This English version is provided for convenience. The German version is legally binding.
Template for review in advance – the binding Data Processing Agreement is concluded when a paid plan is booked. The paid bridge is currently in preparation (early access). The free validator does not involve processing on behalf of a controller; it is described in our Privacy Policy.
§ 1 Parties and status
- Controller
- The Customer who books a paid BelegBridge plan (details as stated in the booking) – hereinafter the "Controller".
- Processor
- BelegBridge Compliance Software, Owner (Inhaber/in): Farah TRIKI, Wilmersdorfer Str. 107C, 10629, Berlin – hereinafter the "Processor".
This agreement specifies the data protection obligations of the parties arising from the paid contract for the BelegBridge bridge (hereinafter the "Main Contract"). It applies to all activities in which the Processor or persons engaged by it process personal data on behalf of the Controller.
§ 2 Subject matter and term
- The subject matter of the processing is the transient conversion, validation and dispatch of invoice data of the Controller via the BelegBridge bridge.
- The term of this agreement corresponds to the term of the Main Contract. Obligations that by their nature continue after termination (in particular confidentiality) remain in force.
§ 3 Nature and purpose of processing
- Receipt of invoice data from the sources connected by the Controller (for example Stripe or PayPal webhooks, email or API).
- Enrichment with the mandatory seller details stored in the Controller's seller profile.
- Creation of an electronic invoice in accordance with EN 16931 (XRechnung or ZUGFeRD/Factur-X, including embedding in a PDF/A-3 file) exclusively in volatile memory.
- Validation of the generated file using the official validation rules (KoSIT validator, Mustang/veraPDF).
- Dispatch to the recipients designated by the Controller (in particular the invoice recipient and the Controller's DATEV mailbox or accounting system).
Invoice contents are processed transiently and are not stored after dispatch.
§ 4 Types of data and categories of data subjects
Types of personal data
- Invoice data: invoice number and date, line items, amounts, taxes, payment terms and payment status.
- Buyer data: name, address, contact person, email address, phone number, VAT ID or other identifiers.
- Payment data: bank details (IBAN, BIC), payment references.
- Configuration data of the Controller stored for operating the service: seller profile (name, address, tax IDs, contact person, bank details), recipient addresses for dispatch, access and webhook credentials.
Categories of data subjects
- Customers of the Controller (invoice recipients) and their contact persons.
- Employees and contact persons of the Controller.
- Where applicable, clients of the Controller (for example clients of tax advisers or agencies).
Special categories of personal data (Art. 9 GDPR) are not processed as intended.
§ 5 Instructions
- The Processor processes personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law; in that case, the Processor informs the Controller before processing, unless the law prohibits this (Art. 28 (3) (a) GDPR).
- The Main Contract and the configuration made by the Controller in the customer account constitute the instructions. Further instructions must be given in text form.
- The Processor informs the Controller without delay if it considers that an instruction infringes data protection law.
§ 6 Confidentiality
The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR). This obligation continues after the end of their engagement.
§ 7 Technical and organizational measures (Art. 32 GDPR)
The Processor implements the following measures, which are part of the service at the start of the contract. The Processor may adapt them to technical progress, provided the level of protection is not reduced.
| Control objective | Measures |
|---|---|
| Physical access control | Operation in data centres of the hosting provider (Hetzner Online GmbH (Rechenzentrum Standort Nürnberg, Deutschland, ISO/IEC 27001)) with physical access controls in accordance with its technical and organizational measures; no own server rooms. |
| System access control | Administrative access only for designated persons with individual, strong authentication; services run with minimal rights (no additional privileges, restricted system capabilities). |
| Data access control | Invoice contents are processed exclusively in volatile memory and not stored, so no subsequent access is possible; sensitive configuration data (such as IBAN and webhook secrets) are stored encrypted (AES-256-GCM); API keys are stored only as hash values. |
| Transfer control | Transport encryption (TLS) for all transmissions; validation services run in isolated containers in an internal network without internet access; dispatch only to recipients configured by the Controller. |
| Input control | Redacted logging of technical events (time, operation, status) without invoice contents; mandatory seller details are taken exclusively from the authenticated seller profile and cannot be overridden by incoming data; webhook signatures are verified using constant-time comparison. |
| Availability control | Limits on upload size (15 MB) and request rates, protection against XML attacks (rejection of DOCTYPE/ENTITY declarations, XXE), read-only file systems for the validation services, health monitoring and automatic restart. |
| Separation control | Logical separation of the configuration data of each Controller (customer account); each invoice is processed in isolation within its own request. |
| Review and evaluation | Review of these measures at least annually and on significant changes; automated tests, including security tests, before each release. |
§ 8 Sub-processors
- The Controller consents to the engagement of the following sub-processor: hosting – Hetzner Online GmbH (Rechenzentrum Standort Nürnberg, Deutschland, ISO/IEC 27001). Further sub-processors (for example for email dispatch) will be named in the list of sub-processors provided when the contract is concluded.
- The Processor informs the Controller in text form of any intended addition or replacement of sub-processors at least four weeks in advance. The Controller may object to the change for important data protection reasons; in this case, both parties have a special right of termination.
- The Processor imposes on each sub-processor the same data protection obligations as set out in this agreement (Art. 28 (4) GDPR). Processing takes place in the European Union or the European Economic Area.
§ 9 Assistance and notification duties
- Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organizational measures in responding to requests from data subjects (Chapter III GDPR).
- The Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessment, prior consultation).
- The Processor notifies the Controller without undue delay after becoming aware of a personal data breach and provides the information required under Art. 33 (3) GDPR.
§ 10 Deletion and return
- Invoice contents are not stored by the Processor; after processing has finished, there is therefore nothing to return or delete.
- Configuration data stored for operating the service (seller profile, recipient addresses, encrypted credentials) are deleted without delay after the end of the Main Contract, unless a statutory retention obligation applies. Before that, the Controller may request an export of these data.
§ 11 Audit rights
The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it (Art. 28 (3) (h) GDPR). Inspections must be announced reasonably in advance, take place during normal business hours and must not unduly disrupt operations; the confidentiality of other customers' data must be preserved.
§ 12 Addendum on the protection of professional secrets (§ 203 StGB)
This addendum applies where the Controller is subject to professional secrecy (for example tax advisers, auditors or lawyers).
- The Processor acts as a "contributing person" (mitwirkende Person) within the meaning of § 203 (3) and (4) StGB. The Processor is aware that it may itself be liable to prosecution under § 203 (4) StGB if it discloses, without authorization, a third-party secret that has become known to it in the course of its work.
- The Processor commits all persons involved in providing the service to confidentiality in text form, informing them of the criminal consequences of a breach. It imposes corresponding obligations on sub-processors.
- The Processor takes note of third-party secrets only to the extent strictly necessary for providing the service. Because invoice contents are processed exclusively in memory and not stored, there is no access to them during regular operation.
- Professional regulations applicable to the Controller regarding the use of service providers (for example § 62a StBerG, § 43e BRAO, § 50a WPO) remain unaffected; the Processor supports the Controller in complying with them.
§ 13 Final provisions
- In the event of contradictions, the provisions of this agreement take precedence over those of the Main Contract with regard to data protection.
- Amendments and additions to this agreement must be made in text form.
- Liability is governed by Art. 82 GDPR and the liability provisions of the Main Contract.
- Should individual provisions of this agreement be invalid, the validity of the remaining provisions remains unaffected.
Template version 2026.11 · Last updated: November 2026. This template does not constitute legal advice.