Data processing terms (accounts)

These terms are part of the terms of service and meet Article 28 of the GDPR ^[1]. They apply to the personal data in what you add to your account: identifiers and your references for your own company, your customers and your clients, and the names you give client workspaces. Some of these can identify a person (for example a sole trader's VAT number). You are the controller of that data; Mohamed (Mo) Farag ("we") is your processor. These terms exist in English only.

1. What we process

Purpose	checking the identifiers against the public Peppol network, telling you what changed, keeping the history and the reports your plan includes
Nature	storing your lists, checking them against the public Peppol network, comparing with earlier checks, emailing alerts, making reports and evidence PDFs, sending webhooks you set up, exporting and deleting
Data	business identifiers (VAT, company and Peppol numbers), your own references, client workspace names, and the network's answers about them (provider, document types, certificate)
People concerned	your customers and clients, where they are sole traders or otherwise identifiable
Duration	while your account is open, then deleted within 30 days of closing it

We never add names, contact details or anything else about these companies or people, and we never use your lists for anything but your account: not for our statistics, not for marketing, not for anyone else.

2. Our obligations

• We process the data only on your documented instructions, which are these terms and what you do in your account, including on transfers outside the EU: we make none except as section 4 says, unless EU or Spanish law requires it, and then we tell you first unless the law forbids that. If we think an instruction breaks data protection law, we tell you.
• Everyone who works on the service is bound to confidentiality.
• Security: encrypted connections (TLS); login links and sessions stored only as hashes; no passwords; access to the server limited to Mohamed (Mo) Farag by key; the server runs in the EU; daily backups are compressed copies on that EU server, kept 30 days; rate limits against abuse. Checking an identifier means asking the public Peppol network about it (OpenPeppol's SML and the provider's SMP), as any Peppol participant does before sending an invoice; nothing else is sent with it.
• We help you answer requests from the people concerned (access, correction, erasure). If someone asks us directly about data you control, we pass the request to you without undue delay and don't answer it ourselves. In the account you can download your lists, remove entries and close the account.
• We help you with security, breach notification (GDPR arts. 32–34), and impact assessments and prior consultation (arts. 35–36), as far as our role and the information we have allow.
• We tell you about a personal data breach affecting your data without undue delay, within 48 hours of finding it: what happened, the data and people concerned (approximate numbers), how to reach us, the likely effects, and what we did about it. We add what we learn later.
• At the end, you choose: we give you an export of your lists, or we delete them (within 30 days of closing the account; backups roll off within a further 30 days), unless the law requires us to keep them.
• Information and audits. On request we give you the information needed to show that we meet these terms. You, or an auditor you appoint who is bound to confidentiality, may audit us once a year with 30 days' notice, during working hours and at your cost, without access to other customers' data. We first answer in writing and with the certifications of our hosting provider; an inspection on site follows only if that doesn't settle the question or a data protection authority requires it.

3. Sub-processors

You authorise these sub-processors. We tell you by email at least 30 days before adding or replacing one, or, if our own supplier gives us less notice, as soon as we hear and at least 10 days before. You can object, and if we can't resolve the objection you can cancel and get the unused part of a prepaid period back. We bind each sub-processor by contract to the same data protection duties, and we stay responsible to you for them.

Sub-processor	What for	Where
Hetzner Online GmbH	server and backups	Germany
Cloudflare, Inc.	delivering the site and API, protection against attacks	USA and a global network; EU–US Data Privacy Framework, standard contractual clauses as fallback
Lettermint B.V. (Netherlands)	sending your login links and change emails (your email address and the email text)	EU servers; delivery logs 28 days

Stripe is not a sub-processor for these lists: it handles payments and never sees them.

4. Transfers outside the EU

We don't move your data outside the EU ourselves. Requests to our site and API pass through Cloudflare's network, under the EU–US Data Privacy Framework, with standard contractual clauses as fallback.

5. Your responsibilities

You confirm that you have a lawful basis to add these identifiers and have informed the people concerned where the law requires. You add only business identifiers and your own references, never special categories of data. If you add data for your own clients (client workspaces) and act as their processor, you confirm that they authorised you to use us, and we are then your sub-processor on these same terms.