Data Processing Agreement

Version 2.0 · Effective July 14, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between TaxDo Inc. (“TaxDo”, “Processor”) and the customer identified in that agreement (“Customer”, “Controller”) under which TaxDo provides the Services (the “Agreement”). It records how TaxDo processes Customer Personal Data on the Customer’s behalf.

Where the Agreement and this DPA conflict on the processing of Customer Personal Data, this DPA prevails. Where this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses prevail.

1. Definitions

1.1 “Data Protection Law” means all laws on the processing of personal data applicable to a party, including the EU General Data Protection Regulation (“GDPR”), the GDPR as incorporated into United Kingdom law (“UK GDPR”) together with the Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States federal and state privacy laws.

1.2 “Customer Personal Data” means personal data contained in data the Customer or its authorised users submit to the Services, and in results returned by the Services in response.

1.3 “Standard Contractual Clauses” or “SCCs” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.4 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0.

1.5 “Sub-processor” means a third party engaged by TaxDo to process Customer Personal Data.

1.5A “Certificate of Validation” means a record issued by TaxDo evidencing that an identifier or document was checked or verified through a Service at a point in time.

1.6 Terms including “controller”, “processor”, “data subject”, “processing” and “personal data breach” have the meanings given in Data Protection Law.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data and TaxDo is its processor. Where the Customer is itself a processor for a third-party controller, TaxDo is a sub-processor and this DPA applies as if references to the Customer were references to that controller, save that the Customer remains responsible to TaxDo under the Agreement.

2.2 TaxDo is a controller in its own right for the personal data described in the TaxDo Privacy Policy, including account administration, billing, support correspondence and website analytics. That processing is governed by the Privacy Policy and not by this DPA, save that clause 12 applies to transfers of that data.

2.3 Annex I sets out the subject matter, duration, nature and purpose of the processing, the categories of data subjects and personal data, and the retention applicable to each Service.

2.4 The Customer is responsible for the lawfulness of the data it submits, for having a lawful basis for the processing it instructs, and for providing any notice or obtaining any consent required from data subjects.

3. Processing instructions

3.1 TaxDo processes Customer Personal Data only on the Customer’s documented instructions, which comprise the Agreement, this DPA, and the Customer’s configuration and use of the Services, unless required to do otherwise by law to which TaxDo is subject. Where TaxDo is so required it will inform the Customer before processing, unless the law prohibits it on important grounds of public interest.

3.2 TaxDo will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. TaxDo is not obliged to carry out a legal review of the Customer’s instructions.

3.3 Except as clause 3.4 provides, TaxDo does not use Customer Personal Data for its own purposes. It does not sell or share Customer Personal Data, does not use it for advertising, marketing, profiling, credit assessment or any secondary purpose, and does not use it to train artificial intelligence or machine-learning models. TaxDo’s agreements with any AI model provider prohibit that provider from training on Customer Personal Data.

3.4 Aggregated data. TaxDo may create aggregated, de-identified and anonymised data from the processing and use it for its own business purposes, including operating, securing, improving and developing the Services. Such data does not identify the Customer, any authorised user or any natural person, and TaxDo will not attempt to re-identify it. Once it can no longer reasonably be used to identify a person it is no longer Customer Personal Data. This clause is a documented instruction of the Customer for the purposes of clause 3.1, and is consistent with the Agreement’s provisions on Aggregated Data.

3.5 Customer restrictions. The Customer will not submit to the Services any special category data within the meaning of Article 9 GDPR, or any data relating to criminal convictions and offences, other than as described in Annex I for the Service it has purchased.

3.6 Complete instructions. This DPA and the Agreement are the Customer’s complete and final instructions at the time of execution for the processing of Customer Personal Data. Any additional or alternative instruction must be agreed separately in writing, and TaxDo may charge a reasonable fee for assistance that goes beyond its obligations under this DPA or Data Protection Law.

3.7 United States state privacy laws. Where the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), or a comparable United States state privacy law, applies to Customer Personal Data: the Customer is the “business”; TaxDo is a “service provider” or, where that law so provides, a “processor”; Customer Personal Data is “personal information”; and a request under clause 7 is a “verifiable consumer request”. TaxDo:

will not sell or share Customer Personal Data;
will not retain, use or disclose Customer Personal Data outside the direct business relationship with the Customer, or for any purpose other than performing the Services and complying with law;
will not combine Customer Personal Data with personal information received from or on behalf of any other person, or collected from TaxDo’s own interaction with the individual, except as that law permits;
certifies that it understands the restrictions in this clause 3.7 and will comply with them;
will provide the same level of privacy protection as that law requires of the Customer;
will notify the Customer if it determines that it can no longer meet its obligations under that law; and
will, on notice from the Customer of any unauthorised use of Customer Personal Data, take reasonable and appropriate steps to stop and remediate it.

The Customer may take reasonable and appropriate steps to ensure that TaxDo uses Customer Personal Data consistently with that law.

3.8 Legal demands. Where TaxDo receives a demand from a governmental authority, court or law enforcement body for Customer Personal Data, TaxDo will inform the Customer of the demand unless prohibited from doing so by law, and will disclose only what the demand requires.

4. Confidentiality

4.1 TaxDo ensures that personnel authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality, are trained in their obligations, and are granted access on a least-privilege basis only where necessary to perform the Services.

5. Security

5.1 TaxDo implements and maintains the technical and organisational measures set out in Annex II, appropriate to the risk under Article 32 GDPR. TaxDo may update those measures provided the level of protection is not materially reduced.

6. Sub-processors

6.1 The Customer gives TaxDo general authorisation to engage Sub-processors. The Sub-processors engaged at the effective date are listed at taxdo.com/legal/subprocessors, which forms Annex III.

6.2 TaxDo will publish any intended addition or replacement of a Sub-processor at taxdo.com/legal/subprocessors at least thirty (30) days before the change takes effect, and will additionally notify by email each Customer that has subscribed to notifications at that page.

6.3 The Customer may object to a proposed Sub-processor on reasonable grounds relating to data protection by notice to TaxDo within that thirty-day period. If the Customer does not object within that period, the appointment of the Sub-processor is deemed accepted. The parties will discuss any objection in good faith. The Customer acknowledges that TaxDo’s Sub-processors are essential to providing the Services and that, if the Customer objects to TaxDo’s use of a Sub-processor, then notwithstanding anything to the contrary in the Agreement or this DPA, TaxDo is not obliged to provide the Customer the Services for which TaxDo uses that Sub-processor.

6.4 TaxDo imposes on each Sub-processor, by written contract, data protection obligations comparable to those in this DPA, and remains responsible to the Customer for each Sub-processor’s performance to the same extent as if TaxDo were performing those obligations directly.

7. Data subject requests

7.1 Taking into account the nature of the processing, TaxDo assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests to exercise data subject rights.

7.2 If TaxDo receives such a request directly from a data subject in relation to Customer Personal Data, it will not respond to it substantively but will refer the data subject to the Customer and inform the Customer without undue delay.

8. Personal data breach

8.1 TaxDo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and, where that data is subject to the GDPR or the UK GDPR, no later than seventy-two (72) hours after becoming aware of it.

8.2 The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where the information cannot be provided at once, it will be provided in phases without undue further delay.

8.3 TaxDo will assist the Customer in meeting its own notification obligations. Notification of a breach is not an acknowledgement of fault or liability.

9. Data protection impact assessments

9.1 TaxDo provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to TaxDo.

10. Deletion and return

10.1 TaxDo deletes Customer Personal Data on completion of the relevant processing in accordance with Annex I, and on the Customer’s written request.

10.2 On expiry or termination of the Agreement, TaxDo will, at the Customer’s choice, delete or return Customer Personal Data and delete existing copies, except to the extent that storage of that data or those copies is (a) required by TaxDo to exercise its rights or perform its obligations under the Agreement, (b) retained as the evidentiary record described in Annex I, for the period stated there, or (c) required or permitted by Data Protection Law for a longer period. Data in routine backups is deleted on the ordinary backup cycle and remains subject to this DPA until it is.

11. Audit

11.1 Following the Customer’s written request, TaxDo contributes to audits and inspections by making available the information necessary to demonstrate compliance with Article 28 GDPR, including current third-party audit reports and certifications where held.

11.2 Following that request, and no more frequently than once annually, TaxDo will promptly provide documentation or complete a written data security questionnaire of reasonable scope and duration regarding its processing of Customer Personal Data. All reports, documentation and questionnaire responses provided under this clause are TaxDo’s confidential information.

11.3 The Customer acknowledges and agrees that it exercises its audit and inspection rights under Clause 8.9 of the SCCs, and any equivalent right under Data Protection Law, by instructing TaxDo to comply with the audit measures described in this clause 11.

12. International transfers

12.1 TaxDo is established in the United States and processes Customer Personal Data there. The Customer authorises the transfer of Customer Personal Data to TaxDo and its Sub-processors on the terms of this clause.

12.2 EEA. The SCCs are incorporated into this DPA and apply to transfers of personal data subject to the GDPR. Module Two applies where the Customer is a controller and Module Three where the Customer is a processor. Module One applies to the limited business contact information concerning the Customer’s representatives that TaxDo processes as a controller. Clause 7 (docking) does not apply. Clause 9 Option 2 (general written authorisation) applies with the thirty-day notice period in clause 6.2. Clause 11(a) optional language does not apply. Clause 17 Option 1 applies, governed by the law of Ireland. Clause 18(b) designates the courts of Ireland. Annexes I, II and III to this DPA populate Annexes I, II and III to the SCCs.

12.3 United Kingdom. The UK Addendum is incorporated and applies to transfers subject to the UK GDPR. Tables 1 to 3 are completed by Annexes I to III of this DPA, and in Table 4 either party may end the Addendum as set out in Section 19 of the Mandatory Clauses.

12.4 Switzerland. The SCCs apply to transfers subject to Swiss law, amended so that references to the GDPR are to the Swiss Federal Act on Data Protection, the competent authority is the Federal Data Protection and Information Commissioner, and “member state” does not exclude data subjects in Switzerland from suing in their place of habitual residence.

13. Liability

13.1 Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party’s liability to a data subject under Data Protection Law.

13.2 Neither TaxDo nor its affiliates is liable for any claim brought by a data subject arising from or related to TaxDo’s acts or omissions, to the extent TaxDo was acting in accordance with the Customer’s instructions.

13.3 Any claim against TaxDo under or in connection with this DPA, including the SCCs, may be brought solely by the Customer entity that is a party to the Agreement. Nothing in this DPA limits either party’s liability in respect of an individual’s rights under Data Protection Law.

14. Term and precedence

14.1 This DPA takes effect on the effective date of the Agreement and continues until TaxDo has ceased all processing of Customer Personal Data. Clauses 4, 10, 11, 12 and 13 survive termination.

15. Governing law

15.1 This DPA is governed by the law stated in the Agreement, except where Data Protection Law or the SCCs require otherwise, in which case clause 12 prevails for the transfers it covers.

Annex I — Description of the processing

A. Parties

Data exporter: The Customer identified in the Agreement, acting as controller (Module Two) or as processor on behalf of its own controller (Module Three). Contact details are those stated in the Agreement.
Data importer: TaxDo Inc., 7901 4th St N, St. Petersburg, FL 33702, US. Contact: [email protected]. Acting as processor.

B. Description of processing, by Service

The categories below apply only to the Services the Customer has purchased. Where a Service is not purchased, no processing under that heading takes place.

B.1 Business tax identity validation — register lookups

Categories of data subjects: Businesses and other legal entities. Where a sole trader or single-member business is registered under an identifier that also identifies a natural person, that record is personal data and the individual is a data subject.
Categories of personal data: Registered legal and trading name; tax identification, VAT or company registration number; registered address; registration and validity status; registry metadata such as registration date and entity type.
Special categories: None.
Source: Published by the relevant tax authority or company register and publicly accessible from that source.
Nature and purpose: Validating a submitted identifier against official registers and returning the result to the Customer. No other purpose.
Frequency: Continuous, on submission by the Customer.
Retention: TaxDo issues a Certificate of Validation evidencing that an identifier was checked against an official register at a point in time. TaxDo retains the submitted identifier, the validation result, the timestamp and the source consulted as the evidentiary record supporting that certificate, so that the validation can be substantiated if it is later examined in a tax audit, assessment or other proceeding. That record is retained for seven (7) years from the date of validation, consistent with tax record-keeping and audit periods. Identifiers in the record are stored tokenised, with the mapping held separately, and the record is encrypted at rest. The Customer may configure a shorter retention period or a deletion schedule, including deletion on request and a mode in which no identifier is retained, as agreed with TaxDo in the Order Form or in this DPA and activated by TaxDo. The Customer acknowledges that once a record is deleted, TaxDo can no longer substantiate the corresponding certificate and no further support for that validation will be available. Query logs are retained only as long as needed for security and billing.

B.2 US taxpayer identification validation

Categories of data subjects: Taxpayers identified in the Customer’s query, including individuals and sole proprietors.
Categories of personal data: A name and a taxpayer identification number. Where the taxpayer is an individual or sole proprietor, that number may be a Social Security number.
Special categories: A Social Security number is sensitive personal information under United States state privacy law. It is used only to perform the validation, is encrypted in transit and at rest, is accessible only to the personnel who deliver the Service, and each access is recorded.
Nature and purpose: Confirming whether a name and taxpayer identification number combination matches the records held by the relevant United States authority, and returning a match or no-match result to the Customer, in support of the Customer’s tax information reporting obligations.
Disclosure: Data submitted to or returned by this Service is not disclosed to any artificial intelligence provider, and is not disclosed to any other third party except the Sub-processors identified in Annex III on whose infrastructure the Services operate, or where disclosure is compelled by law.
Frequency: Continuous, on submission by the Customer.
Retention: TaxDo issues a Certificate of Validation evidencing that a name and taxpayer identification number combination was checked against the records held by the relevant United States authority at a point in time. TaxDo retains the submitted name and identifier, the match or no-match result and the timestamp as the evidentiary record supporting that certificate, so that the validation can be substantiated if it is later examined in a tax audit, assessment or other proceeding. That record is retained for seven (7) years from the date of validation, consistent with tax record-keeping and audit periods. Identifiers in the record are stored tokenised, with the mapping held separately and subject to the access controls described above, and the record is encrypted at rest. The Customer may configure a shorter retention period or a deletion schedule, as described in B.1. The Customer acknowledges that once a record is deleted, TaxDo can no longer substantiate the corresponding certificate and no further support for that validation will be available.

B.3 Tax document verification (optional Service)

Availability: Off unless the Customer enables it under the Agreement.
Categories of data subjects: The businesses and, where a document concerns one, the individuals identified in the document the Customer submits.
Categories of personal data: The contents of the submitted document, which may include a name, an address, and a business or individual taxpayer identification number, together with the other fields the document carries.
Special categories: Where the document carries an individual’s taxpayer identification number, the safeguards in B.2 apply to it. This Service performs no facial recognition and no other biometric comparison.
Source: The document the Customer supplies. Information returned by the Service described in B.2 is never used in this Service.
Nature and purpose: Extracting and verifying the information a submitted tax document contains, and returning the result to the Customer. This Service uses an AI Feature; the model is operated by an established United States provider under written terms that prohibit training on the data.
Automated decisions: The result is one input into the Customer’s process and is not a determination. The Customer applies human review before relying on it.
Frequency: Continuous, on submission by the Customer.
Retention: TaxDo retains an evidentiary record supporting the verification, consisting of the identifiers extracted from the submitted document, the verification result, the timestamp and a cryptographic hash of the document, so that the verification can be substantiated if it is later examined in a tax audit, assessment or other proceeding. That record is retained for seven (7) years from the date of verification, consistent with tax record-keeping and audit periods. The submitted document itself is retained for the same period where the Customer requires it to support an assessment or report, and is otherwise deleted once the result has been returned. Identifiers in the record are stored tokenised, with the mapping held separately and subject to the safeguards in B.2, and the record is encrypted at rest. The Customer may configure a shorter retention period or a deletion schedule, as described in B.1. The Customer acknowledges that once a record is deleted, TaxDo can no longer substantiate the corresponding verification and no further support for it will be available.

B.4 Other Services

Scope: Where the Customer purchases a further Service, the categories of data subjects and personal data, the nature and purpose of the processing and the retention applicable to it are as stated in the Service documentation and agreed at the time of purchase, and are incorporated into this Annex.

C. Competent supervisory authority

Where Module Two applies, the supervisory authority of the member state in which the data exporter is established, or where the data exporter is not established in the EEA, the supervisory authority of the member state in which its Article 27 representative is established, or in which the data subjects are located. Where the UK Addendum applies, the Information Commissioner. Where Swiss law applies, the Federal Data Protection and Information Commissioner.

Annex II — Technical and organisational measures

TaxDo maintains the following measures, appropriate to the risk. TaxDo may update them provided the level of protection is not materially reduced.

Encryption: Customer Personal Data is encrypted in transit using current TLS, and at rest.
Access control: Access is granted on a least-privilege basis, is authenticated, is reviewed periodically, and is revoked on role change or departure. Administrative access requires multi-factor authentication.
Access logging: Access to data submitted to the Services is recorded, and the records are retained and reviewable.
Segregation: Customer Personal Data is logically separated from TaxDo’s own controller data and from other customers’ data.
Pseudonymisation: Where a purpose can be achieved without identifying data, TaxDo uses aggregated or de-identified data. Tax identifiers held in validation records are stored tokenised, with the mapping held separately from those records and subject to separate access controls.
Resilience: Systems are designed for availability and are monitored. Backups are taken on a routine cycle and restoration is tested.
Vulnerability management: Secure development practices, dependency monitoring, patching, and periodic security testing.
Incident response: A documented procedure covering detection, triage, containment, notification and post-incident review.
Personnel: Confidentiality obligations, background screening where lawful, and data protection training.
Vendor management: Due diligence before engagement, written data protection terms, and periodic review.
Physical security: Processing takes place in facilities operated by the hosting providers listed in Annex III, which maintain physical access controls and environmental protections.

Annex III — Sub-processors

The Sub-processors authorised at the effective date are those listed at taxdo.com/legal/subprocessors, which is incorporated into this Annex and updated in accordance with clause 6.

The Customer may subscribe to notice of changes by emailing [email protected]. TaxDo gives at least thirty (30) days’ notice of any intended addition or replacement, and the Customer may object in accordance with clause 6.3.

Signature is not required where this DPA is incorporated by reference into the Agreement. Where the Customer requires a signed counterpart, contact [email protected].