Skip to content
Rechnungskit

Data processing agreement

This English version is a convenience translation. Only the German version is legally binding. Deutsche Fassung

Version: October 2026 · pursuant to Art. 28 GDPR
This data processing agreement (hereinafter "DPA") specifies the data protection obligations between the customer as controller (hereinafter "Controller") and Happy Coffee GmbH, Theodor-Heuss-Str. 15, 53562 St. Katharinen, Germany, as processor (hereinafter "Rechnungskit"). It forms part of the main contract concluded between the parties for the use of the Rechnungskit platform and takes precedence over it in matters of data protection. It takes effect upon conclusion of the main contract.

1. Subject matter and duration

Rechnungskit processes personal data on behalf of the Controller exclusively for the purpose of providing the services agreed in the main contract: creation, validation, audit-proof archiving and sending of electronic invoices, as well as processing of payment and order data and export of accounting data. The duration corresponds to the term of the main contract. For records subject to statutory retention requirements (including GoBD, § 147 AO), the statutory retention periods take precedence; to that extent, deletion takes place only after they have expired.

2. Type of data and categories of data subjects

The data processed includes in particular: master data of invoice and payment recipients (name, company, address, email address, VAT ID number), invoice and line item data, payment and order data (payment references, amounts, payment method, bank identifiers where applicable) and communication data (email delivery logs). Data subjects are the Controller's customers and their representatives and employees, insofar as their data is contained in invoicing or payment transactions.

3. Bound by instructions

Rechnungskit processes the data exclusively within the scope of the Controller's documented instructions, in particular in accordance with the main contract and the settings in the account. Instructions outside the platform functions are given in text form. If Rechnungskit is of the opinion that an instruction infringes data protection provisions, it informs the Controller. No processing for Rechnungskit's own purposes takes place.

4. Confidentiality

Rechnungskit only employs persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after the end of their activity.

5. Technical and organisational measures (TOMs)

Rechnungskit takes the technical and organisational measures required under Art. 32 GDPR. These are described in Annex 2 and are adapted to the state of the art as needed, without falling below the agreed level of protection.

6. Subprocessors

The Controller grants its general authorisation for the engagement of the subprocessors listed in Annex 1. Rechnungskit informs the Controller of any intended changes (addition or replacement) with reasonable advance notice and grants the Controller a right to object for good cause. Rechnungskit obliges every subprocessor to an equivalent level of data protection.

7. Assistance to the Controller

Within reasonable limits, Rechnungskit assists the Controller in responding to requests from data subjects (Art. 12 to 23 GDPR), with the security of processing, with notification obligations (Art. 33, 34 GDPR) and with data protection impact assessments (Art. 35, 36 GDPR). Rechnungskit notifies the Controller without undue delay of any personal data breach that comes to its attention.

8. Deletion and return

After the end of the processing, Rechnungskit deletes or returns the personal data at the Controller's choice, unless a statutory retention obligation precludes this. The Controller can export the archive data during the term of the contract and, after the end of the contract, within the agreed period.

9. Evidence and audits

Rechnungskit makes available to the Controller the information necessary to demonstrate compliance with this DPA and allows for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits are carried out with reasonable advance notice and without disproportionate disruption of operations.

10. Place of processing

Processing takes place in the European Union. The production data is processed and stored in a data centre in Germany (Falkenstein). Encrypted backup copies are additionally kept in a data centre in Finland (Helsinki) within the EU. No transfer to a third country takes place.

Annex 1: Subprocessors

  • Hetzner Online GmbH (Germany, Finland): server hosting, database, object storage and encrypted backups.
  • Bunny (BunnyWay d.o.o., Slovenia/EU): content delivery network, DNS and web application firewall (processing of connection data at the edge).
  • AhaSend B.V. (Netherlands, storage in the EU): sending of transactional emails (recipient address and message content; the content is deleted after one day, the delivery data after seven days).
  • Nebius B.V. (Netherlands, processing in data centres in the EU): AI model for the assistant Kit, for suggestions on classifying and translating products and for draft replies in support (chat inputs and the account data required for them, such as product names and prices, aggregated key figures, type and number of open tasks and the payment status of individual invoices. Information about end customers from orders, invoices and tasks, such as names, email addresses or postal addresses, is not transmitted. In chat inputs and product names, email addresses, IBANs, VAT ID numbers, telephone numbers and postal addresses are automatically masked before transmission; this filter does not detect names that users themselves write into the chat. No permanent storage, no training).
Note: Payment service providers (including Stripe and Mollie) are connected by the Controller with its own account; to that extent, the Controller itself is responsible for the relationship with these providers. Self-operated components for PDF and ZUGFeRD generation run on Rechnungskit's own infrastructure and are not subprocessors.

Annex 2: Technical and organisational measures

  • Confidentiality: tenant separation at database level (row-level security, tenant-based isolation), role-based access control, access protection through authenticated accounts with minimum password requirements.
  • Integrity: immutable storage of finalised invoices (WORM), protection through SHA-256 checksums, signature-verified webhooks from the payment services.
  • Encryption: encryption of archived invoice data at rest (AES-256), authenticated encryption of stored credentials (AES-256-GCM), transport encryption (TLS), exclusively encrypted transfer of backups outside Germany.
  • Availability and resilience: regular, encrypted backups following the 3-2-1 principle, separate backup environment.
  • Organisation: secrets management outside the source code, separation of development and production environments, logging of security-relevant events.
Technical and organisational measures in detail: Security, hosting and compliance
This DPA is a template and does not replace individual legal advice. The version concluded in the account is authoritative. Annex 1 is updated when the service providers used change. This English text is a convenience translation; only the German version is legally binding.
de en