Is a Data Processing Agreement (DPA) available?

Yes. The standard GDPR Article 28 DPA is at /legal/dpa and is automatically incorporated into your agreement on any paid plan – no signature needed. Enterprise customers who need a countersigned copy can request one at [email protected].

When you need a DPA

If you send VAT numbers to the vatnode API on behalf of your own customers, vatnode acts as your data processor. VAT numbers are business identifiers and generally are not personal data, but they can relate to sole traders, and company details returned from registries may then count as personal data. The DPA is the contract that covers this processing.

What the DPA covers

• The subject matter and nature of processing: VAT validation via VIES, company enrichment from national registries, VIES consultation numbers, request and webhook delivery logging, and monitoring subscriptions.
• The obligations of vatnode as processor, including processing only on your documented instructions and keeping persons who handle the data bound to confidentiality.
• Subprocessors, with at least 14 days’ notice before one is added or replaced and a right to object.
• Data subject rights, security measures and data breach notification.
• Return or deletion of data when the agreement ends, and audit rights.

Subprocessors

The current list, with entity names, locations and safeguards, is at /legal/subprocessors. Notifications about changes go to the email address on your account.

Where it is incorporated

The mechanism is written into the Terms of Service: using the service on a paid plan incorporates the DPA by reference. For questions about the DPA or a countersigned copy, write to [email protected].