Data processing agreement

This English version is the binding one. The German translation is provided for convenience.

1. Parties and conclusion

This agreement is concluded between you as the customer of the xmoo E-Invoice API or the xmoo Cable Sizing API (“controller”) and Haag Automation, Julian Haag, Mühlstraße 35, 74360 Ilsfeld, Germany (“processor”). It forms part of the API terms of use and applies as soon as you send personal data to an API. If you need a countersigned copy, write to julian@haag-automation.com.

2. Subject matter, nature and purpose

• Subject matter: automated processing of the documents and values you send to the APIs.
• Nature and purpose: validating, reading, converting and rendering e-invoices, and calculating cable sizes, as requested by you in each API call.
• Duration: each request is processed only until its answer has been sent. The agreement runs as long as you use the APIs.
• Types of data: the content of invoices, in particular names, addresses, e-mail addresses, telephone numbers, tax and registration numbers, bank details and the goods and services invoiced.
• Data subjects: sellers, buyers, payees, contact persons and other people named in the invoices.

3. Instructions

The processor processes the data only on documented instructions of the controller. The API call itself – endpoint and parameters – is the instruction. The processor informs the controller without delay if it considers an instruction to infringe data protection law.

4. Obligations of the processor

• Persons authorised to process the data are committed to confidentiality.
• The processor takes the technical and organisational measures listed in section 9 (Art. 32 GDPR) and may adapt them to technical progress without lowering the level of protection.
• Data is not stored: it stays in memory for the duration of the request and is discarded once the answer has been sent. There is therefore nothing to return or delete after the end of the contract.
• The processor assists the controller, taking into account the nature of the processing, with requests of data subjects, with data protection impact assessments and with the obligations of Art. 32 to 36 GDPR.
• The processor notifies the controller of a personal data breach without undue delay after becoming aware of it.
• The processor makes available the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits. Audits are announced in good time and carried out without disturbing operations; in the first place, written information and this description of measures serve as proof.

5. Sub-processors

The controller authorises the following sub-processor:

The processor informs the controller at least 30 days in advance of any intended addition or replacement, on this page and on the RapidAPI listing. The controller may object for important data protection reasons; if no solution is found, the controller may end the use of the API. The processor imposes the same data protection obligations on every sub-processor.

6. RapidAPI

Requests reach the processor through the RapidAPI gateway of Nokia of America Corporation, dba Rapid, which the controller has chosen and contracted directly. Rapid is not a sub-processor of the processor; the processing by Rapid is governed by the controller's agreement with Rapid, including Rapid's data processing addendum.

7. Transfers to third countries

The processor and its sub-processor process the data only within the European Union. Transfers by Rapid are governed by section 6.

8. Liability

Liability follows Art. 82 GDPR and, between the parties, the API terms of use.

9. Technical and organisational measures

Confidentiality

• Transport encryption: the APIs accept requests only over HTTPS (TLS).
• Access control: the APIs answer only requests that carry the secret of the RapidAPI gateway; everything else is rejected.
• No storage: documents are processed in memory only; there is no database and no file storage for request data.
• No access log; error logs contain no request content (see the API privacy notice).
• Administration only via SSH with keys; password and root login are disabled.
• Server in a data centre of Hetzner Online GmbH with physical access control by Hetzner.

Integrity

• Each conversion result is validated against the official rules before it is returned.
• XML with DOCTYPE or ENTITY declarations is rejected before parsing (protection against XML external entity attacks).
• Software is deployed only from a version-controlled repository after automated tests.

Availability and resilience

• Firewall with only the required ports open; protection against repeated failed log-ins.
• Security updates of the operating system are installed automatically; container images are rebuilt on each deployment.
• Request size and processing time are limited; each request runs in an isolated worker that is replaced after an error or timeout.

Review

• The measures are reviewed when the software or the hosting changes, and at least once a year.

All APIs · API terms of use · API privacy notice