Data Processing Agreement (DPA / AVV)

Document ID: REC-DPA
Version: 1.0.0
Effective Date: 16 October 2026
Last Updated: 16 October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer organization using Rechnelia (the “Controller”) and Mahdi Ghorban Pour - Digitexia, Hauptstrasse 109, 79364 Malterdingen, Germany (the “Processor”). It governs processing of personal data by the Processor on behalf of the Controller under Article 28 GDPR.

1. Scope and Duration

The Processor provides the Rechnelia e-invoicing service, including account and access management; customer and invoice management; conversion of PDF and RTF source documents into structured invoice data; creation of XRechnung XML and ZUGFeRD PDF documents; file storage; billing support; security; maintenance; and support.

Processing continues for the term of the service agreement and any limited period needed for return, deletion, backup expiry, or legal retention.

2. Processing Details

Processing operations may include collection, recording, organization, extraction, review, storage, retrieval, alteration, generation, transmission at the Controller’s direction, restriction, backup, and deletion.

Data subjects may include the Controller’s users, administrators, customers, customer contacts, suppliers, invoice issuers and recipients, payers, payees, and other persons named in invoice documents.

Personal data may include:

names, business contact details, postal and electronic addresses;
account, role, authentication, invitation, and audit data;
invoice numbers, dates, line items, descriptions, amounts, tax and registration identifiers;
bank, payment, routing, purchase-order, contract, and delivery references;
source PDF and RTF documents, generated XML and PDF files, logos, and configuration;
billing and subscription identifiers; and
IP addresses, logs, security events, browser information, and technical metadata.

The service is not intended for special-category data under Article 9 GDPR or criminal-offence data under Article 10 GDPR. The Controller shall not submit such data unless separately agreed and lawfully instructed.

3. Controller Obligations

The Controller determines the purposes and means of processing, ensures its instructions and use of Rechnelia comply with data-protection law, provides required notices, establishes a lawful basis, manages user permissions, maintains accurate data, and handles data-subject requests. The Controller shall not instruct the Processor to violate applicable law.

4. Processor Instructions

The Processor shall process personal data only on documented instructions from the Controller, including the service agreement, this DPA, configuration, and actions taken by authorized users, unless Union or Member State law requires otherwise. The Processor shall notify the Controller if an instruction appears unlawful, unless prohibited by law.

5. Confidentiality and Security

The Processor ensures that persons authorized to process personal data are bound to confidentiality and receive access only as needed. Taking account of risk, the Processor maintains appropriate technical and organizational measures, including access control, tenant separation, authorization, encrypted transport, secure credential handling, logging, monitoring, backups, vulnerability and update management, incident procedures, and availability and recovery measures.

6. Data-Subject Requests and Compliance Assistance

Taking account of the nature of processing, the Processor shall reasonably assist the Controller with data-subject requests and with obligations under Articles 32 to 36 GDPR. If the Processor directly receives a request concerning Controller Data, it will forward it to the Controller unless legally required to respond.

7. Personal Data Breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Data. Available information will include the nature of the breach, affected data and persons, likely consequences, and measures taken or proposed. Notification is not an admission of fault.

8. Subprocessors

The Controller grants general authorization for the subprocessors in Annex 2. The Processor shall bind each subprocessor to data-protection obligations that provide substantially equivalent protection. The Processor remains responsible for its obligations under this DPA.

The Processor shall provide reasonable advance notice of a new or replacement subprocessor where required, enabling the Controller to object on substantiated data-protection grounds. If the parties cannot resolve a valid objection, the Controller may terminate the affected service.

9. International Transfers

Where processing involves a transfer outside the European Economic Area, the Processor shall use an applicable adequacy decision, approved standard contractual clauses with supplementary measures where necessary, or another lawful mechanism under Chapter V GDPR.

10. Audit Information

The Processor shall make information reasonably necessary to demonstrate compliance available to the Controller. Audits must be proportionate, protect other customers and confidential information, avoid unreasonable disruption, and ordinarily use existing documentation or remote review first. On-site audits require reasonable notice unless an incident or authority requires urgency.

11. Return and Deletion

At the Controller’s choice following termination, the Processor shall delete or return Controller Data and delete remaining copies, unless law requires retention. The Controller is responsible for exporting data before account access ends. Data in backups will be deleted through the normal backup lifecycle and protected from routine use in the meantime.

12. Liability, Priority, and Law

Liability is governed by the main service agreement and mandatory data-protection law. If this DPA conflicts with the main agreement on processing of personal data, this DPA prevails. German law applies, subject to mandatory GDPR rights and supervisory-authority powers.

Annex 1 – Parties and Contact

Processor: Mahdi Ghorban Pour - Digitexia, Hauptstrasse 109, 79364 Malterdingen, Germany
Product: Rechnelia
Email: kontakt@rechnelia.de
Website: https://rechnelia.de

Controller: The customer organization identified in its Rechnelia account, order, or subscription.

Annex 2 – Authorized Subprocessors

Subprocessor	Location / transfer context	Purpose
IONOS SE / IONOS Cloud	Germany / European Union	Hosting infrastructure, databases, backups, monitoring, and IONOS Object Storage using an S3-compatible interface for source documents, generated files, logos, and related data
Cloudflare, Inc.	Global services; transfers protected by applicable safeguards	Cloudflare Turnstile anti-bot and abuse protection, including verification of public form submissions
Stripe Payments Europe, Ltd. and affiliates	Ireland / European Union; affiliated processing subject to applicable safeguards	Subscription checkout, billing, invoices, payment-method management, and metered usage billing
Production SMTP email provider	As identified in the production service configuration or customer notice	Transactional email delivery, including confirmations, invitations, password resets, billing, and service notifications

The generic SMTP entry must be replaced with the contracted production provider’s legal name and processing location before this DPA is offered for signature or production acceptance.