Merot e-Faktura API — Data Processing Agreement (DPA)
Version 1 — effective 1 October 2026
Between the Customer (controller; “Controller”) and МЕРОТ ДООЕЛ Скопје, EDB 4043022533490, address [TBD — Meriton Chutra] (processor; “Merot”), under the Terms of Service of the Merot e-Faktura API. Under the Law on Personal Data Protection (ЗЗЛП, Сл. весник 42/2020) the client is the controller and Merot the processor; a processor contract is mandatory. Where the Customer is a vendor acting for its clients, see section 12.
1. Subject, duration, nature and purpose (чл. 32)
| Item | Content |
|---|---|
| Subject | Processing of personal data contained in e-invoices and account data, to provide the Service |
| Duration | The term of the Terms of Service, plus section 9 (retention and return) |
| Nature | Receiving, validating, storing, transmitting to UJP (the tax authority’s e-Faktura system) and to the counterparty through UJP, signing coordination, status tracking, webhook delivery, archiving, export, backup |
| Purpose | Issuing, receiving, accepting/rejecting and legally archiving e-invoices for the Controller |
| Types of personal data | Names, addresses, tax numbers (EDB) and contact details of parties on invoices; line descriptions that may contain personal data; account users’ e-mail addresses; API/console audit records (IP address, user agent). Special categories and ЕМБГ are not intended; [TBD — confirm: ЕМБГ never required for any document type] |
| Categories of data subjects | Natural persons on invoices (buyers, sellers, sole traders, contact persons, representatives), the Controller’s staff and developers who use the console |
The list follows the mandatory content of a processor contract. The Controller determines what personal data it sends.
2. Instructions
Merot processes personal data only on the Controller’s documented instructions — these DPA, the Terms, and the Controller’s use of the API/console — including on transfers, unless the law requires otherwise. Merot tells the Controller if it believes an instruction is unlawful.
3. Confidentiality
Everyone at Merot with access is bound by confidentiality and acts only on instruction. Access is limited to staff who need it. Staff confidentiality wording: [TBD — lawyer].
4. Security of processing
Merot applies technical and organisational measures appropriate to the risk. Measures in place on the infrastructure, verified in the repo:
- Database Postgres 16 on RDS in eu-central-1: encrypted with KMS, not publicly accessible, point-in-time recovery 35 days, separate database roles (runtime role without RLS bypass).
- Object storage in eu-central-1/eu-west-1: SSE-KMS, versioning, Block Public Access, TLS-only bucket policy, S3 data-access logging into an EU-only CloudTrail (Object Lock 400 days).
- Archive bucket with Object Lock (WORM, 10-year default retention), replicated to eu-west-1.
- Host hardening: firewall, SSH allow-list, no password login, intrusion-prevention, audit logging, automatic security updates.
- Tenant isolation in the application and database (row-level security); API keys stored hashed.
Further measures described in the platform plan (field-level encryption, MFA, access logs) are not claimed here until implemented [TBD — Meriton Chutra: confirm before publication]. Merot also follows the АЗЛП security rulebooks (Сл. весник 122/2020) [TBD — lawyer: compliance statement].
5. Sub-processors
5.1 The Controller gives general written authorisation for the sub-processors in Annex A. Merot will inform the Controller of additions or replacements [TBD] days in advance and the Controller may object on reasonable grounds; if no solution is found either side may terminate the affected part of the Service. Merot imposes on each sub-processor obligations no less protective than this DPA and remains responsible for them.
5.2 Annex A lists only sub-processors verified in Merot’s infrastructure records. Anything not in Annex A is not authorised.
6. Data residency and transfers
Production data, backups, logs and archives for this Service are stored and processed in the EU: AWS eu-central-1 (Frankfurt) and eu-west-1 (Ireland). Merot does not transfer personal data of this Service to a third country [TBD — Meriton Chutra: confirm, including the payment processor and any support tooling]. The EU is treated as adequate; a transfer outside the EU would need adequacy or safeguards (ЗЗЛП чл. 48–52) and a new notice under section 5. [TBD — lawyer: article numbers 50 ff. and support/admin access from outside the EU.]
7. Assistance to the Controller
Merot helps the Controller, by appropriate measures, to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection — the Controller must answer within one month) and with its security, breach and impact-assessment duties. Requests received by Merot from a data subject are forwarded to the Controller. Erasure requests are subject to the legal-hold rule in section 9. Records of processing: Merot keeps a processor record. Contact of Merot’s data-protection officer: [TBD — Merot has decided to designate an internal DPO; person not yet named].
8. Personal data breach
Merot notifies the Controller without undue delay on becoming aware of a breach affecting the Controller’s data (the processor notifies the controller immediately; the controller notifies the authority, АЗЛП, within 72 hours). The notice contains the nature of the breach, categories and approximate number of data subjects and records, contact point, likely consequences and measures taken or proposed. Merot documents all breaches. A fixed maximum notice period in hours: [TBD — lawyer].
9. Retention, end of contract, return and deletion
9.1 Archived e-invoices outlive the contract. Under the draft e-invoicing law, issuers and recipients keep e-invoices for the periods of the Law on Tax Procedure (ЗДП) — read as 10 years — in original electronic form. The Service therefore stores the original JSON, signed JWS, PDF rendering and status trail of every sent and received document for 10 years in a WORM archive. That law is currently a draft, not adopted; the retention rule will be re-checked against the adopted text [TBD — lawyer].
9.2 On termination or expiry, Merot (a) stops processing for new documents, (b) keeps the archive of documents
already issued or received until their retainUntil date, as a legal-retention obligation of the Controller carried
out on its instruction, and (c) after the retention period deletes or returns the data at the Controller’s choice. Which party bears the cost of continued storage after termination, and the last date on which the
Controller may still order export: [TBD — Meriton Chutra / lawyer].
9.3 Data with no legal retention (for example console audit logs of departed staff, webhook delivery logs, account data) is deleted or returned within [TBD] days after termination. Backups roll off on their own schedule: database point-in-time recovery 35 days; nightly dumps expire after 100 days.
9.4 Erasure requests versus retention. Personal data inside archived tax documents cannot be erased before the retention period ends; the Controller (not Merot) decides the legal hold. Personal data without another legal basis is kept only until the purpose ends.
9.5 How export works. The Controller can, per company and environment, (a) fetch any document’s artefacts with
GET /v1/archive/einvoices/{id} (JSON, JWS, PDF, ASiC, each with sha256, size, retainUntil and a short-lived
download link), and (b) order a bulk export with POST /v1/archive/exports (filter by direction, dates, kinds),
poll GET /v1/archive/exports/{id}, and download a ZIP with manifest.json (per-file sha256, EUID, document number). Export before and after termination is available under 9.2.
10. Audits
Merot makes available the information needed to show compliance and allows and contributes to audits and inspections by the Controller or its auditor, on [TBD] days’ notice, at reasonable frequency, under confidentiality. Cost allocation and limits: [TBD — lawyer].
11. Liability
Governed by the Terms. Fines under ЗЗЛП for legal entities go up to 2 % of annual turnover; how the parties allocate liability between them: [TBD — lawyer].
12. Vendors
A vendor who integrates the Service for its own client companies is a processor for those clients; Merot is then the vendor’s sub-processor for the clients’ data, and the vendor must have a compliant contract with each client that passes through this DPA’s obligations. [TBD — lawyer: model clauses, and the case where a client contracts with Merot directly under the referral model.]
For Merot: ______________________ Meriton Chutra For the Controller: ______________________
Date / place: ______________________
Annex A — Authorised sub-processors (verified in infra records only)
| Sub-processor | Service | Location | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. [TBD — lawyer: contracting entity] | Compute (EC2), managed Postgres (RDS), object storage (S3), key management (KMS), e-mail sending (SES SMTP), backups | eu-central-1 (Frankfurt): production; eu-west-1 (Ireland): archive replica, backups, KMS replica key | All Service data; SES: recipient addresses and message content of Service e-mails |
Configured in the codebase but not verified as active for this Service, so not authorised until confirmed
[TBD — Meriton Chutra]: Sentry (error tracking; EU ingest *.ingest.de.sentry.io is the only host allowed), Grafana
Cloud EU (telemetry); Anthropic (optional, consent-gated AI in the ERP; not part of this API); Merot
Billing / payment processor for plan payments (pay.merot.com) — Controller’s billing contact data only [TBD — name the
processor]; Cloudflare (DNS only, no traffic) [TBD — lawyer: is it a processor]. The same list feeds the Terms.
Annex B — Sub-processor changes
Notice address: [TBD]. Objection period: [TBD] days.