Version 1.0 · Effective date: April 5, 2026
api.eurovalidate.com.The parties acknowledge that, with respect to Customer Data, the Customer is the Controller and EuroValidate is the Processor. EuroValidate processes Customer Data only on documented instructions from the Customer, as set out in Annex I and in the Customer’s use of the Service.
For data EuroValidate collects independently to operate the Service (its own account records, billing data, security logs) EuroValidate acts as an independent Controller governed by the Privacy Policy.
See Annex I for the detailed description of the Processing.
EuroValidate shall process Customer Data only on the documented instructions of the Customer, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law. EuroValidate shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.
EuroValidate ensures that persons authorised to process Customer Data have committed themselves to confidentiality (or are under an appropriate statutory obligation of confidentiality) and have received appropriate data protection training.
EuroValidate shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing. These measures are described in Annex II.
The Customer grants EuroValidate a general authorisation to engage Sub-processors listed in Annex III. EuroValidate will:
If the Customer reasonably objects to a new Sub-processor on legitimate data-protection grounds, it may terminate the affected portion of the Service by written notice within the 30-day window. EuroValidate will refund any pre-paid fees for the unused portion.
Taking into account the nature of the Processing, EuroValidate shall assist the Customer by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the Data Subject’s rights (Art. 12–23 GDPR).
If EuroValidate receives a request directly from a Data Subject relating to Customer Data, it will not respond on the merits but will promptly forward the request to the Customer.
EuroValidate shall, taking into account the nature of Processing and information available to it, assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 (security), 33 (breach notification), 34 (communication to Data Subjects), 35 (DPIA) and 36 (prior consultation) of the GDPR.
EuroValidate shall notify the Customer of any Personal Data Breach affecting Customer Data without undue delay and within 72 hours of becoming aware of it. The notification shall contain, to the extent known, the information required by Art. 33(3) GDPR. EuroValidate will provide updates as additional information becomes available.
Primary processing takes place on servers located in Germany (EU). Certain Sub-processors (Stripe Inc., functionalities of Cloudflare) may process Customer Data in the United States. Where such transfers occur, they are subject to the SCCs (Module Two, Controller-to-Processor), which are incorporated into this DPA by reference and executed between EuroValidate and the relevant Sub-processor. Copies are available on request.
For transfers from the Customer (Controller) to EuroValidate (Processor) where the Customer is established outside the EEA and EuroValidate is established inside the EEA, the parties agree that Module Four of the SCCs (Processor-to-Controller) shall apply where legally required.
EuroValidate shall make available to the Customer all information necessary to demonstrate compliance with this DPA. On no more than once per twelve-month period, the Customer may conduct an audit — at its own cost, on reasonable written notice of at least 30 days, during normal business hours, and subject to confidentiality — by requesting documentation, completing a security questionnaire, or (for Enterprise customers) commissioning a qualified independent third-party assessor. Audits must not unreasonably disrupt the Service or compromise the security of other customers.
Upon termination of the Service, EuroValidate shall, at the Customer’s choice, delete or return all Customer Data, and delete existing copies, unless Union or Member State law requires further storage. Default behaviour: deletion within 30 days of termination.
This DPA takes effect on the date the Customer accepts the Terms of Service and continues for as long as EuroValidate processes Customer Data. Clauses that by their nature should survive termination (confidentiality, liability, audit records) shall survive.
Each party’s liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party’s liability for damages caused by its own willful misconduct, gross negligence, or breaches of the GDPR.
In the event of any conflict between this DPA and the Terms of Service, this DPA prevails with respect to data protection matters. In the event of any conflict between this DPA and the SCCs, the SCCs prevail.
Data protection queries: [email protected].
No special categories of data (Art. 9 GDPR) are processed.
On-demand (each API call); continuous (for monitored entities with scheduled re-validation).
For the duration of the Service. Cached identifiers expire automatically per the retention schedule in Annex II.
The Customer is responsible for providing privacy notices to its own Data Subjects and for establishing a lawful basis for submitting identifiers to EuroValidate.
deploy) for application management.no-new-privileges.| Data type | Retention |
|---|---|
| VAT validation results (cache) | 24 hours |
| EORI validation results (cache) | 24 hours |
| IBAN validation results (cache) | 1 hour |
| Company (GLEIF) data (cache) | 7 days |
| API usage logs | 12 months, then anonymised |
| Account data | For the life of the account + 30 days |
| Backups | 14 days |
/v1/gdpr/*) for export, purge, and account deletion.The current list is maintained at /subprocessors and summarised below:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, compute, storage | Germany (EU) |
| Cloudflare, Inc. | DNS, CDN, DDoS protection, bot detection | Global / USA |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Billing, subscription management, invoicing | Ireland (EU) / USA |
| Resend Inc. | Transactional email delivery | USA |
| GitHub, Inc. | Source code and deployment pipelines (no Customer Data) | USA |
Transfers to Sub-processors established in the United States are governed by the SCCs (Module Three, Processor-to-Processor) and/or applicable adequacy mechanisms (e.g. EU-US Data Privacy Framework where the Sub-processor is certified).