Data Processing Agreement

Tallio is a service of Hypermetron, GEMI number Missing: [GEMI number], VAT number Missing: [VAT number], registered at Arnis 12, 115 28 Athens, Greece. Email: info@tallio.dev. Website: hypermetron.com.

This agreement is between Hypermetron (“Tallio”, the processor) and each vendor that uses the Tallio API or dashboard, and each merchant that uses the Tallio Shopify app (the “customer”, the controller). It forms part of the Terms of Service and follows Article 28 of the General Data Protection Regulation (GDPR).

Where the customer itself processes the data for its merchants, the customer is their processor and Tallio is its sub-processor; this agreement then applies between Tallio and the customer in the same way.

This agreement and our other legal texts are written in English. If a translation is ever published, the English text prevails.

• The customer is the controller of the personal data in the documents it sends. Tallio processes it only on the customer’s documented instructions, which are the API calls the customer makes, its settings, and this agreement.
• Purpose: issuing and tracking e-invoicing documents (invoices, receipts, credit notes, delivery notes) through the licensed provider the merchant chooses, and returning the result: the registration number, QR code, PDF link and status.
• Personal data: a buyer’s name, tax id, address, email and phone as they appear on a document; the order lines and totals; the merchant’s own details and staff contacts; and the merchant’s provider credentials, which are encrypted and never returned.
• Data subjects: the merchant’s customers and the merchant’s own staff contacts.
• Processing: receiving, checking, storing, translating and sending documents to the provider, receiving the provider’s results, logging requests for debugging, and deleting data on schedule.
• Duration: for as long as the customer uses Tallio, then until the deletion described under retention and deletion.

• Process personal data only for the purpose above. No selling, profiling, marketing or advertising use.
• Keep it confidential. Only the people who operate Tallio can access it, only to run or support the service, and they are bound to confidentiality.
• Protect it with the security measures below and on our security page.
• Engage sub-processors only as the sub-processors section allows.
• Help the customer answer data-subject requests (access, rectification, erasure, restriction, portability and objection), and act on Shopify’s customer erasure and shop erasure webhooks.
• Notify the customer without undue delay, and within 72 hours at most, after becoming aware of a personal data breach affecting its data, with what happened, the data concerned, what we did and what the customer should do.
• Help the customer with its security, breach-notification and data-protection impact assessment duties, as far as Tallio’s processing is concerned.
• Make available the information needed to show compliance with this agreement, and allow and contribute to audits by the customer or an auditor it appoints, on reasonable notice.
• Tell the customer if, in our opinion, an instruction breaks data protection law.

• TLS for data in transit, and encryption at rest by the database host.
• Provider credentials sealed with AES-256-GCM under a data key per vendor, itself wrapped by a Google Cloud KMS key in Frankfurt; no key held by the application opens every vendor’s credentials.
• Logged request, response and webhook bodies encrypted, with credentials stripped before they are stored; secrets and personal data redacted from application logs.
• API keys stored only as a hash; dashboard access by role, with a fresh sign-in required for sensitive actions such as creating a live key.
• Every vendor’s data separated in the database by its vendor id on every query.

The customer authorises the sub-processors listed in the table at the end of this page, which also names the recipients the merchant chooses (its provider and, for the Shopify app, Shopify). Tallio binds each sub-processor to data protection terms no weaker than this agreement and remains responsible for it.

Tallio’s sub-processors process the customer’s data in the EU; a recipient the merchant chooses does so under its own terms. We tell customers by email at least 30 days before we add or replace a sub-processor. A customer may object on reasonable data protection grounds; if we cannot address the objection, the customer may end its use of Tallio.

• Personal data in operational logs (request, provider call and webhook bodies) is removed after 90 days.
• A document’s full content, with its parties, is removed 90 days after the document is settled; its metadata (type, status, number, registration number and totals) stays for the customer’s records.
• Provider credentials are deleted 30 days after the connection is disconnected.
• At the customer’s request, a customer’s or a whole merchant’s personal data is erased earlier, and everything is deleted at the end of the service, unless the law requires us to keep it.
• Tallio keeps no fiscal archive. The provider remains the legal archive of every issued document.

• Have a lawful basis for the personal data it sends, and give its data subjects the information the law requires.
• Send only the personal data a document needs, and no special categories of personal data.
• Give instructions that comply with data protection law.

Data protection contact: info@tallio.dev.