Data Processing Agreement (DPA)

If you use Volk Accountant to process personal data, a data processing agreement may be a necessary part of your data protection compliance. On this page we explain what such an agreement is, when you need it, what it covers and how you can request it from us.

What is a data processing agreement?

A data processing agreement is a contract under Article 28 of the General Data Protection Regulation (GDPR). It governs the processing of personal data by a processor on behalf of the controller.

The agreement sets out the rules under which the processor may handle the personal data entrusted to it, and it ensures that this processing takes place only within the framework defined by the controller and by data protection law.

Why do you need it?

If you enter personal data of third parties – for example the data of your clients – into Volk Accountant, you are the controller within the meaning of data protection law, and we act as your processor. In this situation, a data processing agreement is legally required.

Concluding the agreement puts the relationship between you as controller and us as processor on a proper legal footing and helps you meet your own obligations under the GDPR.

What does it govern?

The data processing agreement addresses the essential aspects of the processing carried out on your behalf. In particular, it governs:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the categories of data subjects and of personal data;
• the technical and organisational measures;
• the use of sub-processors;
• the deletion or return of the data after the contract ends;
• the controller's rights of control and instruction.

Sub-processors used

In order to provide the application, we make use of carefully selected sub-processors. These currently are:

• Vercel Inc. — hosting, function region Frankfurt
• Supabase Inc. — database, authentication and file storage, data region EU/Frankfurt
• Hetzner Online GmbH — contact-form email delivery, Germany
• Resend (Plus Five Five, Inc.) — transactional emails from the application
• Anthropic PBC / Anthropic Ireland Ltd. — AI-assisted receipt recognition, translation and support chat (no training on transmitted data)
• Stripe Payments Europe Ltd. — subscription billing
• Google Ireland Limited — Google Drive integration, only where you actively connect it

Transfers to third countries are safeguarded by Standard Contractual Clauses under Art. 46 GDPR and, where applicable, the EU-US Data Privacy Framework. We inform you in advance of any change or addition of a sub-processor, and you may object.

How to request the DPA?

You can request the data processing agreement by email at info@volkaccountant.com. We will provide the DPA to you for conclusion.

Once concluded, the agreement forms the contractual basis for our processing of personal data on your behalf and complements our other terms and our privacy policy.