Data Processing Agreement (DPA)

If you use Volk Accountant to process personal data, a data processing agreement may be a necessary part of your data protection compliance. On this page we explain what such an agreement is, when you need it, what it covers and how you can request it from us.

This page describes our processing and DPA annexes. It does not replace separately concluding the agreement under Art. 28 GDPR.

What is a data processing agreement?

A data processing agreement is a contract under Article 28 of the General Data Protection Regulation (GDPR). It governs the processing of personal data by a processor on behalf of the controller.

The agreement sets out the rules under which the processor may handle the personal data entrusted to it, and it ensures that this processing takes place only within the framework defined by the controller and by data protection law.

Why do you need it?

If you enter personal data of third parties – for example the data of your clients – into Volk Accountant, you are the controller within the meaning of data protection law, and we act as your processor. In this situation, a data processing agreement is legally required.

Concluding the agreement puts the relationship between you as controller and us as processor on a proper legal footing and helps you meet your own obligations under the GDPR.

What does it govern?

The data processing agreement addresses the essential aspects of the processing carried out on your behalf. In particular, it governs:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the categories of data subjects and of personal data;
• the technical and organisational measures;
• the use of sub-processors;
• the deletion or return of the data after the contract ends;
• the controller's rights of control and instruction.

Scope of processing on your behalf

We process business data you enter for the agreed bookkeeping functions and under your documented instructions. Data subjects may include your customers, suppliers, contacts and payment counterparties. Data categories include master and contact data, invoices and quotes, receipts, tax details, payment data and bank records. Account, billing and our own support administration data are processed under our own responsibility, as described in the privacy policy.

Annex 1: Technical and organisational measures

• TLS-protected transmission and encrypted storage in the Frankfurt/EU data region.
• Tenant separation, role-based permissions and server-side access checks.
• Password hashing, time-limited file access and file-upload checks.
• Regular backups, security logs and documented deletion and incident processes.

Measures are developed according to risk. The EU data region does not mean that all providers or every processing step are located exclusively within the EU.

Annex 2: Sub-processors and other recipients

Roles are distinguished below: an independent controller does not become a sub-processor merely because of a technical integration.

Stripe Payments Europe Ltd. predominantly acts as an independent controller for subscription billing and its own payment-service duties. Hetzner Online GmbH is used for website contact-form emails; Google Analytics relates to website analytics. These activities are distinct from storing customer business data on the customer’s instructions.

For bank access under its own authorisation, Enable Banking provides a separate service subject to the terms displayed during connection. If another contractual access model is agreed, roles and contracts must be adjusted before that model is used.

Third-country transfers require the applicable safeguards, in particular Standard Contractual Clauses under Art. 46 GDPR and, where applicable, the EU-US Data Privacy Framework. Notification and objection procedures for changes of sub-processors are governed by the concluded DPA.

Assistance, personal data breaches and deletion

Within the DPA, we assist the controller with data-subject requests and its duties under Art. 32 to 36 GDPR. We notify it without undue delay after becoming aware of a breach affecting data processed on its behalf and provide available information for assessment and notification. Direct requests and incident reports to info@volkaccountant.com.

After the contract ends, data are returned or deleted under the DPA, the customer’s instructions and applicable retention duties. The terms provide a 30-day export period. Company deletion is arranged through support after authorisation checks and includes associated files. Backups are overwritten through backup cycles. Necessary evidence is retained only to the extent legally required.

How to request the DPA?

You can request the data processing agreement by email at info@volkaccountant.com. We will provide the DPA to you for conclusion.

Once concluded, the agreement forms the contractual basis for our processing of personal data on your behalf and complements our other terms and our privacy policy.