Data Processing Addendum

This Data Processing Addendum ("DPA") governs Vatforge AB's processing of personal data on behalf of business customers under Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679). It forms part of the VatForge Terms of Service.

Summary

• EU data residency — all customer data is stored in the Supabase Ireland (eu-west-1) region.
• Sub-processor transparency — our sub-processor list is published at /security/subprocessors, with 30-day advance notice of any changes.
• Personal Data Breach notification — we will notify you without undue delay and no later than 72 hours after becoming aware of a breach.
• Deletion or return of Personal Data — within 30 days of termination, subject to statutory 10-year OSS retention requirements where applicable.
• Standard Contractual Clauses — SCCs apply to any transfer of Personal Data outside the EEA.

Sub-processor annex (summary)

The full, current list of sub-processors — including Supabase and Stripe — is maintained at /security/subprocessors. The most recent addition:

• Google LLC (Google Analytics 4) — aggregate, pseudonymous site-usage analytics, consent-gated under Consent Mode v2 (no data is sent until the visitor accepts analytics cookies). Transfer mechanism: EU–US Data Privacy Framework + Standard Contractual Clauses. Data categories: pseudonymous client_id, page URLs, event names and UTM parameters — no name, email or account user_id; IP addresses are not stored. Retention: 14 months.

Contact

Questions about our DPA: dpa@vatforge.com