Skip to main content
This page summarizes the structure and technical enforcement of the Novatrade24 Data Processing Agreement. The signed DPA is the authoritative legal document — this page is a non-binding technical orientation.
Nothing on this page is legal advice. Work with your DPO / counsel on the substantive DPA content. Contact [email protected] to request the current DPA template.

​
Who signs what

RoleEntityTypical controller/processor status
CustomerYour organizationController of buyers’ data you submit
Novatrade24Novatrade24 GmbHProcessor for customer-submitted data; controller for platform-internal data (logs, billing, infra)
Joint controllersBothFor specific categories documented per-case (e.g. KYC review workflows where NT24 makes substantive decisions)
Exact roles are documented per data category in the signed DPA Annex.

​
Standard DPA content

The current template covers:
  1. Subject matter and duration. Scoped to the Integration API’s lifetime at your organization.
  2. Nature and purpose of processing. EU VAT compliance, cross-border transaction validation.
  3. Categories of personal data. See GDPR data categories.
  4. Categories of data subjects. Buyer contact persons, identity subjects of uploaded ID documents, transport drivers.
  5. Controller obligations. Your obligations as customer (lawful basis, providing accurate data, handling subject requests you receive).
  6. Processor obligations. NT24’s obligations (security measures, confidentiality, sub-processor management, breach notification, audit cooperation, data return/deletion at end of engagement).
  7. Sub-processors. Initial list (Hetzner, Stripe, iDenfy), approval mechanism for additions, objection rights.
  8. Security measures. Referenced to the technical documentation (see Security overview).
  9. Data transfers. EU-only; SCCs for any ancillary third-country flows.
  10. Audit rights. Customer’s right to audit and how it’s exercised (e.g. annual SOC 2 report sharing in lieu of on-site audit).
  11. Liability and indemnification. Per the master agreement.
  12. Term and termination. Aligned with the master agreement.

​
Technical enforcement

The signed DPA version is stored on your IntegrationOrganization: 
{
  "organizationUuid": "550e8400-...",
  "dpaVersion": "2026-01",
  "dpaAcceptedAt": "2026-02-15T10:00:00Z"
}
  • No DPA → 403. API requests are rejected with type: dpa-not-accepted if dpaAcceptedAt is null.
  • Outdated DPA → 403 (after grace period). When we publish a new DPA version, we notify organization admins and set a grace window (typically 90 days) before enforcement. After the grace window, API calls against the old version return 403.

​
Inspect your DPA status

curl "https://api.novatrade24.com/v1/me" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"

{
  "dpaVersion": "2026-01",
  "dpaAcceptedAt": "2026-02-15T10:00:00Z"
}

​
Signing process

  1. Reach out via our contact page to request the current DPA version.
  2. Legal review on your side.
  3. Both parties sign (typically DocuSign).
  4. NT24 records the signed version on your organization.
  5. GET /v1/me reflects acceptance immediately.
  6. API access unblocks.

​
Updating the DPA

New DPA versions are published when:
  • Regulatory change requires updated language (e.g. EU-US adequacy decision changes).
  • Sub-processor list changes materially.
  • Platform scope changes (new data categories).
Process:
  1. Notice to organization admins on record (90+ days advance).
  2. Grace window during which old version remains enforced.
  3. Cutover: sign new version OR API calls start returning 403.

​
Sub-processor changes

Current sub-processors are listed in the DPA. Customer is notified before new sub-processors are added — typically a 30-day objection window. Unresolved objections may be grounds for termination per the master agreement.

​
Data return and deletion at termination

At end of engagement:
  • Customer may request data export in a machine-readable format (JSON / CSV) for all data they submitted.
  • After export confirmation, NT24 deletes customer-provided data subject to legal retention overrides (VAT records remain for the mandatory retention period, with access limited to compliance staff).
  • Customer-provided data in backups expires per backup retention schedule (typically 90 days).
  • A termination certificate is issued on completion.

​
Questions

​
Next

GDPR details

Data categories, subject rights, retention.

Security overview

Encryption, residency, audit trail.