GDPR: what it means for faktoora users
What is the GDPR?
Since 25 May 2018, all companies operating in the EU have had to comply with the General Data Protection Regulation (GDPR, in German: DSGVO). Whereas many countries previously had their own data protection laws of varying scope, the GDPR standardises the rights relating to personal data and introduces requirements that all companies operating in the EU must comply with. The legislators' main aim was to strengthen the rights of individual citizens. It must now be clear what data companies collect and how they use it. Where processing is based on consent, the people concerned can withdraw that consent at any time.
The internet never forgets!
And very importantly: everyone generally has the right to have their data deleted, the so-called right to be forgotten. However, this does not apply to data that is subject to a statutory retention obligation, for example tax-relevant documents such as your invoices.
What does this mean for you?
As a faktoora user, the GDPR affects you both as a customer and as a business owner who stores customer data on our platform. faktoora takes data protection seriously: the data is stored with a hosting provider in Germany on ISO 27001-certified infrastructure.
When you process information such as customer names, addresses or transaction data with faktoora, faktoora is your data processor. The data processing agreement (AVV) is linked to your main contract with faktoora and applies without a separate signature. This matters, because the GDPR applies to all companies regardless of size and turnover, and the fines are high: under Art. 83 GDPR, they can amount to up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.