Sub-processors – VAT & Company Autofill service
DRAFT — needs legal review. The providers are not chosen yet: the owner fills in the rows after renting the VPS, choosing an SMTP provider and a backup target (BLOCKERS B-01, B-04, B-06, B-08). Keep every provider in the EEA.
Last updated: [date]
Sub-processors
Section titled “Sub-processors”| Provider | Purpose | Data | Location | Safeguards |
|---|---|---|---|---|
| [VPS provider, e.g. Hetzner Online GmbH / TransIP B.V.] | Hosting of the server and database | everything in the DPA, Annex 2 | [NL/DE data centre] | DPA with the provider [link] |
| [SMTP provider, e.g. an EU transactional mail service] | Sending dashboard sign-in links | merchant e-mail address, sign-in link | [EEA] | DPA with the provider [link] |
| [Backup storage, e.g. Hetzner Storage Box] | Off-site copies of the nightly backup | everything in the DPA, Annex 2 | [EEA] | DPA [link]; copies kept 14 days |
Recipients that are not sub-processors
Section titled “Recipients that are not sub-processors”These public registers receive the number or address being checked, on the shop’s instruction. They act as independent controllers or public bodies under their own terms.
| Recipient | What is sent | Terms |
|---|---|---|
| European Commission – VIES | VAT number and country | https://ec.europa.eu/taxation_customs/vies/ |
| Kadaster – PDOK (Netherlands) | postcode and house number | https://www.pdok.nl/ |
| BOSA / regions – BeST address register (Belgium) | postcode, street, house number | https://www.geopunt.be/ and the BeST services |
| Kamer van Koophandel – KVK API (only if the shop switched it on, with the shop’s own key) | KvK number | https://developers.kvk.nl/ |
| Let’s Encrypt / ZeroSSL (TLS certificates) | the server’s domain name only, no personal data | – |