> ## Documentation Index > Fetch the complete documentation index at: https://developers.novatrade24.com/llms.txt > Use this file to discover all available pages before exploring further. # GDPR > Data categories, lawful basis, subject rights, retention, and how the Integration API implements each. This page explains how the Integration API handles personal data under the GDPR (EU Regulation 2016/679). It is a technical summary of what the API does — the legally authoritative document is the [DPA](/security/dpa). ## Personal data categories handled | Category | Where | Sensitivity | | -------------------------------------------------------------- | --------------------------- | ---------------------------------------------------------------------- | | Business identification (company name, VAT, address) | Buyer record | Low (not "personal data" under strict GDPR reading for legal entities) | | Contact person details (name, email, phone) | Buyer contacts sub-resource | Personal | | Identity documents (ID card, passport, drivers' license scans) | KYC documents | Special category (biometric / ID) | | Face picture (iDenfy selfie, Mode B) | KYC documents | Biometric | | AML declaration / source of funds | KYC documents | Special category | | IBAN and bank details | Payment, Buyer bank account | Financial | | Driver identification (transport) | Transport pickup | Personal | | VIN / vehicle data | Order | Not personal data (vehicle, not person) | ## Lawful basis * **Contract performance** — processing buyer identification, documents, and transaction data is necessary to perform the compliance evaluation contracted via the DPA. * **Legal obligation** — VAT compliance evidence (10-year retention in EU member states) overrides erasure in narrowly-defined cases. * **Legitimate interest** — audit logging, fraud detection, platform integrity. Documented in the DPA. Consent is **not** the primary basis for platform processing — it would be unworkable in B2B transactions. Explicit consent may be required for specific downstream uses (e.g. marketing — not part of Integration API). ## Controller / processor Novatrade24 is typically a **processor** for customer data you provide via the Integration API. Your organization is the **controller** for the data on the buyers you submit. Joint-controller arrangements exist for certain categories — see your DPA. ## Data minimization The API is designed to minimize surface area for personal data: * `GET /buyers/{id}` returns business-level data only. Personal contact details are on a separate `/contacts` sub-resource. * The `/contacts` sub-resource requires the `allowContactPersonalData` capability — off by default. * KYC document downloads require the `allowKycDocumentDownload` capability. * Fields tolerate omission (Jackson `NON_NULL`) — integrations that don't need personal data never see it. ## Data subject rights ### Access / portability Customer can export their own data via existing endpoints (`GET /buyers/{id}`, `GET /orders/...`). Per DPA, Novatrade24 assists in fulfilling data-subject-access requests that reach either party. ### Rectification Via `PATCH` on the relevant resource (buyer, contact). Version-bumps on the entity; Envers records who changed what. ### Erasure Complicated by overlapping obligations: * Data subject requests erasure. * Platform has legal retention obligation (VAT: 10 years). * Integration customer may have independent retention obligation. Process: 1. Request reaches NT24 or customer. 2. NT24 evaluates retention overrides per DPA. 3. Non-required freeform fields erased. 4. Records required by law remain with minimal fields (VAT, amount, date, buyer name for the invoice). 5. A `buyer.erasure_required` webhook (Phase 3+) notifies customer to cascade deletion in their own datastore. ### Objection / restriction Per DPA. The Integration API does not provide a self-service object-to-processing endpoint; route via support. ## Retention | Data | Retention | Notes | | --------------------------- | ------------------------------- | ------------------ | | Buyer / order business data | Transaction lifetime + 10 years | EU VAT mandatory | | KYC documents | Transaction lifetime + 10 years | Legal audit chain | | Envers audit revisions | Same as source entity | | | HTTP access logs | 6 years | PII access audit | | Webhook delivery history | 30 days | Debugging / replay | | Idempotency-key cache | 24 hours | Replay-safety only | ## Encryption * **TLS 1.2+** enforced on all API endpoints. Older protocols rejected. * **At-rest disk encryption** on databases and object storage. * **Field-level encryption** on bank account numbers and ID document scans (sensitive fields within otherwise plaintext tables). ## International transfers * **All Integration API data stored in Germany** (Hetzner Falkenstein). * **No third-country transfers** as part of platform processing. * Limited third-party services (Stripe, iDenfy) process some data within the EU under standard contractual clauses and their own DPAs — see the DPA for the current sub-processor list. ## Audit trail * **Every API call logged** with caller identity (API client UUID), partner context, endpoint, timing, status, trace id. * **Hibernate Envers** records every entity write with actor attribution (`api_client:{uuid}` vs `user:{uuid}`). * **PII-access events** (reads of contact data, KYC document downloads) logged to a separate stream with 6-year retention. * Customer can provide `X-Purpose` header for per-request justification. ## Breach notification Per DPA — NT24 notifies affected organizations promptly when a security incident meets the classification criteria. Notifications include: * Nature, scope, data categories affected. * Estimated affected data subjects. * Mitigations applied. * Recommended customer actions. GDPR's 72-hour authority notification deadline applies to NT24 as controller for its own platform data. For processed data, NT24 notifies the customer promptly so the customer (as controller) can meet their own obligation. ## Sub-processors Current sub-processors handling personal data: * **Hetzner Online GmbH** (hosting, Germany) * **Stripe** (payment processing, EU) * **iDenfy** (KYC verification, EU) Authoritative list in the DPA. Customer is notified before new sub-processors are added. ## Reporting a GDPR concern * **Data subject requests** reaching your side: route per your DPA. * **Data subject requests reaching NT24 directly**: [privacy@novatrade24.com](mailto:privacy@novatrade24.com). * **Security incidents**: [security@novatrade24.com](mailto:security@novatrade24.com). ## Next Authoritative controller/processor terms. Encryption, residency, audit.