Data Processing Agreement

This agreement is made between the IVAERO customer, acting as controller, and IVAERO Digital, S.L., Tax ID (NIF) B05630363, with registered office at calle Sostres, 1 bis, 2.º 1.ª, 08024 Barcelona (Spain) (“IVAERO”), acting as processor, in compliance with article 28 of Regulation (EU) 2016/679 (GDPR) and article 33 of Spanish Organic Law 3/2018 (LOPDGDD).

It forms part of the IVAERO Terms of Service and is accepted with them. It governs the personal data IVAERO processes on the customer's behalf. The data IVAERO processes as controller, such as the access and security data of the account's users, is governed by the Privacy Policy.

IVAERO processes the data to provide the subscribed service: storing the customer's sales and customers, preparing and issuing its invoices, generating and submitting its invoicing records to the AEAT when the customer enables it, importing sales from files and from the channels the customer connects, generating exports and documents, and providing support. The operations include collection, recording, organisation, storage, consultation, disclosure by transmission to the AEAT, and erasure.

Data subjects: the buyers and recipients of the customer's invoices, their contact persons, and the holder or representative named in the electronic certificate the customer provides.

Data: identification data (name or company name and NIF or other tax identifier), contact data (postal address and, where entered, email and phone number) and the data of the invoiced transactions (dates, descriptions, amounts and taxes). The service does not need special categories of data and the customer must not enter them.

The processing lasts for as long as the customer's contract with IVAERO is in force and, afterwards, for the return and erasure period in section 10.

IVAERO will process the data only on the customer's documented instructions (these terms, the settings the customer chooses in the application and the instructions it gives in writing), including with regard to international transfers, unless Union or Spanish law requires otherwise; in that case it will inform the customer before processing, unless the law prohibits it. It will tell the customer if it considers that an instruction infringes data-protection law.

It will ensure that the persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, and it will apply the security measures in section 7.

It will assist the customer, through appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights; if a request reaches IVAERO, it will pass it to the customer without delay. It will also assist the customer in meeting its obligations on security, notification of personal data breaches, impact assessments and prior consultation (articles 32 to 36 GDPR), taking into account the information available to it.

It will notify the customer of personal data breaches affecting its data without undue delay and, in any case, within 48 hours of becoming aware of them, with the information available to document them and, where applicable, report them to the supervisory authority and the data subjects.

It will keep a record of the processing activities it carries out on behalf of its customers and make available to the customer the information needed to demonstrate compliance with this agreement, as set out in section 9.

The customer warrants that it has a legal basis for the data it enters, that it has informed the data subjects under articles 13 and 14 GDPR and that its instructions comply with the law. It supervises the processing and can view in the application at any time the data IVAERO processes on its behalf.

IVAERO hosts the service on Amazon Web Services, in the Ireland region (European Union), and applies, among others, these measures: encryption at rest of the database, the cache and document storage; additional encryption, with keys managed in AWS Key Management Service, of the electronic certificates customers provide; communications with the service encrypted with TLS; role-based access control within each account and logical separation of each customer's data; passwords stored using strong hashing functions; automatic daily database backups; an audit log of relevant actions; and access by IVAERO staff limited to what is necessary.

IVAERO reviews these measures periodically and may replace them with equivalent or better ones, without lowering the level of protection.

The customer gives IVAERO general authorisation to engage other processors. IVAERO will inform the customer of any addition or replacement at least 30 days in advance, by email or in the application; the customer may object on reasonable grounds and, if no solution is found, cancel the service without penalty before the change takes effect. IVAERO imposes on each sub-processor, by contract, data-protection obligations equivalent to those in this agreement and remains liable to the customer for their compliance.

Amazon Web Services EMEA SARL (Luxembourg): hosting, database, document storage and transactional email; the data is hosted in the Ireland region (EU).

Google Cloud EMEA Limited (Ireland), through Google Workspace: corporate email and customer support, where communications with the customer include data from its invoices; it may process data outside the European Economic Area with the safeguards in section 11.

The following are not sub-processors but recipients or sources the customer activates: the Spanish Tax Agency (AEAT), to which IVAERO submits the invoicing records in fulfilment of the customer's obligations, and the sales platforms the customer connects, from which IVAERO receives data with the customer's authorisation.

The customer may request the information needed to verify compliance with this agreement. IVAERO will first provide it through available documentation, reports or certifications. If these are not sufficient, the customer, or an auditor it appoints who is bound by confidentiality, may carry out an audit with 30 days' notice, once a year unless there has been a security breach, at its own cost and without compromising the security or confidentiality of other customers' data.

When the contract ends, the customer has 30 calendar days to export its invoices and data, as set out in the Terms of Service. After that period, IVAERO will erase the personal data processed on the customer's behalf, unless the customer has asked for its return within the period or Union or Spanish law requires it to be kept; in that case IVAERO will keep it blocked and process it only to meet that obligation. Backups are erased according to their rotation cycle. On request, IVAERO will certify the erasure.

IVAERO processes the data in the European Economic Area. If a sub-processor processes it outside the EEA, it will do so with the safeguards of Chapter V GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for certified entities) or the European Commission's standard contractual clauses.

This section applies when the customer connects its Amazon seller account. Buyer data received from Amazon (name, address and, where provided, email) is used only to issue the invoices for those orders.

Data that is not linked to an issued invoice is erased 30 days after the order is delivered. Data linked to an issued invoice is kept for as long as tax and commercial law require. If the customer disconnects the channel or revokes the authorisation, IVAERO will erase within 30 days all data received from Amazon that is not subject to that retention obligation and, at the customer's request, will certify it.

Each party is liable in accordance with article 82 GDPR and the Terms of Service.

This agreement is written in Spanish. The English version is a translation and, in case of any discrepancy, the Spanish version prevails.