Data processing agreement for codesaur's hosted apps

DRAFT v1, not yet reviewed by a lawyer. Not in force until a lawyer has approved it.

Last updated: [date]

This agreement exists in Dutch and English. If the two differ, the Dutch text (verwerkersovereenkomst) prevails.

This data processing agreement applies only to codesaur’s hosted apps (currently: VAT & Company Autofill for Shopify and Lightspeed). Plugins that the Customer installs itself (Shopware, WooCommerce, Adobe Commerce, PrestaShop) send no personal data to codesaur; no data processing agreement is needed for them.

Parties

1. The Customer: the operator of the online shop that installs a codesaur App, as identified in its account with the platform, hereinafter: the Customer, as controller;
2. codesaur, sole proprietorship (eenmanszaak) of Hans de Jong, registered with the Dutch Chamber of Commerce under number 42167270, established at De Dintel 19, 5463 NR Veghel, the Netherlands, hereinafter: codesaur, as processor.

Recitals

1. codesaur provides the App from its own servers. The App checks VAT numbers (VIES), Dutch addresses (PDOK), Belgian addresses (BeST) and, if the Customer switches it on, Dutch Commercial Register data (KVK API) for the shop’s buyers, and shows the Customer a log of these checks.
2. In doing so, codesaur processes personal data on behalf of the Customer.
3. Article 28(3) GDPR requires this processing to be governed by a contract. The parties set this out in this data processing agreement.
4. This data processing agreement forms part of the agreement between the parties and applies alongside codesaur’s Terms of use (plugins.codesaur.nl/legal/terms/). The Customer accepts it by installing the App.

Article 1. Definitions

Capitalised terms have the meaning given in the Terms of use (including App, Customer, Store, Data Sources, Business day). In addition:

1. GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).
2. Personal Data, Processing, Data Subject, Personal Data Breach: as defined in Article 4 GDPR.
3. Data Breach: a Personal Data Breach concerning Personal Data that codesaur Processes for the Customer.
4. Sub-processor: a third party engaged by codesaur that Processes the Customer’s Personal Data.
5. Dashboard: the App’s admin area in which the Customer manages settings, the log and its data.

Article 2. Subject and roles

1. The Customer is the controller for the Personal Data of its buyers and other visitors that the App processes. codesaur is the processor for it.
2. Which Personal Data codesaur processes, of which Data Subjects, for what purpose and for how long, is set out in Annex 1.
3. Outside this agreement is the processing for which codesaur is itself the controller: the sign-in data of the Customer’s Dashboard users, subscription administration, the website and support. That processing is described in the privacy policy (plugins.codesaur.nl/legal/privacy/).
4. The Data Sources (VIES, PDOK, BeST, KVK API) that codesaur queries on the Customer’s instruction are not Sub-processors. They are independent recipients acting under their own terms. For the KVK API, the Customer is itself a customer of the Dutch Chamber of Commerce.
5. The shop’s platform (Shopify, Lightspeed) is not a Sub-processor of codesaur. The Customer has its own agreement with it.

Article 3. Instructions

1. codesaur Processes the Personal Data only on documented instructions from the Customer. The agreement, this data processing agreement, the settings in the Dashboard and the Customer’s use of the App count as those instructions. The Customer gives further instructions by e-mail.
2. codesaur does not use the Personal Data for its own purposes, does not sell it and does not use it to train language models or other models.
3. If codesaur is legally required to Process Personal Data outside the instructions, codesaur informs the Customer in advance, unless the law prohibits this.
4. codesaur informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection rules.

Article 4. Confidentiality

1. codesaur keeps the Personal Data confidential. Anyone who gets access to Personal Data under codesaur’s responsibility is bound by the same confidentiality. At present this is only Hans de Jong.
2. codesaur uses its technical access to the Customer’s data only for administration, security and fixing faults, at the Customer’s request, or where a legal obligation requires it.

Article 5. Security

1. codesaur takes appropriate technical and organisational measures to protect the Personal Data, as referred to in Article 32 GDPR.
2. The measures are listed in Annex 2. codesaur may change them, provided the level of security does not decrease.

Article 6. Sub-processors

1. The Customer gives codesaur general authorisation to engage the Sub-processors in Annex 3. The current list is at plugins.codesaur.nl/legal/subprocessors/.
2. codesaur announces a new or replacement Sub-processor at least 30 days in advance, with a notice in the Dashboard and by e-mail to the Customer’s sign-in addresses, and updates the list.
3. The Customer may object on reasonable grounds within those 30 days. If the parties cannot agree, the Customer may remove the App and cancel its subscription before the new Sub-processor is engaged. Refunds are governed by the Store’s rules.
4. codesaur imposes on each Sub-processor in writing at least the same obligations as in this agreement, and remains responsible to the Customer for the Sub-processor.

Article 7. Transfers outside the EEA

1. codesaur Processes the Personal Data only within the European Economic Area, at the locations in Annex 3.
2. A transfer to a country outside the EEA takes place only with the Customer’s prior written consent and with safeguards as referred to in Chapter V GDPR.

Article 8. Data Subjects’ rights

1. The Customer can handle most requests itself in the Dashboard: download all data (JSON), empty the log at once and delete all data. On Shopify, the App handles Shopify’s privacy requests (data request, buyer erasure, shop erasure) automatically.
2. Where that is not possible, codesaur helps the Customer within reasonable limits to answer Data Subjects’ requests (access, rectification, erasure, restriction, portability, objection).
3. If codesaur receives such a request directly, codesaur forwards it to the Customer within 5 Business days and does not answer it itself.

Article 9. Data Breaches

1. codesaur notifies the Customer of a Data Breach without undue delay, and no later than 48 hours after codesaur discovered it, by e-mail to the Customer’s sign-in addresses.
2. The notification contains, as far as known: what happened, which Personal Data and how many Data Subjects are affected, the likely consequences, and the measures codesaur has taken or proposes. codesaur reports what becomes known later as soon as it is known.
3. codesaur takes immediate measures to limit the Data Breach and prevent it from recurring, and records every Data Breach.
4. The Customer decides whether the Data Breach is notified to the Dutch Data Protection Authority and to Data Subjects. codesaur does not notify them itself, unless the law requires it.

Article 10. Assistance

codesaur helps the Customer within reasonable limits with its obligations under Articles 32 to 36 GDPR, such as a data protection impact assessment (DPIA) or a prior consultation of the supervisory authority, with the information available to codesaur.

Article 11. Information and audit

1. On request, codesaur gives the Customer the information needed to demonstrate that codesaur complies with this agreement, for example by completing a questionnaire.
2. If that information is demonstrably insufficient, the Customer may have an audit carried out by an independent expert bound by confidentiality. An audit takes place at most once a year, is announced at least 30 days in advance and does not disrupt the service to other customers. After a Data Breach an audit may take place sooner.
3. The costs of an audit are borne by the Customer, unless the audit reveals significant shortcomings. codesaur fixes shortcomings found as quickly as reasonably possible.

Article 12. Term, end, return and deletion

1. This agreement runs for as long as codesaur Processes Personal Data for the Customer.
2. Retention periods are set out in Annex 1.
3. If the Customer removes the App or chooses “Delete all data” in the Dashboard, codesaur deletes all of the Customer’s data. On Shopify, the access token is deleted as soon as the App is removed, and the rest on Shopify’s erasure request for the shop, or no later than 49 hours after the App is removed.
4. Before deletion, the Customer can download its data in the Dashboard.
5. Backups are kept for 14 days. Deleted data is therefore also gone from the backups no later than 14 days after deletion.
6. codesaur confirms the deletion in writing on request. Deletion does not take place to the extent that the law requires codesaur to keep data.

Article 13. Liability

The parties’ liability is governed by article 11 of the Terms of use. This does not affect liability towards Data Subjects under Article 82 GDPR.

Article 14. Final provisions

1. In case of conflict between this data processing agreement and the Terms of use, this data processing agreement prevails as far as the Processing of Personal Data is concerned.
2. codesaur may change this data processing agreement in the same way as the Terms of use (article 14 of the terms). A change does not lower the protection of the Personal Data.
3. This agreement is governed by Dutch law. Disputes are submitted to the District Court of Oost-Brabant (rechtbank Oost-Brabant).

Annex 1. Description of the processing

Item	Description
Purpose	Checking and completing business buyers’ data in the shop’s checkout and account pages; showing the Customer why a check failed; protecting the service against abuse
Nature of the processing	Receiving the input from the shop, querying the public register, caching the answer, returning it to the shop, writing a masked log entry, counting KvK requests, making backups and deleting data
Data Subjects	Buyers and prospective buyers of the Customer (mainly business buyers, including sole traders)
Personal Data	VAT numbers and KvK numbers (personal data for sole traders), postcode, house number, street, place; company name and address as returned by the registers; IP address (only as a keyed hash, for rate limits); on Shopify: customer data in Shopify webhooks (encrypted)
Special categories and criminal data	None
Location	European Economic Area, see Annex 3

Retention periods

Data	Retention
Log (masked input, no IP address)	set by the Customer, 1 to 180 days (default 30)
Cache of answers	VIES 24 hours; PDOK and BeST 7 days (shared between shops); KvK 7 days (per shop)
Rate-limit counters (hash of the IP address)	at most 1 day
Sign-in links / links from the platform	15 minutes / 5 minutes
Dashboard sessions	2 hours idle, 12 hours at most
Number of KvK requests per month	24 months
Settings, sign-in addresses, encrypted KvK key	until the App is removed or “Delete all data” is used
Shopify: shop data (encrypted access token, plan, options)	access token until the App is removed; the rest until Shopify’s erasure request, at most 49 hours after removal
Shopify: webhook jobs (encrypted payload with customer data)	payload until the job is done or the buyer is erased; the record 7 days
Backups	14 days

Annex 2. Security measures

Topic	Measure
Hosting	One server at [VPS provider] in [country, EEA]; only ports 80 and 443 open
Encryption in transit	All traffic over HTTPS (TLS), with automatically renewed certificates
Administrative access	Only Hans de Jong, by SSH key only
KvK key	Stored encrypted (XChaCha20-Poly1305, bound to the shop); never shown, logged or exported
Platform access tokens	Stored encrypted
Log	Masked input only (for example NL00*******B01, 1234 **), never IP addresses or full input
Rate limits	Per IP address and per shop; the IP address only as a keyed hash, kept for at most 1 day; an outage of a register does not block checkout (circuit breaker)
Dashboard sign-in	Single-use sign-in links (15 minutes) or signed single-use links from the platform (5 minutes); sessions expire after 2 hours idle and after 12 hours at most; secure HttpOnly cookies; protection against CSRF and clickjacking
Secrets	Sign-in tokens, session IDs and the operator token stored as hashes only
Backups	Daily, kept 14 days, at [backup location, EEA]
Testing	Automated tests on every change, including security tests (key never in logs or answers, CSRF, single use)
Incidents	Data Breaches are notified and recorded under article 9

Annex 3. Sub-processors

The current list is at plugins.codesaur.nl/legal/subprocessors/. At the time of this agreement:

Sub-processor	What it does	Which data	Location
[VPS provider]	Hosting of the server and the database	all data in Annex 1	[country, EEA]
[SMTP provider]	Sending Dashboard sign-in links	Dashboard user’s e-mail address, sign-in link	[country, EEA]
[Backup storage provider]	Off-site copies of the daily backup	all data in Annex 1	[country, EEA]

Not sub-processors (independent recipients, article 2(4)): European Commission (VIES), Kadaster (PDOK), Belgian authorities (BeST address register), Dutch Chamber of Commerce (KVK API, only if the Customer switches it on, with its own key). The issuer of the TLS certificates receives only the server’s domain name, no personal data.