Data processing agreement

§ 1 Parties and conclusion

1. This agreement is concluded between the customer who uses E-Rechnungsfreund with a customer account and processes personal data of third parties in it (controller, hereinafter "customer") and the provider (processor, hereinafter "provider"):
   Nils Wehner, Wolfsgrube 11, 97493 Bergrheinfeld (Legal notice)
2. This agreement applies to all customers who use E-Rechnungsfreund for business purposes. It is part of the usage agreement according to our terms and conditions and is concluded together with the acceptance of the terms and conditions; a separate signature is not required (electronic form, Art. 28(9) GDPR).
3. In matters of data protection, this agreement takes precedence over the terms and conditions.

§ 2 Subject matter and duration

1. The subject matter is the provision of the web application E-Rechnungsfreund for creating, importing, validating, managing and exporting e-invoices (ZUGFeRD, XRechnung), including the API. In doing so, the provider processes the personal data contained in the customer's invoice data and files.
2. The agreement runs as long as the customer account exists and ends with the deletion of the customer account. The end of a paid plan does not end the agreement, because the customer account continues in the free plan.

§ 3 Nature and purpose of the processing

1. Nature of the processing: collection (input in forms, upload, API), storage, validation, generation of XML and PDF files, display, export and download, sending by e-mail as well as deletion.
2. Purpose of the processing: performance of the usage agreement. The provider does not use the data for its own purposes.
3. Files that are only validated and not imported are only processed temporarily for the validation and are not stored afterwards; for counting the validation quota, only the time and the file name are stored.
4. On the customer's instruction, the provider sends invoices including the stored PDF or XML file by e-mail to the recipients specified by the customer. To count the e-mails included in the plan, the recipient address, the time of sending and the reference to the invoice are stored; these entries are deleted automatically after 13 months and immediately when the customer account is deleted.

§ 4 Types of personal data and categories of data subjects

Types of personal data:

• Master and contact data of the invoice parties (name, address, e-mail address, telephone number, contact persons)
• Tax identifiers (VAT identification number, tax number)
• Bank details (IBAN, BIC, account holder)
• Invoice content (items, quantities, prices, amounts, dates, references, notes)
• Payment and status data recorded by the customer
• Uploaded and generated files (XML, PDF, attachments) and saved party templates

Categories of data subjects:

• Customers, suppliers and other business partners of the customer and their contact persons
• Employees and other persons of the customer named in invoices

The processing of special categories of personal data (Art. 9 GDPR) is not intended. The customer does not enter such data.

§ 5 Instructions

1. The provider processes the data only on documented instructions from the customer, including with regard to transfers to a third country, unless it is required to do so by Union or Member State law; in that case, the provider informs the customer before the processing, unless that law prohibits such information.
2. The instructions are laid down in this agreement and are given by the customer's use of the functions of the application (e.g. creating, changing, exporting and deleting invoices). Further instructions are given in text form to privacy@e-rechnungsfreund.de.
3. The provider informs the customer immediately if, in its opinion, an instruction infringes data protection law (Art. 28(3) sentence 3 GDPR).

§ 6 Confidentiality

The provider ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

§ 7 Security of processing

The provider takes the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 1 (technical and organisational measures). It may adapt the measures to technical progress, provided that the level of protection is not reduced.

§ 8 Sub-processors

1. The customer gives its general authorisation to engage the sub-processors listed in Annex 2.
2. The provider informs the customer in text form (e-mail to the address of the customer account) in advance of any intended addition or replacement of sub-processors. The customer may object to the change within 14 days of receipt of the information for important reasons of data protection. If no agreement is reached, the customer may terminate the usage agreement with effect from the time of the change.
3. The provider imposes the same data protection obligations as set out in this agreement on each sub-processor by contract (Art. 28(4) GDPR).
4. Data is only transferred to a third country if the requirements of Art. 44 et seq. GDPR are met.

§ 9 Assistance to the customer

1. Rights of data subjects: The customer can view, correct, export and delete the data in the application itself. Where this is not sufficient, the provider assists the customer on request with appropriate technical and organisational measures. If a data subject contacts the provider directly, the provider forwards the request to the customer.
2. The provider assists the customer in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to the provider.
3. Personal data breaches: The provider notifies the customer without undue delay after becoming aware of a personal data breach (Art. 33(2) GDPR) by e-mail to the address of the customer account. The notification contains the information pursuant to Art. 33(3) GDPR, as far as it is available; information may be provided in phases. The notification to the supervisory authority and to the data subjects is the responsibility of the customer.

§ 10 Deletion and return of data

1. The customer can download individual invoices and export all of its invoices as a ZIP file in the customer area at any time (stored original files of imports and the most recently generated ZUGFeRD PDF or XRechnung XML). This export is the return of the data.
2. When the customer deletes the customer account, all invoices including their files, party templates and management data are deleted. Before the deletion, the application points out the export option. Statutory retention of invoices is the responsibility of the customer; E-Rechnungsfreund is not an archive within the meaning of the GoBD.
3. Deleted data remains in the daily backups on the server until they are deleted in the course of the regular rotation after 14 days.

§ 11 Evidence and inspections

1. The provider makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular this agreement, the technical and organisational measures and the list of sub-processors.
2. The provider allows for and contributes to audits, including inspections, conducted by the customer or another auditor mandated by the customer. Inspections are agreed in advance with reasonable notice; auditors are bound to confidentiality.

§ 12 Liability and further information

Liability is governed by Art. 82 GDPR and the terms and conditions. Information on the processing of the customer's own data (account, payment) can be found in our privacy policy.

Annex 1: Technical and organisational measures

Technical and organisational measures (Art. 32 GDPR)

Annex 2: Sub-processors

The following sub-processors process customer data under this agreement:

Encrypted backups at an external storage provider are planned. If a sub-processor is engaged for this, the provider informs the customer in advance in accordance with § 8(2).

The following services do not process invoice data and are not sub-processors under this agreement; they are described in the privacy policy:

• Transactional e-mails to the customer (account, subscription): no invoice data. Like the invoices sent by the customer by e-mail, they are sent via the mail server of STRATO in Germany (see above); no further service provider is involved.
• Stripe: payment of paid plans; Stripe only processes the customer's own billing data.
• Web analytics and conversion tracking (Matomo, Google tag): only on the website and only with consent in the cookie banner, no invoice data.

The validation of e-invoices runs on the provider's own server. Invoice data is not passed on to AI services.