Data Processing Agreement (DPA) & B2B Terms

1. Subject Matter and Duration of Processing (Art. 28 GDPR)

Valutova processes incoming e-invoices (XRechnung / ZUGFeRD), creditor master data, payment coordinates (IBAN/BIC), and GoBD audit trails on behalf of the client strictly for validation, visualization, payment preparation, and statutory archiving.

2. Technical and Organizational Measures (Art. 32 GDPR)

• Strict multi-tenant isolation via organization_id in PostgreSQL.
• Cryptographic SHA-256 checksum sealing of every original XML/PDF document upon receipt.
• Isolated internal validation containers (KoSIT 1.6.3 & Python FastAPI without public exposure).
• TLS 1.3 encryption in transit and scrypt password key derivation.

3. Data Portability & GoBD Procedure Documentation

Clients can export all original XML datasets, validation reports, SEPA files, DATEV batches, and their customized GoBD procedure documentation from the workspace at any time.