or of obligations under data protection law.

09 · Support under Art. 32 to 36 GDPR and Notification of Personal Data Breaches

(1) The processor supports the controller (customer) in complying with the obligations set out in Articles 32 to 36 GDPR concerning the security of personal data, notification obligations in the event of personal data breaches, data protection impact assessments and prior consultations. These include, among other things:

a) ensuring an appropriate level of protection through technical and organisational measures that take into account the circumstances and purposes of the processing as well as the forecast probability and severity of a possible infringement through security vulnerabilities, and that enable relevant infringement events to be identified promptly

b) the obligation to report personal data breaches to the controller (customer) without undue delay; insofar as known, the notification contains the information under Art. 33(3) GDPR, and information not yet available is provided in phases (Art. 33(4) GDPR)

c) the obligation to support the controller (customer) in the context of its duty to inform the data subject and, in this connection, to provide it with the relevant information available to it without undue delay

d) supporting the controller (customer) with its data protection impact assessment

e) supporting the controller (customer) in the context of prior consultations with the supervisory authority

(2) The processor may claim remuneration for support services that are not included in the service description and are not attributable to misconduct on the part of the processor.

10 · Authority of the Controller (Customer) to Issue Instructions

(1) The processor processes personal data exclusively on documented instructions from the controller (customer). The instructions are set out in this agreement and in the main contract and are issued through the use of the platform's functions. This also applies to the transfer of personal data to a third country or an international organisation, unless the processor is required to do so by Union or Member State law to which it is subject. In such a case, the processor informs the controller (customer) of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The controller (customer) confirms oral instructions in text form without undue delay.

(3) The processor must inform the controller (customer) without undue delay if it considers that an instruction infringes data protection provisions. The processor is entitled to suspend the execution of the instruction concerned until it is confirmed or amended by the controller (customer).

11 · Support and Error-Analysis Access (Account-Bound Access / Impersonation)

(1) The controller (customer) instructs and authorises the processor, for the purpose of error analysis, troubleshooting, technical support and handling support requests, to access the personal data processed on its behalf to the extent necessary, including access via the user interface in the view of a user account (impersonation). This instruction is deemed a documented general instruction within the meaning of Art. 28(3) GDPR; no separate instruction or approval in the individual case is required.

(2) Access is purpose-bound, follows the principle of data minimisation and is carried out exclusively by the processor's authorised personnel who are bound to confidentiality (Art. 28(3)(b), Art. 29 and Art. 32(4) GDPR).

(3) Accesses via the user interface (impersonation) are logged with time, accessing person and account concerned; administrative accesses to production systems are logged on a personal basis. The logs are made available to the controller (customer) on request within the scope of its audit rights (clause 8).

(4) In the context of this access too, the processor processes the data exclusively within the scope of this contract and not for its own purposes.

12 · Erasure and Return of Personal Data

(1) Copies or duplicates of the data are not made without the knowledge of the controller (customer). This does not apply to backup copies, insofar as they are necessary to ensure proper data processing, or to copies that the processor requires to fulfil its own legal obligations.

(2) After termination of the service agreement, the processor makes all data processed on behalf of the controller (customer) available to the controller (customer) for export during a retrieval period of 30 days (clause 5.2 of the T&Cs). After the retrieval period has expired, or earlier on the instruction of the controller (customer), the processor erases this data in compliance with data protection law, including the contents of API requests and responses; retention under commercial and tax law provisions is the responsibility of the controller (customer). Log data on logins, accesses and changes (audit trail) forms part of the data processed on behalf of the controller (customer) and is erased together with it. Backup copies are overwritten in the regular backup cycle of up to 12 months; until then, they are encrypted, access-restricted and used only for restoring data. If data is restored from a backup copy, the processor re-applies deletions carried out before the restore. On request, the processor informs the controller (customer) about the nature and the time of the erasure.

(3) Documentation that serves as evidence of processing carried out properly and in accordance with the engagement must be retained by the processor beyond the end of the contract in accordance with the respective retention periods. The processor may hand it over to the controller (customer) at the end of the contract to discharge itself.

13 · Mobile Working (Remote-first)

(1) The processor works location-independently ("remote-first") and does not maintain its own office or server rooms. The platform is operated in data centres in Germany (Annex 2); Annex 3 applies to sub-processors.

(2) Employees and other persons working for the processor may carry out their work from private homes and other mobile workplaces. In particular:

• Access to the processor's systems is always encrypted and requires personal authentication.
• Work devices are fully encrypted, lock automatically when inactive and are kept up to date with security updates.
• Data of the controller (customer) is stored on work devices only to the extent necessary in individual cases for error analysis and for reproducing reported errors, and is deleted once the analysis is complete. It is not stored on removable media or in private cloud storage.
• Work is carried out so that third parties cannot see personal data; production systems are accessed over public networks only through a secured connection.

(3) Access to personal data of the controller (customer) from a workplace outside the EU/EEA is permitted only under the conditions of Art. 44 et seq. GDPR (clause 3).

(4) The processor ensures the measures under Art. 32 GDPR (Annex 2) also when working remotely, reviews them regularly, documents this and makes the documentation available to the controller (customer) on request. Audits under clause 8 are carried out in this respect on the basis of this documentation and other evidence; access to private homes is excluded.

14 · Other Agreements

14.1 Fees

No fee is charged for this engagement. Where the controller (customer) requires support under clause 5 to respond to requests from data subjects, it must reimburse the costs incurred as a result. Clause 8(4) applies to audits. Data export and switching providers under clause 5.2 of the T&Cs are free of charge. If the controller (customer) issues instructions to the processor under clause 10 that go beyond the agreed scope of services or cause additional effort, it must reimburse the reasonable costs incurred as a result.

There is no obligation to pay remuneration where the respective support, audit or measure has become necessary because of a demonstrable breach by the processor of this agreement or of obligations under data protection law.

14.2 Term of the Agreement

This agreement is dependent on the existence of a main contractual relationship in accordance with clause 2. Termination or other ending of the main contractual relationship in accordance with clause 2 ends this agreement, subject to the following continued-validity provision. The right to separate extraordinary termination of this agreement and the exercise of statutory rights of rescission specifically for the agreement remain unaffected.

Where personal data is still processed after the end of the main contractual relationship in connection with return, export, erasure, backup retention or the provision of evidence, the provisions of this agreement continue to apply until these processing operations have been fully completed.

14.3 Choice of Law

The law of the Federal Republic of Germany applies.

14.4 Place of Jurisdiction

Clause 12.1 of the T&Cs applies to the place of jurisdiction.

14.5 Liability

Clause 9 of the T&Cs applies to liability; Art. 82 GDPR remains unaffected.

Signatures

Annex 1 · Personal Data and Purpose of Processing

Annex 1 to the engagement pursuant to Art. 28 GDPR – list of the personal data and the purpose of its processing

I. Types of data

The following types of data are regularly the subject of processing:

• Company name with names of contact persons and company address
• Contact details
• Outgoing and incoming invoices including attachments
• Bank transactions (when a bank account is connected)
• Communication and transmission data (sending and receiving email, Peppol, transmissions to tax authorities)
• API logs (requests to and responses from the application programming interface)
• User and access/authentication data (e.g. user ID, roles/permissions, access logs)
• Usage and log data (e.g. IP address, timestamps, technical metadata)
• Payment data
• The company's customer data for invoicing
• The company's product and service names

II. Categories of data subjects

Categories of persons affected by the data processing:

• Employees and customers of the controller (customer)
• Partners and service providers of the controller (customer)
• Suppliers of the controller (customer)
• Invoice recipients and invoice senders of the controller (customer)

III. Nature and purpose of processing

Provision of a web application and application programming interface for the creation, receipt, validation, delivery and storage during the contract term of invoices, credit notes and other business documents in accordance with EN 16931 and other formats; payment reconciliation; transmission to e-invoicing networks and tax authorities; optional automatic data extraction from incoming invoices; support.

Annex 2 · Technical and Organisational Measures

Annex 2 to the engagement pursuant to Art. 28 GDPR – technical and organisational measures under Art. 32 GDPR.

Note: Specific measures for working from home are based on the measures recommended by the BSI (Recommendations for working from home).

1. Confidentiality (Art. 32(1)(b) GDPR)

a. Physical access control

Data centre – Our servers are located in ISO 27001 certified German data centres of Hetzner Online GmbH.

• Physical access control, surveillance and escorting of visitors in accordance with the data centre operator's ISO 27001 certification

Administration/working from home

• Work devices are fully encrypted; employees are instructed not to leave them unattended
• Work devices lock automatically after a short period of inactivity and are locked when leaving the workplace
• Printouts containing personal data are destroyed after use
• Only personnel committed to confidentiality and data protection access personal data for support purposes
• Employees are instructed not to process personal data in the presence of third parties

b. System access control

Data centre – Administrative credentials and means of access for server and infrastructure systems are accessible only to the processor's employees authorised in each case and are used exclusively for the purpose of administering, maintaining and monitoring the infrastructure.

Working from home

• Employees are instructed to store passwords for access to accounts or systems in an encrypted password manager.
• Administrative access to server, cloud and development systems is protected by multi-factor authentication.

c. Data access control

Infrastructure

• The infrastructure provider operates its infrastructure in accordance with a documented security concept; when selecting it, the processor takes into account, among other things, recognised security evidence/certifications.
• The infrastructure provider implements physical and logical access controls in accordance with recognised standards; evidence results from the provider's corresponding certifications/audit reports.

Applications / internal administration systems

• regular security updates (in line with the current state of the art) ensure that unauthorised access is prevented.
• are reachable only via password-protected, personalised accounts
• Databases and internal data stores are not reachable from the internet; direct access is possible only via administrative access with multi-factor authentication
• Administrative applications require login via the identity provider with role-based authorisation
• Regular review and adjustment of access permissions

d. Data carrier control

Data centre

• Hard drives are overwritten (erased) several times by the infrastructure provider using a defined procedure. After verification, the hard drives are reused.
• Defective hard drives that cannot be securely erased are destroyed (shredded) directly in the infrastructure provider's data centre.

General / working from home

• Data carriers of employees that are no longer needed or are defective are overwritten (erased) several times and destroyed.
• Work devices and data carriers are fully encrypted; data of the controller (customer) is stored locally only in accordance with clause 13.

e. Separation control

• Customer data is stored physically or logically separated from other data.
• Customer data is also backed up on logically and/or physically separate systems.

2. Integrity (Art. 32(1)(b) GDPR)

a. Transfer control

General

• All employees have been instructed and are obliged within the meaning of Art. 32(4) GDPR to ensure that personal data is handled in compliance with data protection law.
• External transmissions are encrypted (TLS 1.2 or higher)
• Production systems and backups are encrypted (Art. 32(1)(a) GDPR)

Working from home

• Employees are instructed to create confidential documents/printouts only in exceptional cases and to destroy them immediately after use.
• Employees are instructed to dispose of data carriers that are no longer needed in an appropriate manner.

b. Logging / monitoring / error analysis

To ensure stability, availability and error correction, technical event and diagnostic data is processed. Processing follows the principle of data minimisation; identifying content is reduced as far as possible or removed by filtering/scrubbing. Access to diagnostic and monitoring systems is restricted on a role basis and is logged. Retention periods for diagnostic/error data are limited according to purpose. Account-bound support access (impersonation) to user accounts takes place exclusively on a role basis by authorised personnel and is logged (time, accessing person, account concerned).

3. Availability and Resilience (Art. 32(1)(b) GDPR)

a. Availability control

Servers

• Our servers are located in a Hetzner data centre in Germany that is certified in accordance with ISO 27001.
• All persistent data sets of the production platform are backed up in encrypted form at short intervals (currently at least every 2 hours) and stored at a physically separate location.
• Power supply and network protection in accordance with the data centre operator's ISO 27001 certification.

Working from home

• Customer data is stored on work devices only in accordance with clause 13 and only temporarily; work devices are fully encrypted.

b. Rapid recoverability (Art. 32(1)(c) GDPR)

Servers

• An escalation chain is defined for all systems, specifying who is to be informed in the event of a fault in order to restore the system as quickly as possible.
• Restoration from backups is practised and documented regularly.

Working from home

• Work devices can be replaced without loss of customer data, as the authoritative data set resides exclusively in the centrally backed-up platform.

4. Procedures for Regular Testing, Assessment and Evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)

a. Order control

Measures that ensure that personal data processed on behalf of the controller (customer) can only be processed in accordance with the instructions of the controller (customer). These comprise:

• Careful selection of sub-processors, in particular with regard to data protection
• Conclusion of the necessary agreements with sub-processors and their review

b. Organisational control

The internal organisation must be designed in such a way that it meets the specific requirements of data protection. This comprises the following measures:

• Employees are bound to confidentiality and instructed in data protection
• The technical and organisational measures are regularly reviewed and further developed.
• Customer-specific documentation of instructions and activities in the context of processing on behalf of a controller
• A documented process for the detection, assessment, containment and notification of security and data protection incidents is in place; incidents are documented and evaluated without undue delay.
• Vulnerabilities are detected by automated checks and remediated on a risk basis.

Annex 3 · Sub-processors

For the processing of data on behalf of the controller (customer), the processor uses the services of third parties that process personal data on its behalf ("sub-processors"). These are the following companies:

Recipients that receive data on the basis of a statutory obligation (e.g. tax authorities in the case of VeriFactu, KSeF or French e-invoicing), licensed payment service providers that provide account information and payment initiation services to users under their own responsibility (BANKSapi Technology GmbH, Munich), and services connected by the controller (customer) itself (e.g. accounting, ERP or CRM systems) are not sub-processors within the meaning of this Annex. The current overview is also available at trust.faktoora.com.

---

This version applies from 01.12.2026. For controllers (customers) whose contract was concluded before that date, it applies from 01.12.2026, but no earlier than four weeks after receipt of the notification of amendment, unless the controller (customer) objects within this period (amendment provision of the previous T&Cs, in future clause 8.10 T&Cs); the right to object to new sub-processors under clause 7(1) remains unaffected. Until then, the previous version applies.

faktoora GmbH · Data Processing Agreement · v4.2 · valid from 01.12.2026