Data Processing Agreement (DPA)

This Data Processing Agreement establishes the respective obligations of vatcheck.tax (Data Processor) and the Customer (Data Controller) regarding the processing of Personal Data under the General Data Protection Regulation (GDPR).

1. Scope and Applicability

This DPA applies when vatcheck.tax processes VAT Registration Numbers and related entity data inputted by the Customer for the strict purpose of Verification API routing.

2. Processor Obligations

vatcheck.tax warrants that it processes data only on documented instructions from the Controller. Our architectural policy ensures 'Zero-Retention': VAT payloads are not stored on persistent disks after the API request is routed to HMRC or VIES.

3. Sub-processors

The Controller authorizes the Processor to engage Google Cloud (Hosting) and Stripe (Billing) as sub-processors, provided they adhere to robust security standards equivalent to this DPA.