Data processing agreement

1. Parties and scope

This data processing agreement ("DPA") is between the customer who accepted the terms of service for an xmlvalid account ("you", the controller) and Oleksii Babintsev, a sole proprietor (FOP) registered in Ukraine, operating xmlvalid ("we", the processor). It forms part of the terms of service and applies, without signing, whenever we process personal data on your behalf that is subject to the GDPR (Regulation (EU) 2016/679), the UK GDPR or the Swiss Federal Act on Data Protection ("data protection law").

It covers the personal data contained in what you send to the server-side features: documents and schemas sent to the API or fetched by URL, URL monitors, webhooks, shared report links and saved schemas ("customer data"). Documents validated in the browser are not sent to us and are not processed by us. Account, billing and usage data we process as a controller, as described in the privacy policy.

2. Roles and instructions

You are the controller of customer data and we are its processor. We process it only on your documented instructions, which are the terms of service, this DPA and your use of the service's features, unless the law we are subject to requires otherwise; we will tell you of such a requirement first, unless that law forbids it. We will tell you if we believe an instruction infringes data protection law. You are responsible for having a lawful basis for the processing and for the instructions you give.

3. The processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

4. Confidentiality and security

We ensure that anyone authorised to process customer data is bound by confidentiality. We implement the technical and organisational measures in Annex II, which provide a level of security appropriate to the risk, as Article 32 of the GDPR requires. We may change them as long as the overall level of security is not reduced.

5. Subprocessors

You give us a general authorisation to engage the subprocessors listed in Annex III and on the security page. We will announce a new or replacement subprocessor there, and email the account owners of paid plans, at least 30 days before it starts processing customer data. You may object on reasonable data protection grounds within that period; if we can't address the objection, you may end the affected service and, on a paid plan, receive a pro-rata refund of the period you have paid for and not used. We impose on each subprocessor, by contract, data protection obligations that are no less protective than this DPA, and remain responsible to you for its performance.

6. Assistance

Taking into account the nature of the processing, we help you respond to requests from data subjects exercising their rights, and with data protection impact assessments and prior consultations, as far as these concern our processing. If a data subject contacts us directly about customer data, we will pass the request on to you and not answer it ourselves, unless you ask us to.

7. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data. The notice goes to your account's email address and describes, as far as we know at the time, the nature of the breach, the categories and approximate number of records and data subjects concerned, its likely consequences and the measures taken or proposed. We provide further information as it becomes available and take reasonable steps to contain the breach.

8. Deletion and return

Customer data is deleted on the schedule in Annex I during the service. When your account is deleted, we delete the customer data it holds within 30 days, except where the law requires us to keep it. Before that you can download your saved schemas and validation history from the dashboard. Database backups that may still contain deleted data are overwritten within 30 days.

9. Audits

We make available the information needed to demonstrate compliance with this DPA and Article 28 of the GDPR, and answer reasonable security questionnaires. Where that is not enough, or a supervisory authority requires it, you may audit our processing, yourself or through an independent auditor bound by confidentiality, at most once a year, with 30 days' notice, during business hours, at your cost, and without access to other customers' data.

10. International transfers

Customer data is stored in the European Union (Annex III). Because we, the processor, are established in Ukraine, for which the European Commission has not adopted an adequacy decision, access to customer data from Ukraine is a transfer to a third country. For such transfers, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module Two (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer, and:

• clause 7 (docking clause) applies;
• clause 9: option 2, general written authorisation, with the 30 days' notice in section 5;
• clause 11: the optional wording does not apply;
• clause 13: the supervisory authority is the one competent for you under that clause;
• clauses 17 and 18: the law of Ireland and the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by the annexes of this DPA.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies, with the tables completed by this DPA and neither party able to end it under its section 19. For transfers subject to the Swiss FADP, the SCCs apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and Switzerland as a possible place of habitual residence of data subjects for clause 18(c).

Where a subprocessor outside the EEA is engaged, we ensure the transfer is covered by an adequacy decision or by the SCCs (Module Three) with it.

11. Liability and precedence

Each party's liability under this DPA is subject to the limits in the terms of service, except where data protection law or the SCCs do not allow them to be limited. If this DPA and the terms of service conflict, this DPA prevails for the processing of customer data; if the SCCs and this DPA conflict, the SCCs prevail. This DPA lasts as long as we process customer data for you. We may update it to reflect changes in law or in the service, announcing material changes on the site 30 days before they apply; the version in force is the one on this page.

Annex I: details of the processing

Parties. Data exporter and controller: the customer, as identified in its account; its contact is the account's email address. Data importer and processor: Oleksii Babintsev, FOP, Ukraine, operating xmlvalid; contact support@xmlvalid.com. Activity: an XML validation service.

Categories of data subjects. Whoever is named in the documents you send: typically your customers, suppliers, their contact persons and your employees.

Types of personal data. Whatever your documents contain, which you decide: typically names, postal and email addresses, phone numbers, tax and company identifiers, bank account numbers (IBAN) and invoice details. No special categories of data are intended; don't send them unless you need to and the law allows it.

Nature and purpose. Receiving, storing for a short time and validating XML documents against schemas and business rules, and returning, sending (webhooks) or showing (report links) the results, as you request through the service.

Frequency. Continuous, each time you use a server-side feature.

Duration and retention. For as long as you use the service. Documents and schemas sent to the API or fetched by URL: deleted after the validation, within 24 hours at most. API results and webhook bodies: 24 hours. URL monitor results, including the first error message: 30 days. Report links: 30 days or until you delete them. Saved schemas and their rules: until you delete them or the account. Backups: up to 30 days.

Annex II: technical and organisational measures

• Data minimisation: the validator works in the browser, and server-side features keep documents only while they are validated.
• Encryption: TLS for all traffic to the site and the API; files in Cloudflare R2 encrypted at rest.
• Access control: access to the servers, the database and storage is limited to the operator, with separate credentials for each service; each account sees only its own data.
• Credentials: passwords stored as bcrypt hashes and API keys as hashes; card data handled only by Paddle.
• Isolation: the validation engine reads only the files of the validation it runs and has no network access; the URL fetcher reaches public addresses only.
• Availability: regular database backups to Cloudflare R2 in the EU; protection from attacks by Cloudflare.
• Monitoring: error tracking (Sentry) and logs to detect failures and abuse; rate limits on the API and sign-in.
• Deletion: automatic deletion on the schedules in Annex I.
• Development: changes are tested automatically before they are deployed; dependencies are kept up to date.

Annex III: subprocessors