Data Processing Agreement

1. Parties and roles

The merchant who installs the App is the controller for customer VAT validation and related store records. Tom Wilkinson, a sole trader established in Austria (Machstrasse 5, 1020 Wien, Austria), is the processor for that data.

This DPA does not apply where we act as controller (for example merchant accounts, sessions, billing/quota, and security), as described in the Privacy Policy.

2. Subject matter, duration, and nature

• Subject matter: EU and Northern Ireland (XI) VAT validation via VIES, storefront verification, writing results onto checkout and orders, and (if enabled) tax-exempt sync.
• Duration: from install until uninstall, plus the Shopify shop-redact window described in the Privacy Policy.
• Nature: collection, storage, validation, disclosure to VIES, writing back to Shopify, and deletion.
• Purpose: to provide the App on the merchant’s documented instructions.
• Types of personal data: where they identify a natural person — VAT numbers of sole traders, trader names, Shopify customer and order identifiers, country codes, hashed customer email, tax-exempt status, and related audit events. VAT numbers belonging to companies are not personal data (Art. 4(1)).
• Categories of data subjects: store customers (typically B2B buyers) and, where they are natural persons, merchant staff whose identifiers appear in Shopify session data processed only as needed to run the App.

3. Instructions

The merchant instructs us by installing the App and configuring its settings (including auto tax-exempt and the merchant VAT number). We process only on those instructions unless Union or Member State law requires otherwise, in which case we inform the merchant unless the law prohibits that (Art. 28(3)(a)).

4. Confidentiality and security

Persons authorised to process personal data are under a duty of confidentiality (Art. 28(3)(b)). We implement appropriate technical and organisational measures under Art. 32, including HTTPS in transit and restricting database access to authenticated application processes (Art. 28(3)(c)).

5. Sub-processors

The merchant authorises the sub-processors listed in section 8 of the Privacy Policy. We will give at least 14 days’ notice of any intended addition or replacement, by email or in-App notice, so the merchant can object on reasonable data-protection grounds. If we cannot resolve a reasonable objection, the merchant may terminate by uninstalling the App (Art. 28(2) and 28(4)).

6. Assistance

We assist the merchant, taking into account the nature of processing, with:

• data-subject requests (Art. 28(3)(e)), including Shopify access and deletion webhooks;
• Arts. 32 to 36 (security, breach notification, DPIAs, and prior consultation), as far as possible given the information available to us (Art. 28(3)(f)).

If a personal-data breach occurs in our processing as processor, we notify the merchant without undue delay after becoming aware (Art. 33(2)).

7. Deletion and return

On uninstall we delete shop data and purge residual data when Shopify sends the shop-redact webhook. On a customers-redact webhook we delete that customer’s data. The merchant should export VAT audit records from the App (Validations → Export CSV) before uninstall if they need them for their own tax-retention duties (Art. 28(3)(g)).

8. Information and audits

We make available information necessary to demonstrate compliance with Art. 28 and allow audits, including inspections, conducted by the merchant or an auditor mandated by the merchant, at reasonable intervals, on reasonable notice, and in a way that does not compromise security or other merchants’ data (Art. 28(3)(h)).

9. International transfers

Transfers outside the EEA/UK and the safeguards used are described in section 9 of the Privacy Policy.

10. Contact

Tom Wilkinson
Machstrasse 5, 1020 Wien, Austria
vatvalidatorpro@gmail.com