Tax and Duty Payment Data Processing Addendum

Version: Version 1.0
Published: 19 August 2026
Effective date: The date on which the Customer accepts this DPA during onboarding for Tax and Duty Payment

This Data Processing Addendum (the DPA) governs the processing of personal data by ByLogic OÜ in connection with the Tax and Duty Payment software-as-a-service product.

How this DPA is entered into

The Customer enters into this DPA by ticking the acceptance checkbox during onboarding for Tax and Duty Payment. The electronic acceptance record identifies the Customer, the person accepting on its behalf, the date and time of acceptance, and the version of this DPA accepted. The person accepting confirms that they have authority to bind the Customer.

This DPA forms part of the Tax and Duty Payment Subscription Terms accepted through the same onboarding process (the Subscription Terms). It applies whenever ByLogic OÜ processes personal data on the Customer's behalf in providing Tax and Duty Payment. No signature is required. The acceptance record, the Subscription Terms, and this DPA constitute the documented agreement between the parties for this processing. If this DPA conflicts with the Subscription Terms on the processing of personal data, this DPA prevails to the extent of that conflict.

The Provider is ByLogic OÜ, an Estonian private limited company, registry code 16567996, registered at Tartu mnt 67/1-13b, Tallinn 10115, Estonia; notice email: info@bylogic.io. The Customer is the legal entity identified in the acceptance record. The Provider and the Customer are each a Party and together the Parties.

The liability limitations in the Subscription Terms, including the aggregate cap of fees actually paid for Tax and Duty Payment during the six months before the first event giving rise to liability, apply to this DPA to the maximum extent permitted by law. They do not limit liability that cannot lawfully be limited.

D1. Roles and applicable law

For personal data processed to provide Tax and Duty Payment under the Customer's documented instructions, the Customer is the controller and the Provider is the processor. Where the Customer is itself a processor, the Provider is its subprocessor.

Each Party is an independent controller for business-contact, contract-administration, billing, fraud-prevention, security, and legal-compliance data for which it determines the purposes and means of processing. The hosted payment provider is an independent controller for payment-card and related payment data collected on its hosted payment page; that data is not processed by the Provider as processor under this DPA.

Data Protection Laws means the EU General Data Protection Regulation 2016/679 (EU GDPR), the Estonian Personal Data Protection Act, the UK GDPR, the UK Data Protection Act 2018, and any other data-protection law applicable to the relevant processing. Terms including controller, processor, personal data, data subject, processing, and personal data breach have the meanings given to them by applicable Data Protection Laws.

D2. Instructions and compliance

The Provider will process personal data only on the Customer's documented instructions, unless applicable law requires otherwise. The documented instructions comprise:

• the Subscription Terms and this DPA as identified in the acceptance record;
• the Customer's configuration and authorised use of Tax and Duty Payment; and
• lawful written directions submitted by an authorised Customer contact and accepted by the Provider, including directions relating to international transfers.

Where the law permits, the Provider will inform the Customer before carrying out processing required by law. The Provider will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Data Protection Laws and may suspend the affected instruction while the Parties address it.

The Customer is responsible for the legality of its instructions and processing, including providing required transparency information, establishing lawful bases, limiting submitted data to what is necessary, maintaining data accuracy, and meeting its obligations as controller or processor. The Customer warrants that it has the rights and authorisations needed to submit personal data to Tax and Duty Payment and instruct the Provider to process it.

The Provider will not sell Customer personal data, use it for advertising, or use it to train publicly available artificial-intelligence models. The Provider may use information that has been aggregated and irreversibly anonymised so that it is no longer personal data for analytics, security, and product improvement.

D3. Confidentiality and security

The Provider will ensure that each person authorised to process Customer personal data is bound by an appropriate duty of confidentiality and has access only to the extent necessary for their role.

Taking account of the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and the risks to data subjects, the Provider will maintain appropriate technical and organisational measures designed to protect Customer personal data. The baseline measures are set out in Schedule 2. The Provider may update those measures to reflect changes in technology, risk, and the service, provided that the update does not materially reduce the overall level of protection.

D4. Subprocessors

The Customer gives the Provider general written authorisation to appoint subprocessors necessary to provide, support, secure, and maintain Tax and Duty Payment.

The Provider publishes and maintains the current subprocessor list in Schedule 3 of this DPA, which identifies each subprocessor, its processing purpose, and its processing location. Each change to the list is published as a new version of this DPA at its own stable address.

The Provider will give the Customer at least 10 calendar days' notice before a new subprocessor begins processing Customer personal data, where reasonably practicable. Notice may be given through the service, by email to the Customer's recorded notice contact, or through a subscription mechanism associated with the published list.

The Customer may object within that notice period on reasonable, documented data-protection grounds. The Parties will work in good faith to identify a practical alternative. If no reasonable alternative is available, the Provider may discontinue the affected feature, or the Customer may terminate only the affected Tax and Duty Payment service, without affecting fees due for processing already performed.

The Provider will impose on each subprocessor data-protection obligations that are materially equivalent to the obligations applicable to the Provider under this DPA, to the extent relevant to that subprocessor's services. The Provider remains responsible to the Customer for its subprocessors as required by Data Protection Laws.

A third party does not become a subprocessor merely because it acts as an independent controller. In particular, the payment provider collects and processes payment-card data on its own hosted page as an independent controller. The Provider does not receive or store card numbers, card security codes, or other full payment-card data.

D5. Assistance and data-subject requests

Taking account of the nature of the processing and the information available to it, the Provider will provide reasonable assistance to the Customer with:

• responding to requests by data subjects to exercise their rights;
• security-of-processing obligations;
• personal-data-breach notifications and communications;
• data-protection impact assessments; and
• prior consultations with supervisory authorities.

If the Provider receives a request from a data subject relating to Customer-controlled personal data, it will notify the Customer where legally permitted and will not respond substantively unless the Customer authorises it or applicable law requires it. The Provider may direct the data subject to the Customer.

Assistance available through standard Tax and Duty Payment functionality is included in the service. Additional bespoke assistance may be charged at the Provider's then-current rates where permitted by Data Protection Laws, unless the assistance is required because of the Provider's breach of this DPA.

D6. Personal data breaches

The Provider will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer personal data.

As information becomes available, the Provider's notice will describe:

• the nature of the breach, including affected categories of data subjects and personal data where known;
• the likely consequences;
• measures taken or proposed to contain, investigate, mitigate, and remediate the breach; and
• a contact point for further information.

The Provider may provide information in phases where it is not available at the same time. Notification is not an admission of fault or liability. The Customer controls notifications to supervisory authorities and data subjects for which it is responsible. The Parties will cooperate on those notifications and coordinate any public statements where lawful.

D7. Audit information

The Provider will make available information reasonably necessary to demonstrate compliance with this DPA and applicable processor obligations.

The Customer must first use current security materials, completed questionnaires, certifications, or independent audit reports that the Provider makes available. A further audit is permitted only where reasonably necessary to verify compliance, normally no more than once in any 12-month period, and subject to:

• at least 20 business days' prior written notice;
• conduct during normal business hours;
• reasonable scope, duration, confidentiality, and security controls;
• no access to another customer's data or systems; and
• no disproportionate disruption to the Provider's business or services.

The Customer bears its audit costs and the Provider's reasonable costs of supporting the audit, unless the audit establishes a material breach of this DPA by the Provider. These restrictions do not limit the statutory powers of a competent supervisory authority.

D8. International transfers

Neither Party will make a restricted transfer of personal data unless the transfer is covered by an applicable adequacy decision or another lawful transfer mechanism under Data Protection Laws.

Where required for a restricted transfer from the European Economic Area, the applicable modules of the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914 (EU SCCs) are incorporated into this DPA by reference:

• Module Two applies to a controller-to-processor transfer; and
• Module Three applies to a processor-to-processor transfer.

For those EU SCCs:

• Clause 7 (the docking clause) applies;
• Option 2 of Clause 9 applies, with the notice period stated in D4;
• the optional language in Clause 11 does not apply;
• the governing law under Clause 17 is the law of Estonia;
• the courts under Clause 18 are the courts of Estonia; and
• the acceptance record identifies the data exporter and data importer, while Schedules 1 and 2 supply the processing description and technical and organisational measures for the relevant transfer.

Where a restricted transfer from the United Kingdom relies on the EU SCCs, the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (UK Addendum/IDTA) is incorporated into this DPA. It is completed using the Parties and their roles identified in the acceptance record and D1, the relevant EU SCC module selected above, the processing details in Schedule 1, and the security measures in Schedule 2. If the applicable UK transfer mechanism requires a standalone International Data Transfer Agreement rather than the UK Addendum, the Parties will use the then-current ICO form populated with the same information.

Each Party will provide reasonable information needed for transfer-risk assessments and will implement supplementary measures where required by Data Protection Laws.

D9. Return and deletion

After the Customer's access to Tax and Duty Payment ends, the Customer may request a standard export of Customer personal data within 30 days. The Customer must communicate its choice to return or delete the data before that export period expires. If the Customer does not request an export, the Provider may proceed with deletion after the export period.

Subject to legal retention requirements and normal backup cycles, the Provider will delete working copies within 30 days after the export period ends and backup copies within 90 days after that period ends. Security and operational logs may be retained for up to 12 months where necessary for security, fraud prevention, service integrity, or legal compliance.

Where applicable law requires retention, the Provider will continue to protect the retained personal data, isolate it from ordinary use where reasonably practicable, and process it only for the legally required purpose. On the Customer's written request, the Provider will confirm completion of deletion, except for data retained under this paragraph or data that cannot reasonably be isolated from protected backup media before the ordinary backup cycle expires.

Schedule 1 — Processing details

Schedule 2 — Baseline security measures

The Provider maintains the following baseline technical and organisational measures, applied according to risk and to the components of Tax and Duty Payment under the Provider's control:

• documented access-control procedures, least-privilege access, role-appropriate authorisation, periodic access review, and prompt access removal when no longer required;
• confidentiality obligations and proportionate security awareness for personnel authorised to access Customer personal data;
• authentication controls appropriate to the relevant system, with multi-factor authentication for privileged access where supported;
• encryption in transit using current secure protocols and encryption at rest where supported and proportionate to the risk;
• secure handling of API keys, tokens, and other credentials, including keeping secrets out of acceptance records, contracts, and ordinary source files;
• logging and monitoring proportionate to the service and risks, with access to logs restricted to authorised personnel;
• reasonable vulnerability, patch, and dependency management for Provider-controlled systems and software components;
• backup and recovery arrangements for service components where backup is provided, with restoration procedures tested proportionately;
• documented processes for incident identification, containment, investigation, remediation, recovery, and notification;
• data minimisation, separation of production and non-production environments where appropriate, and secure deletion or disposal procedures;
• risk-based supplier assessment and contractual data-protection and security controls for subprocessors; and
• periodic review and improvement of measures based on risk, technological change, and the nature of Tax and Duty Payment.

No technical or organisational measure provides absolute protection. Any Customer-specific security requirement, hosting region, certification, recovery objective, or other control applies only if expressly shown to and accepted by the Customer during onboarding and captured in the acceptance record or otherwise agreed in a lawful written instruction accepted by the Provider.

Schedule 3 — Current subprocessors

The payment provider Stripe is not a subprocessor under this DPA. It collects payment-card data on its own hosted payment page as an independent controller, as stated in D1 and D4.

Transfers to the subprocessors above rely on the transfer mechanisms in D8.

Notices and governing language

Notices concerning this DPA must be sent to the notice contacts recorded for each Party. Notices to the Provider must be sent to info@bylogic.io. The Provider may send notices to the Customer's onboarding or account notice email. Email notices are received on the next business day after sending unless the sender receives a delivery-failure message.

This DPA is governed by Estonian law. The Parties will first attempt in good faith to resolve a dispute for 30 days after written notice. The courts of Harju County, Estonia have exclusive jurisdiction, except that the Provider may seek urgent protective relief in any competent court. These provisions are subject to the mandatory rights of data subjects and supervisory authorities and the transfer terms in D8. This DPA is written and controlled in English.

Related documents

• Subscription Terms
• Privacy Policy
• Data Processing Addendum