Data Processing Addendum (DPA)

Last updated: October 2026

This Data Processing Addendum (“DPA”) forms part of the Notaly Terms of Service (“Terms”) and applies where Notaly processes personal data on behalf of the Customer as a processor under the General Data Protection Regulation (“GDPR”) or the UK GDPR.

Parties:

• Customer — the account holder that submits invoice data to the Service (referred to as “you” or “your” in the Terms). Where GDPR applies to invoice data, Customer is the controller.
• Notaly — the operator of getnotaly.com and provider of the Service (referred to as “we”, “us” or “our” in the Terms). In respect of invoice data, Notaly is the processor.

Contact: hello@getnotaly.com

1. Interpretation

• Terms used in this DPA have the meanings given in the Terms and in the GDPR. “Personal Data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings in Article 4 GDPR.
• “Subprocessor” means a third party engaged by Notaly to process Personal Data on Notaly’s behalf under this DPA.
• In the event of any conflict between this DPA and the Terms, this DPA prevails in respect of the processing of Personal Data.

2. Roles and scope

• This DPA applies to Personal Data contained in invoice data that Customer submits to the Service (the “Customer Data”), and not to account, billing or service usage data, which Notaly processes as its own controller under the Privacy Policy.
• Payment data is collected and processed by Paddle as Merchant of Record. This DPA does not cover Paddle’s processing of payment card data; that processing is governed by Paddle’s own terms and privacy policy.
• The Customer remains the controller of the Customer Data and is responsible for the lawfulness of processing, including having a valid legal basis to share the Customer Data with Notaly and to have Notaly transmit it to KSeF or other third-party systems.

3. Details of processing

The subject matter, nature, purpose, duration and categories of processing are set out in Annex 1. Notaly processes Customer Data only on the Customer’s documented instructions, which consist of providing, operating, securing and supporting the Service.

4. Processor obligations

Notaly will:

• process Customer Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a third country, unless required by EU, UK or Member State law, in which case Notaly will inform the Customer of that requirement before processing unless prohibited by law;
• ensure that persons authorized to process Customer Data are bound by confidentiality obligations;
• take appropriate technical and organizational measures as described in Annex 2;
• engage Subprocessors only as permitted under Section 5;
• assist the Customer, taking into account the nature of processing and information available to Notaly, in responding to requests from data subjects exercising their rights, and in meeting the Customer’s obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation);
• notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data; and
• at the Customer’s choice, delete or return Customer Data on termination, subject to retention required by applicable law (see Section 8).

5. Subprocessors and onward recipients

• The Customer grants a general authorization for Notaly to engage Subprocessors. Notaly will maintain a list of Subprocessors and will inform the Customer of intended changes, giving the Customer a reasonable opportunity to object before the change takes effect.
• Current Subprocessors include the hosting and infrastructure provider(s) used to provide the Service (storage in the European Union / European Economic Area) and, where Peppol delivery is used, certified Peppol access point partner(s).
• KSeF, operated by Poland’s Ministry of Finance, is a recipient of Customer Data because the Customer instructs Notaly to submit invoices to that system. KSeF is not a Subprocessor; the transmission occurs on the Customer’s documented instruction to provide the Service.
• Notaly will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and remains liable to the Customer for the Subprocessor’s performance of those obligations.

6. International transfers

• Customer Data is stored and processed in the European Union / European Economic Area.
• If a transfer of Customer Data outside the EEA is required, Notaly will rely on an appropriate safeguard under the GDPR, such as the European Commission’s Standard Contractual Clauses, and will provide further information on request.

7. Security

• Notaly implements and maintains the technical and organizational measures described in Annex 2.
• Notaly may update the measures in Annex 2 from time to time, provided the level of protection is not materially reduced.

8. Retention, deletion and return

• Notaly retains Customer Data for as long as necessary to provide the Service and to comply with applicable tax and accounting law, which may require retention of invoice data and related records (including submission references and UPO) for up to 10 years.
• On termination, and subject to the retention obligations above, Notaly will delete Customer Data within a reasonable period, or return it to the Customer at the Customer’s written request.
• Where deletion is not possible because of legal retention obligations, Notaly will limit processing of that data to what is necessary to comply with those obligations.

9. Audits

• Notaly will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable notice and confidentiality.
• Audits are limited to one per calendar year unless required by a supervisory authority or following a personal data breach.

10. Liability

• Each party’s liability under this DPA is subject to the limitation of liability in Section 12 of the Terms.
• The allocation of roles in this DPA does not limit the Customer’s obligations as controller, including the obligation to ensure a valid legal basis for processing and to respond to its own data subjects and supervisory authorities.

11. Term and termination

• This DPA is effective for the duration of the processing and continues for as long as Notaly retains Customer Data as permitted under Section 8.
• On termination, Sections 8, 10 and 12 survive.

12. Governing law

• This DPA is governed by the same law and jurisdiction as the Terms (Section 16 of the Terms).
• If the processing is subject to the GDPR, the parties agree that the courts of the Member State in which the Customer is established have jurisdiction, without prejudice to mandatory provisions.

Annex 1 — Details of processing

Subject matter: provision of the Notaly e-invoicing Service.

Nature and purpose of processing:

• receiving invoice data through the API;
• generating structured invoice documents (currently FA(3) XML for KSeF);
• validating structure against the applicable schema;
• submitting invoices to KSeF and other applicable systems;
• returning status, submission references and UPO;
• generating PDFs and QR codes;
• operating webhooks and storing records necessary to provide the Service.

Duration: for the term of the agreement and any applicable retention period described in Section 8.

Categories of data subjects:

• the Customer’s personnel and authorized users;
• the Customer’s customers and counterparties, including sole traders and entrepreneurs;
• any other individuals whose data appears in invoice content.

Categories of Personal Data:

• names;
• addresses;
• tax identification numbers (including Polish NIP and, where provided, PESEL);
• contact details (email, telephone, where provided);
• invoice line items, amounts, tax rates and related invoice metadata.

Special categories of data: none. The Customer must not submit special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) through the Service.

Frequency: continuous, on demand.

Annex 2 — Technical and organizational measures

Notaly maintains measures including the following:

• Encryption: encryption in transit (TLS) and at rest; customer KSeF tokens are encrypted with AES-256-GCM with per-tenant authenticated data.
• Access control: least-privilege access, unique user accounts, and restricted access to production systems.
• Tenant isolation: Customer Data is segregated by account, including binding encrypted secrets to the account, tax identifier and environment.
• Logging and monitoring: security and operational logging with access limited to authorized personnel.
• Data residency: storage and processing of Customer Data in the European Union / European Economic Area.
• Backup and recovery: regular backups and tested restore procedures.
• Confidentiality: personnel with access to Customer Data are bound by confidentiality obligations and receive data protection awareness training.
• Incident response: documented procedures for detecting, containing and reporting personal data breaches, and for notifying the Customer without undue delay.