Data Processing Agreement

Version: 2.1
Date: 4 August 2026
Entity: B2Brouter Global, S.L.

1. Purpose and contractual incorporation

This Data Processing Agreement (the “DPA”) governs the conditions under which B2Brouter Global, S.L. (“B2Brouter”) will process personal data on behalf of the customer, contracting entity, partner, integrator, reseller or third party that contracts or uses B2Brouter services (the “Client”).

This DPA applies in connection with the provision of B2Brouter, B2Bconnector, eDocSync and other associated services for the issue, receipt, transformation, transmission, retention, tracking and management of electronic invoices, electronic documents and tax reports, as well as technical integrations, support, maintenance, monitoring, security and related functionalities.

This DPA forms an integral part of the agreements, terms of service, service orders, schedules, proposals, commercial agreements or any other contractual documents that expressly incorporate it or refer to it, whenever B2Brouter processes personal data on behalf of the Client or third parties in connection with the contracted services.

No separate signature of the DPA will be required where its acceptance results from those contractual documents or from the commencement of services involving the processing of personal data on behalf of the Controller.

2. Roles of the Parties

As a general rule, the Client will act as controller and B2Brouter will act as processor in accordance with Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, the “GDPR”) and other applicable data protection legislation.

However, where the Client uses B2Brouter services to provide services to its own customers, users, group companies, recipients or third parties, including eDocSync white-label, resale, intermediation, integration, delegation, provision under the Client’s brand or services offered to the Client’s end customers, the Parties acknowledge that the Client may act, as applicable, as controller or processor in relation to those third parties.

In such cases, B2Brouter will act as processor or, where the Client itself acts as processor for a third-party controller, as sub-processor, in accordance with Article 28 of the GDPR.

For the purposes of this DPA, references to the Controller include the Client when it acts as controller and, where applicable, the third-party controller on whose behalf the Client acts. References to the Processor include B2Brouter when it acts as processor or sub-processor.

3. eDocSync white-label, resale or integration services

Where the Client uses B2Brouter services to provide services to third parties, including eDocSync white-label, resale, integration, intermediation, delegation or provision under the Client’s brand, the Client is responsible for obtaining the authorisations, instructions, legal bases, contracts, data processing agreements, notices and consents required in relation to its own customers, users, recipients or third parties.

The Client warrants that its agreements, terms of service, privacy policies, data processing agreements or equivalent documentation permit B2Brouter’s involvement in providing the services and, where applicable, its appointment as processor or sub-processor.

The provision of eDocSync white-label services does not release the Client from its obligations regarding transparency, information, authorisation of sub-processors, legal basis, security, handling of data subject rights and any other obligations applicable to it under data protection law.

Where B2Brouter acts as sub-processor, the Client is responsible for passing on to B2Brouter only lawful instructions that are compatible with the instructions received from the relevant controller.

4. Nature, purpose and duration of the processing

The nature and purpose of the processing, the categories of personal data and data subjects, and the other details of the processing are described in Annex I --- Details of the Processing.

The processing will continue for the duration of the contractual relationship between B2Brouter and the Client, unless certain data must be retained in restricted form for a longer period in order to comply with legal, tax, accounting or regulatory obligations, or for the establishment, exercise or defence of legal claims.

Once the services have ended, B2Brouter will return, delete or make available to the Client the personal data processed on its behalf, in accordance with the main agreement, this DPA and applicable law.

5. Instructions of the Controller

B2Brouter will process personal data only on documented instructions from the Client.

The following will be considered documented instructions from the Client:

• the main agreement entered into or accepted by the Parties;
• this DPA;
• the applicable schedules, service orders, specific terms or contractual documents;
• the settings configured by the Client on the platform;
• instructions provided by the Client through B2Brouter’s official support, integration or communication channels;
• instructions arising from the ordinary use of the contracted services.

B2Brouter will not use personal data for its own purposes or for purposes other than providing the services, unless required to do so by Union or Member State law. In that case, B2Brouter will inform the Controller of that legal requirement before the processing, unless the applicable law prohibits such information on important grounds of public interest.

If B2Brouter considers that an instruction from the Client infringes applicable data protection legislation, it will inform the Client, unless applicable law prohibits such communication.

6. Obligations of the Client and the Controller

The Client and, where applicable, the Controller are responsible for:

• ensuring that the processing of personal data has a valid legal basis;
• providing information to data subjects in accordance with applicable law;
• ensuring the accuracy, lawfulness, currency, relevance and minimisation of personal data provided or managed through the services;
• obtaining, where applicable, the necessary consents, authorisations, mandates, instructions or legal bases;
• handling data subject rights, except where the reasonable assistance of B2Brouter is required;
• determining the purposes and essential means of the processing;
• ensuring that the instructions given to B2Brouter are lawful and comply with applicable law;
• carrying out, where applicable, data protection impact assessments, risk assessments or prior consultations with the competent supervisory authority;
• ensuring that personal data entered, uploaded, transmitted or managed through the services does not include special categories of personal data unless there is a sufficient legal basis and, where applicable, appropriate additional measures have been agreed;
• ensuring, in eDocSync white-label, resale, integration or intermediation scenarios, that it has sufficient authorisation to appoint B2Brouter as processor or sub-processor.

B2Brouter will not be responsible for any absence, insufficiency or inaccuracy of the legal basis, information, authorisation, consent, mandate, instruction or documentation for which the Client or controller is responsible.

7. Obligations of B2Brouter

B2Brouter undertakes to:

• process personal data only in accordance with the documented instructions of the Client;
• not apply or use personal data for purposes other than those set out in the agreement and this DPA;
• not disclose personal data to third parties except as provided in this DPA or the agreement, on the Client’s instructions or where required by law;
• ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
• reasonably assist the Client in complying with its data protection obligations, on the terms set out in this DPA;
• notify the Client of personal data breaches of which it becomes aware, in accordance with this DPA;
• make available to the Client the information reasonably necessary to demonstrate compliance with the obligations under Article 28 of the GDPR;
• delete, return or make available the personal data at the end of the services, in accordance with this DPA;
• impose on its sub-processors the same data protection obligations as those set out in this DPA, in accordance with Article 28(4) of the GDPR.

8. Confidentiality

B2Brouter will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

The confidentiality obligation will continue after the contractual relationship between the Parties ends.

B2Brouter will take reasonable measures to limit access to personal data to personnel, contractors, providers, group companies or sub-processors that need access to those data in order to provide the services.

The Client must preserve the confidentiality of the documentation, security measures, internal processes, technical information, trade secrets, reports, evidence or compliance documentation provided by B2Brouter under this DPA.

9. Technical and organisational measures

B2Brouter will implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Such measures may include, among other things, access controls, authentication mechanisms, encryption of communications, logical segregation, backups, monitoring, incident management, activity logging, internal security policies, service continuity measures and recovery procedures.

The applicable technical and organisational measures are described in Technical and Organisational Measures / TOMs.

The Client acknowledges that the security measures may evolve during the term of the agreement, provided that such updates do not materially reduce the agreed level of security.

Specific availability, support, continuity, RTO, RPO or service-level objectives will be governed, where applicable, by the main agreement, the applicable SLA or specific terms agreed with the Client.

10. Sub-processors

The Controller grants B2Brouter a general authorisation to engage sub-processors where necessary to provide the services, provided that those sub-processors are subject to data protection obligations substantially equivalent to those set out in this DPA.

The list of authorised sub-processors is included in Annex II --- Sub-processors or will be made available to the Client through a website, contractual notice, compliance documentation or any other reasonably accessible means.

B2Brouter will inform the Client of any significant addition or replacement of sub-processors with reasonable prior notice where such notification is required under applicable law.

The Client may reasonably object to the engagement of a new sub-processor where there are substantiated grounds relating to the protection of personal data. The objection must be made in writing within the period specified by B2Brouter or, if no period is specified, within ten (10) business days after the notification.

If the Client’s objection is reasonable and cannot be resolved through alternative measures, the Parties will negotiate a solution in good faith. If no solution can be reached, the Client may terminate the affected services, without prejudice to amounts accrued up to the effective termination date.

B2Brouter will remain responsible to the Client for compliance by its sub-processors with their data protection obligations, on the terms established in Article 28 of the GDPR.

11. B2Brouter / team.blue group companies

B2Brouter may engage companies belonging to its corporate group, including, where applicable, team.blue group companies or affiliates, to provide internal, technical, administrative, security, support, infrastructure, monitoring, corporate management or ancillary services necessary for the provision, maintenance, security or improvement of the contracted services.

Where those entities access or process personal data on behalf of B2Brouter in connection with the services provided to the Client, they will act as sub-processors and will be subject to data protection obligations substantially equivalent to those set out in this DPA, in accordance with Article 28 of the GDPR.

The specific group companies acting as sub-processors and the services they provide will be identified in the applicable list of sub-processors where required by data protection law.

B2Brouter’s membership of a corporate group does not, in itself, mean that all group companies have access to personal data processed on behalf of the Client.

12. International transfers

B2Brouter will not transfer personal data internationally outside the European Economic Area unless:

• an applicable adequacy decision is in place;
• appropriate safeguards have been adopted in accordance with the GDPR, including, where applicable, standard contractual clauses approved by the European Commission;
• a derogation under data protection law applies;
• there is a documented instruction from the Client; or
• there is an applicable legal obligation.

Where necessary, B2Brouter will adopt reasonable supplementary measures to ensure an adequate level of protection in accordance with applicable law.

13. Personal data breaches

B2Brouter will notify the Client without undue delay of any personal data breach of which it becomes aware and which affects personal data processed on behalf of the Client.

B2Brouter will endeavour to provide the initial notification within forty-eight (48) hours after becoming aware of the breach.

The notification will include, to the extent that the information is available:

• the nature of the personal data breach;
• the categories and approximate number of affected data subjects, where possible;
• the categories and approximate number of affected personal data records, where possible;
• the likely consequences of the personal data breach;
• the measures taken or proposed to remedy or mitigate its effects;
• the contact point from which further information can be obtained.

B2Brouter may provide this information in phases where all details are not available at the time of the initial notification.

The Client is responsible for determining whether the personal data breach must be notified to the supervisory authority or the data subjects, unless B2Brouter is legally required to make a direct notification.

Communications relating to personal data breaches will be made through the contact channels designated by the Parties. For these purposes, B2Brouter may use the contact email address provided by the Client in the agreement, on the platform or through official support channels.

The Client may contact B2Brouter regarding data protection matters or personal data breaches at ciso@b2brouter.net or dpo@b2brouter.net, or at any other address that B2Brouter communicates or publishes for that purpose.

14. Assistance to the Client and data subject rights

Taking into account the nature of the processing and the information available, B2Brouter will reasonably assist the Client in complying with its data protection obligations, particularly regarding:

• the handling of rights of access, rectification, erasure, objection, restriction, portability and rights relating to automated individual decision-making;
• security of processing;
• management of personal data breaches;
• data protection impact assessments;
• prior consultations with supervisory authorities, where applicable.

If B2Brouter directly receives a request from a data subject to exercise rights in relation to personal data processed on behalf of the Client, it will inform the Client, unless legally prohibited from doing so.

B2Brouter will not respond directly to the request unless instructed to do so by the Client or required by applicable law.

Where the requested assistance exceeds the ordinary support included in the contracted services, B2Brouter may charge the Client the reasonable costs arising from that assistance, after informing the Client.

15. Audits and verification of compliance

B2Brouter will make available to the Client the information reasonably necessary to demonstrate compliance with the obligations under Article 28 of the GDPR.

Where possible, verification will be carried out by providing security documentation, certifications, audit reports, compliance questionnaires, internal policies, reasonable evidence or equivalent documentation.

Any on-site, technical or documentary audit must:

• be requested at least thirty (30) days in advance;
• be limited to the scope strictly necessary to verify compliance with this DPA;
• be conducted during B2Brouter’s normal business hours;
• not materially interfere with the provision of the services;
• be subject to strict confidentiality obligations;
• not compromise the security, availability or integrity of B2Brouter’s systems, other clients or third parties.

Unless required by law or by a competent authority, or justified by a security incident, the Client may not conduct more than one audit per calendar year.

Audits may not involve access to source code, trade secrets, confidential information of other clients, third-party data, shared infrastructure, sensitive internal documentation, detailed security architectures or any information whose disclosure could compromise the security of B2Brouter, its clients or its providers.

Penetration tests, vulnerability scans, intrusive technical analyses or any testing of B2Brouter systems require B2Brouter’s prior written authorisation and acceptance of the applicable technical and security conditions.

Where an audit, review or verification request requires dedicated B2Brouter personnel, technical or legal assistance, additional meetings, preparation of ad hoc documentation, support during the audit, involvement of third parties or any other activity beyond making standard compliance documentation available, B2Brouter may charge the Client the reasonable costs arising from such assistance, after prior notice to the Client and, where applicable, acceptance of the corresponding quotation.

16. Return, deletion and retention

At the end of the services, B2Brouter will, at the Controller’s choice and unless retention is required by law, return, delete or make available to the Client the personal data processed on its behalf.

B2Brouter may retain personal data in duly restricted form where necessary to comply with legal, tax, accounting or regulatory obligations, or for the establishment, exercise or defence of legal claims. During that period, the data will not be used for purposes incompatible with the grounds justifying their retention.

Once the applicable statutory periods have expired, B2Brouter will permanently delete the personal data, unless another legal basis justifies their retention.

The return or export of data will be carried out in the formats, within the periods and under the conditions set out in the main agreement, on the platform or in applicable law. Commercial commitments relating to archiving, post-termination access and portability will, where applicable, be governed by a separate addendum to the main agreement.

17. Liability

Each Party is responsible for complying with the obligations applicable to it under data protection law.

The Client is responsible for the lawfulness of the processing, the accuracy of the data, the information provided to data subjects, the existence of a valid legal basis, the instructions given to B2Brouter and, where applicable, having sufficient authorisation to appoint B2Brouter as processor or sub-processor.

B2Brouter is responsible for complying with its obligations as processor or sub-processor on the terms set out in the GDPR, the main agreement and this DPA.

The Parties’ liability will be governed by the main agreement, without prejudice to any liability that cannot be limited under applicable law.

18. Updates, version control and sub-processors

B2Brouter may update this DPA, the TOMs and the list of sub-processors where necessary to reflect legal, technical, organisational, security, infrastructure, provider or service-related changes.

B2Brouter will inform the Client of material changes where required by applicable law or where those changes may materially affect the processing of personal data on behalf of the Client.

Updates will not materially reduce the level of protection, security or safeguards applicable to the processing of personal data.

19. Order of precedence

In the event of a conflict between this DPA and the main agreement on matters specifically relating to the processing of personal data on behalf of the Client, this DPA will prevail.

In the event of a conflict concerning the technical and organisational security measures applicable to the processing of personal data, the TOMs will prevail, unless the main agreement expressly establishes a more specific or restrictive obligation.

In all other matters, the main agreement will prevail, unless the Parties expressly agree otherwise in writing.

20. Term and acceptance

This DPA forms an integral part of the General Terms and Conditions, agreements, service orders, proposals or other contractual documents that expressly incorporate it or refer to it.

The DPA applies from the date on which the Client accepts the General Terms and Conditions or the contractual document incorporating it, or from the time B2Brouter begins processing personal data on behalf of the Client, whichever occurs first. No separate signature of this DPA is required.

B2Brouter will make the current version of the DPA available on its website, clearly identified by its version number and publication date. Updates will be governed by Article 18.

The DPA will remain in force for as long as B2Brouter processes personal data on behalf of the Client, whether acting as processor or sub-processor.

Obligations which, by their nature, are intended to survive the end of the contractual relationship, including confidentiality, security, return, deletion or restriction of data, cooperation on data protection matters and liability, will remain in force for the applicable statutory periods.

21. Governing law and jurisdiction

This DPA is governed by Spanish law and applicable European Union data protection legislation.

Any dispute arising from this DPA will be submitted to the jurisdiction specified in the main agreement, unless applicable law establishes another mandatory jurisdiction.

ANNEX I DETAILS OF THE PROCESSING

1. Controller

The Client or, in eDocSync white-label, resale, integration or intermediation scenarios, the third-party controller on whose behalf the Client acts.

2. Processor

B2Brouter Global, S.L., where it processes personal data on behalf of the Client acting as controller.

Where the Client acts as processor for a third-party controller, B2Brouter will act as sub-processor.

3. Subject matter of the processing

Provision of technological services for the issue, receipt, transformation, transmission, retention, tracking and management of electronic invoices, electronic documents, tax reports and related communications, as well as integration, support, maintenance, security, monitoring and associated functionalities.

4. Duration of the processing

The duration of the processing will coincide with the term of the main agreement and, where applicable, any additional periods required for the retention, restriction, return or deletion of the data in accordance with applicable law.

5. Nature of the processing

The processing may include, among other operations:

• access;
• recording;
• storage;
• structuring;
• retention;
• consultation;
• transmission;
• disclosure to recipients or authorities, where applicable;
• format conversion;
• technical validation;
• generation of evidence or records;
• support and incident resolution;
• monitoring and security;
• deletion, restriction or return.

6. Purpose of the processing

The purpose of the processing is to enable the provision of the services contracted by the Client, including the management of electronic invoices, electronic documents, tax reports, associated communications, technical integrations, support, security, traceability, retention and compliance with legal or regulatory obligations related to the services.

7. Categories of data subjects

The categories of data subjects whose personal data may be processed in connection with the services include, depending on the Client’s use of the platform:

• authorised users of the Client;
• employees, representatives, directors, contractors or contact persons of the Client;
• customers, suppliers, recipients or issuers of invoices, electronic documents or communications managed through the services;
• legal representatives, signatories, contact persons or other interlocutors included in invoices, electronic documents, tax reports or communications;
• third parties whose data may appear in documents, schedules, invoices, communications or files uploaded, transmitted or managed by the Client through the services;
• users, employees, representatives, customers, suppliers, recipients, invoice issuers, contact persons or third parties associated with the Client’s end customers, particularly where the services are provided as eDocSync white-label, resale, integration or intermediation services.

8. Categories of personal data

The categories of personal data may include, as applicable:

• identification data, including first name, surname, corporate name, NIF, NIE, VAT number, SIREN and equivalent tax identifiers;
• contact data, including postal address, email address, telephone number and contact person;
• professional data, including position, department, company, function or user role;
• financial, banking, tax, accounting or transactional data included in invoices, electronic documents, tax reports or related communications;
• platform access and usage data, including user identifiers, IP addresses, activity records, logs, timestamps and technical metadata;
• data included in invoices, schedules, documents, files or communications uploaded, generated, transmitted or managed by the Client;
• signature data, certificates, evidence, technical identifiers or metadata where necessary to provide the service.

The Client is not expected to enter special categories of personal data into the services. If the Client enters such categories of data, it is responsible for ensuring that a valid legal basis exists and for informing B2Brouter in advance where additional measures must be adopted.

9. Special processing activities

B2Brouter does not carry out, on behalf of the Controller, automated individual decision-making that produces legal effects or similarly significantly affects data subjects.

ANNEX II SUB-PROCESSORS

Tools used by B2Brouter for commercial management, CRM, quotation preparation, prospecting, corporate marketing or management of the contractual relationship with its own clients will not be considered sub-processors for the purposes of this DPA where they do not involve processing personal data on behalf of the Client in connection with the contracted services.

In such cases, B2Brouter will act as controller in respect of those data and the providers used for those purposes will, where applicable, act as processors for B2Brouter in accordance with applicable law.

The following list identifies the sub-processors that may be involved in providing the services where they have access to or process personal data on behalf of B2Brouter.

Corporate name	Country of establishment	Service provided	Location / processing
Hetzner Online GmbH	Germany	Infrastructure, hosting, servers, backups or associated technical services.	Germany / European Union.
Scaleway SAS	France	Contingency infrastructure, recovery, backups, DRP or associated technical services.	France / European Union.
Amazon Web Services EMEA SARL / AWS	Luxembourg	Storage, archiving, backups, cloud services or associated technical services, where applicable.	Germany and France / European Union
Team.blue NV	Belgium	Internal, technical, administrative, security, support, monitoring, corporate management or ancillary services necessary for the provision of the services.	Belgium / European Union

B2Brouter’s membership of a corporate group does not mean that all group companies have access to personal data processed on behalf of the Client. Only entities that actually process or may access personal data on behalf of B2Brouter in connection with the provision of the services will be considered sub-processors.

B2Brouter may update this list of sub-processors in accordance with this DPA.