Data processing agreement

1. Subject matter

The processor processes personal data on behalf of the controller to provide the Taxaia service: invoicing and quotes, expense management, document inbox, bank reconciliation, quarterly close, draft tax returns, a portal for the tax advisor, artificial intelligence assistants and, when the controller enables it, submission of invoicing records to the Spanish Tax Agency (Agencia Tributaria).

2. Duration

For as long as the organisation exists in Taxaia. At the end, clause 10 applies.

3. Nature and purpose of the processing

Collection, recording, structuring, storage, extraction with artificial intelligence, consultation, disclosure to the recipients the controller indicates, and erasure. The sole purpose is to provide the contracted features. The processor does not process the data for its own purposes, does not use it to train artificial intelligence models and does not disclose it to third parties beyond what is provided for here.

4. Types of data and data subjects

Data subjects

• Clients, suppliers and employees of the controller who appear in its documents.
• People the controller invites to the organisation, including its tax advisor.
• Any person named in the documents, emails or messages the controller adds.

Categories of data

• Identification and contact data: name, tax ID, address, email, phone.
• Financial and transactional data: invoices, expenses, quotes, bank transactions, withholdings, invoicing records.
• Documents and images the controller uploads or forwards, and the text extracted from them.
• Emails and messages from the connectors the controller enables, within the scope it authorises.
• Only if the owner uploads it: the organisation's digital certificate and its private key, in accordance with the custody policy.

Special categories of data (Art. 9 GDPR) are not processed intentionally. If a document contains them, for example a healthcare invoice, the controller guarantees that adding it is lawful.

5. Obligations of the processor

1. Instructions. Process the data only on the documented instructions of the controller: this agreement, the configuration it sets in the application (connectors, permissions, privacy modes, retention) and the requests it sends in writing. If an instruction infringes the regulations, the processor will say so immediately.
2. Confidentiality. People with access to data are bound by a duty of secrecy. Access is limited to what is necessary and is logged.
3. Security. Apply the measures in annex I.
4. Sub-processors. As set out in clause 7.
5. Data subject rights. If a data subject exercises their rights with the processor, the processor will inform the controller within 5 working days and help it respond using the application's features (search, download, rectification) and, where they are not enough, by extracting or erasing the data at the controller's written request.
6. Security breaches. Notify the controller, at the email of the organisation's owner, without undue delay and in any case within 72 hours of confirming it, with the nature of the breach, the categories and approximate number of people affected, the likely consequences and the measures taken.
7. Assistance. Help the controller with impact assessments and prior consultations with the supervisory authority, with the information available to it.
8. Records. Keep the record of processing activities it carries out on behalf of the controller.
9. Audit. Make available to the controller the information needed to demonstrate compliance and allow audits, with 30 days' notice, during working hours, once a year except in case of a breach or a request from the authority, and without accessing data of other organisations.

6. Obligations of the controller

• Have a legal basis for the data it adds and inform the data subjects.
• Decide which connectors it enables and with what scope, and who has access.
• Review artificial intelligence proposals before approving them.
• Respond to data subjects' rights and to the supervisory authority.
• If it uploads its digital certificate, check that the terms of its certification authority allow it.

7. Sub-processors

The controller gives the processor general authorisation to use the sub-processors in annex II. Each one is bound by contract to obligations equivalent to those in this document. If the processor wants to add or replace one, it will publish it on this page and notify the organisation's owner by email 30 days in advance. The controller may object on justified grounds within that period; if there is no reasonable alternative, it may terminate the agreement without penalty and export its data. The processor is liable to the controller for its sub-processors' compliance.

8. International transfers

The data is hosted in the European Union. Some sub-processors process data outside the European Economic Area or may access it from outside; in those cases the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses, with the additional measures in annex I, as indicated in annex II.

9. Artificial intelligence

To extract data from documents, categorise expenses and prepare proposals, the processor sends the necessary content to the model providers in annex II, under API terms that exclude using the data for training. The processor keeps the model's response and the result of each proposal, together with the model and instruction version used, for as long as the organisation exists, so that it can be reviewed and reproduced. No proposal is applied without human approval, except those the controller expressly sets up as automatic.

10. End of the engagement

When the agreement ends, the controller can export its data and download its documents. The processor will erase the personal data within 30 days of the request or of the organisation being deleted, except what it must keep by legal obligation: issued invoices and their invoicing records for the periods set by tax regulations, with access blocked and only to respond to official requests. Backups are deleted according to their rotation cycle.

11. Liability

Each party is liable for the damage it causes by breaching the GDPR and this agreement, under Article 82 of the GDPR. The limitation of liability in the terms of service applies, except where the GDPR does not allow it to be limited.

Annex I. Security measures

• Encryption in transit (HTTPS/TLS) and encryption at rest of file storage and of the off-site backup, provided by the hosting provider.
• Isolation per organisation: every piece of data carries the organisation it belongs to and every query is filtered by it.
• Access control per user, role-based permissions within the organisation, and shared links with a key and an expiry.
• Passwordless access: a single-use link sent by email or sign-in with Google.
• Connector tokens encrypted (AES-256-GCM), deleted when the connector is disconnected and, for Google, also revoked with the provider.
• The organisation's digital certificate, if uploaded: encrypted with its own key per certificate, itself wrapped with a key held by an AWS security module in Spain. Only an isolated process with no network port can open it, solely to authenticate the connection with the Tax Agency. There is no download. Deleting it destroys the key.
• Immutable audit log of relevant actions, including those of the artificial intelligence assistants and human approvals.
• Limits on the assistants' capabilities: no action with a tax effect or sending to third parties without approval; recipients restricted to the organisation's contacts; detection of malicious instructions in documents.
• Invoicing records with a chained fingerprint, immutable.
• Daily backups: 14 days on the server and 90 days in off-site storage in the European Union, encrypted with a key that is not kept in that storage.
• Error diagnostics without document content or tax data.
• Incident response procedure with notification deadlines.

Annex II. Sub-processors

List in force as of 3 October 2026.

The Tax Agency and the recipients of the invoices, quotes and emails the controller chooses to send are not sub-processors: they are recipients of a communication ordered by the controller.