Draft: this text has not been legally checked yet.
Data processing agreement
This data processing agreement belongs to the agreement about Bauabzug-kit. The customer is the controller. Angelista Enterprise B.V. is the processor.
1. Subject and duration
The processor processes personal data only to provide Bauabzug-kit, for as long as the agreement runs.
2. Nature, purpose and data
A self-service kit for the German Bauabzugsteuer: checklist, prefilled letters and reminders for the Freistellungsbescheinigung and the refund deadline.
- E-mail address, firm name, address, VAT number, German Steuernummer if any, contact person and phone
- Questionnaire answers
- Names, addresses and (optional) e-mail addresses of German clients
- Dates and amounts of payments with 15% withheld
- End date of the Freistellungsbescheinigung
- One session cookie (sid) to stay signed in
- When you pay: billing e-mail, country, VAT ID, amount and Mollie customer id, kept 7 years (tax law)
Data subjects: employees, clients or contacts of the customer, as far as they appear in the customer's files.
3. Instructions
The processor processes the data only on documented instructions from the customer. Using the service as intended counts as an instruction.
4. Confidentiality
Everyone with access to the data is bound to confidentiality.
5. Security
The processor takes appropriate measures (GDPR art. 32): encrypted connections (HTTPS), access only after login, servers in the EEA, limited admin access, and backups.
6. Sub-processors
The customer gives general authorisation for these sub-processors:
- OVHcloud SAS, Roubaix, France (hosting of server and database)
- Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)
- Mollie B.V., Amsterdam, Netherlands (payments)
The processor announces a new sub-processor 30 days in advance. The customer may object and then cancel.
7. Assistance
The processor helps the customer with requests from data subjects and with the duties of GDPR art. 32 to 36.
8. Breaches
The processor reports a personal data breach to the customer without undue delay, and at the latest 48 hours after discovery (GDPR art. 33).
9. End
After the agreement ends, the customer gets an export of the data on request within 30 days. The processor deletes it when the customer asks, otherwise after the period in the privacy policy. Backups expire after 14 days. This does not apply where the law requires keeping it.
10. Audits
The processor gives the customer all information needed to show compliance and cooperates with reasonable audits.
11. Transfers
No data is transferred to countries outside the EEA.