> ## Documentation Index
> Fetch the complete documentation index at: https://developers.novatrade24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Processing Agreement (DPA)

> Controller/processor relationship, obligations, sub-processors, and how DPA state is enforced technically.

This page summarizes the structure and technical enforcement of the
Novatrade24 Data Processing Agreement. The **signed DPA is the
authoritative legal document** — this page is a non-binding technical
orientation.

<Warning>
  Nothing on this page is legal advice. Work with your DPO / counsel on
  the substantive DPA content. Contact
  [legal@novatrade24.com](mailto:legal@novatrade24.com) to request the
  current DPA template.
</Warning>

## Who signs what

| Role                  | Entity            | Typical controller/processor status                                                                            |
| --------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------- |
| **Customer**          | Your organization | Controller of buyers' data you submit                                                                          |
| **Novatrade24**       | Novatrade24 GmbH  | Processor for customer-submitted data; controller for platform-internal data (logs, billing, infra)            |
| **Joint controllers** | Both              | For specific categories documented per-case (e.g. KYC review workflows where NT24 makes substantive decisions) |

Exact roles are documented per data category in the signed DPA Annex.

## Standard DPA content

The current template covers:

1. **Subject matter and duration.** Scoped to the Integration API's
   lifetime at your organization.
2. **Nature and purpose of processing.** EU VAT compliance, cross-border
   transaction validation.
3. **Categories of personal data.** See [GDPR data categories](/security/gdpr#personal-data-categories-handled).
4. **Categories of data subjects.** Buyer contact persons, identity
   subjects of uploaded ID documents, transport drivers.
5. **Controller obligations.** Your obligations as customer (lawful basis,
   providing accurate data, handling subject requests you receive).
6. **Processor obligations.** NT24's obligations (security measures,
   confidentiality, sub-processor management, breach notification, audit
   cooperation, data return/deletion at end of engagement).
7. **Sub-processors.** Initial list (Hetzner, Stripe, iDenfy), approval
   mechanism for additions, objection rights.
8. **Security measures.** Referenced to the technical documentation
   (see [Security overview](/security/overview)).
9. **Data transfers.** EU-only; SCCs for any ancillary third-country
   flows.
10. **Audit rights.** Customer's right to audit and how it's exercised
    (e.g. annual SOC 2 report sharing in lieu of on-site audit).
11. **Liability and indemnification.** Per the master agreement.
12. **Term and termination.** Aligned with the master agreement.

## Technical enforcement

The signed DPA version is stored on your `IntegrationOrganization`:

```json theme={null}
{
  "organizationUuid": "550e8400-...",
  "dpaVersion": "2026-01",
  "dpaAcceptedAt": "2026-02-15T10:00:00Z"
}
```

* **No DPA → 403.** API requests are rejected with
  `type: dpa-not-accepted` if `dpaAcceptedAt` is null.
* **Outdated DPA → 403** (after grace period). When we publish a new DPA
  version, we notify organization admins and set a grace window
  (typically 90 days) before enforcement. After the grace window, API
  calls against the old version return `403`.

### Inspect your DPA status

```bash theme={null}
curl "https://api.novatrade24.com/v1/me" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}"
```

```json theme={null}
{
  "dpaVersion": "2026-01",
  "dpaAcceptedAt": "2026-02-15T10:00:00Z"
}
```

## Signing process

1. Reach out via [our contact page](https://www.novatrade24.com/contact) to request the current DPA version.
2. Legal review on your side.
3. Both parties sign (typically DocuSign).
4. NT24 records the signed version on your organization.
5. `GET /v1/me` reflects acceptance immediately.
6. API access unblocks.

## Updating the DPA

New DPA versions are published when:

* Regulatory change requires updated language (e.g. EU-US adequacy
  decision changes).
* Sub-processor list changes materially.
* Platform scope changes (new data categories).

Process:

1. Notice to organization admins on record (90+ days advance).
2. Grace window during which old version remains enforced.
3. Cutover: sign new version OR API calls start returning `403`.

## Sub-processor changes

Current sub-processors are listed in the DPA. Customer is notified
before new sub-processors are added — typically a 30-day objection
window. Unresolved objections may be grounds for termination per the
master agreement.

## Data return and deletion at termination

At end of engagement:

* Customer may request data export in a machine-readable format
  (JSON / CSV) for all data they submitted.
* After export confirmation, NT24 deletes customer-provided data
  subject to legal retention overrides (VAT records remain for the
  mandatory retention period, with access limited to compliance staff).
* Customer-provided data in backups expires per backup retention
  schedule (typically 90 days).
* A termination certificate is issued on completion.

## Questions

* **DPA text / negotiation:** [legal@novatrade24.com](mailto:legal@novatrade24.com)
* **Technical enforcement / API gate behavior:** [contact page](https://www.novatrade24.com/contact)
* **Privacy / data-subject issues:** [privacy@novatrade24.com](mailto:privacy@novatrade24.com)

## Next

<CardGroup cols={2}>
  <Card title="GDPR details" icon="scale-balanced" href="/security/gdpr">
    Data categories, subject rights, retention.
  </Card>

  <Card title="Security overview" icon="lock" href="/security/overview">
    Encryption, residency, audit trail.
  </Card>
</CardGroup>