Data Processing Agreement

1. Parties, scope and precedence

This Data Processing Agreement (“DPA”) forms part of the agreement for Loomi services between TAXME LTD, a company incorporated in England and Wales (“Loomi”, “we” or “Processor”), and the business customer (“Customer” or “Controller”). Where the Customer acts as a processor for its own clients (for example an accountancy practice), the Customer confirms that it is authorised to appoint TAXME LTD as a further processor, references to the Controller’s instructions include the instructions the Customer passes on, and the Accountancy Practice Addendum also applies.

This DPA applies only when TAXME LTD processes personal data on behalf of the Customer in connection with Loomi (“Customer Personal Data”). It does not govern information for which TAXME LTD independently determines the purposes and means of processing, such as its own account, billing or certain professional engagement records. Such processing is addressed in our Privacy Policy and, where relevant, an accepted Filing Order and applicable professional-services records.

If this DPA conflicts with the main service terms on the protection of Customer Personal Data, this DPA prevails to the extent of that conflict. “Applicable Data Protection Law” means the UK GDPR and Data Protection Act 2018, and the EU GDPR where applicable, together with relevant amendments and implementing laws.

2. Description of processing and Customer responsibilities

The subject matter, duration, nature and purpose of processing, types of personal data and categories of individuals are described in Schedule 1. The Customer determines the lawful purposes of its processing, the personal data it submits, and the instructions it gives to TAXME LTD.

The Customer is responsible for providing appropriate privacy information to individuals, establishing a lawful basis where required, ensuring its instructions are lawful and avoiding unnecessary personal or sensitive information in uploads. TAXME LTD will assist as described in this DPA.

3. Documented instructions and confidentiality

TAXME LTD will process Customer Personal Data only on the Customer’s documented instructions, including instructions relating to international transfers, unless applicable law requires otherwise. In that case, TAXME LTD will notify the Customer before processing unless the law prohibits notification on important grounds of public interest.

The service agreement, product configuration, authorised uploads, customer actions and written support instructions constitute documented instructions to the extent consistent with this DPA. TAXME LTD will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

Personnel authorised to access Customer Personal Data will be subject to confidentiality obligations and access restrictions appropriate to their duties.

4. Security and compliance assistance

TAXME LTD will implement appropriate technical and organisational security measures in accordance with Article 32 of Applicable Data Protection Law, taking account of the risks to individuals, the nature of the data and the processing. TAXME LTD will maintain records of those measures and make appropriate information available to the Customer under section 9. The measures in place are summarised in Schedule 3.

Taking account of the nature of processing and the information available to it, TAXME LTD will reasonably assist the Customer with requests to exercise individual data protection rights, security obligations, personal data breach notifications, data protection impact assessments and prior consultation with regulators where required.

5. Subprocessors

The Customer grants TAXME LTD general written authorisation to use subprocessors to deliver Loomi services. TAXME LTD lists the authorised subprocessors and their functions in Schedule 2, and will notify the Customer of intended additions or replacements before they take effect, giving the Customer a reasonable opportunity to object on data protection grounds.

TAXME LTD will impose written data protection obligations on subprocessors that provide protection equivalent to this DPA as required by Article 28, and will remain responsible to the Customer for the performance of those obligations by subprocessors.

If the Customer reasonably objects to a proposed subprocessor, the parties will seek a practical alternative. If no reasonable alternative is available, the Customer may terminate the affected processing service in accordance with the service agreement before the change takes effect.

6. Personal data breaches

TAXME LTD will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will provide information reasonably available about the incident, the affected data and individuals, likely consequences and mitigation measures, and supplement the notification as information becomes available.

TAXME LTD will cooperate reasonably in investigating, containing and remediating the breach and in enabling the Customer to meet applicable notification obligations.

7. International transfers

TAXME LTD will make restricted international transfers of Customer Personal Data only in accordance with documented instructions and Applicable Data Protection Law. Where required, transfers will rely on an applicable adequacy arrangement, appropriate contractual safeguards (including relevant UK or EU transfer clauses) or another lawful mechanism.

TAXME LTD will ensure applicable onward-transfer obligations are addressed with subprocessors and provide reasonable information about relevant safeguards on request.

8. Return and deletion of Customer Personal Data

At the end of the processing services, TAXME LTD will, at the Customer’s choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires storage. TAXME LTD will provide a practicable method for the Customer to communicate its choice and obtain an export where return is selected.

Where immediate removal of copies from disaster-recovery backups is technically impracticable, TAXME LTD will isolate those copies from routine processing, protect them under this DPA and delete them through the established backup rotation process. If a backup is restored, TAXME LTD will reapply the Customer’s deletion instructions. This does not displace the Customer’s Article 28 right to deletion or return.

This section does not permit TAXME LTD to retain all customer transaction data merely because it has assisted with VAT filing. Any separate professional engagement records held by TAXME LTD as an independent controller must have their own lawful basis and retention justification. More restrictive third-party platform retention and deletion requirements remain applicable.

9. Audit and compliance information

TAXME LTD will make available information reasonably necessary to demonstrate compliance with its obligations under Article 28 and allow for, and contribute to, audits and inspections by the Customer or an auditor appointed by the Customer.

The parties will coordinate audits reasonably to protect security, confidentiality and other customers’ information, including by using relevant reports or independent assurance where appropriate. These arrangements do not remove statutory audit rights.

10. Term, changes and relationship with professional services

This DPA applies for as long as TAXME LTD processes Customer Personal Data under the service agreement, including the lawful return or deletion period. Changes to this DPA will follow the service agreement and applicable legal requirements; material reductions in data protection commitments will be notified as appropriate.

Use of Loomi does not itself appoint TAXME LTD as a VAT agent, fiscal representative or IOSS intermediary. Optional professional VAT preparation, submission or representation requires an accepted Filing Order and any legally required taxpayer or local-agent mandate. A local accountant or tax agent acting solely on TAXME LTD’s instructions as processor will be treated as a subprocessor where applicable; a professional independently determining its own purposes and means of processing may instead be a separate controller. Roles, disclosures and safeguards must be assessed for the actual engagement.

Schedule 1 — Processing description

Subject matter: Customer-uploaded or customer-authorised VAT and transaction information used within Loomi.

Duration: During the subscription/service term and the period needed for instructed export, return or deletion, subject to applicable law.

Nature and purpose: Receipt, hosting, organisation, deterministic rules-based transaction classification, VAT calculation, reconciliation, reporting, generation of draft VAT returns, customer-directed support VAT number validation through the EU VIES system, compliance deadlines, reminders and alerts, emails and single-use links sent on the Customer’s behalf to collect files or approvals from its own clients, the filing workflow with TAXME LTD’s tax team where a Filing Service is ordered, and export/deletion.

Individuals: Customer personnel, buyers, sole traders, supplier contacts and other persons whose details appear in uploaded records. Where the Customer is an accountancy practice, also its members and the contacts at its clients who receive emails or links from Loomi on its behalf.

Personal data: Business contact information, identifiers, VAT numbers, invoice and order references, transaction dates, amounts, locations and addresses where included in source records; related communications and audit trails. No special category data is required for the services, and the Customer should not upload it.

Instructions: Customer account settings, uploaded files, permitted integrations, written instructions and the applicable service agreement.

Loomi’s deterministic rules engine performs transaction classification and VAT calculations. AI is used only to reword alerts that Loomi’s deterministic checks have already raised; AI does not select VAT treatments or change the engine’s calculations. Any disclosure of Customer Personal Data to an AI service is subject to the instructions, subprocessor and transfer provisions of this DPA.

Schedule 2 — Subprocessors

TAXME LTD uses the following subprocessors for Loomi. Where a location is given, the data is hosted there; other providers may process data in the United States, under the safeguards in section 7.

Vercel: application hosting and processing (Frankfurt, Germany), and the AI gateway used to reach Anthropic.

Neon: application database (Frankfurt, Germany).

Google Cloud: file storage, data processing and scheduled jobs (Frankfurt, Germany).

Clerk: sign-in and user accounts.

Resend: sending emails, including emails sent on an accountancy practice’s behalf.

Vatstack: VAT number checks against the EU VIES system.

Sentry: error monitoring (EU region).

Slack: internal notifications to the Loomi tax team about filing requests (business name and return; no amounts).

Anthropic, through the Vercel AI Gateway: rewording alerts in plainer language (receives the alert text only).

Google Workspace: email correspondence with customers (hello@loomi.tax).

Schedule 3 — Security measures

The application, database and file storage are hosted in the European Union (Frankfurt, Germany).

Data is encrypted in transit and at rest by the hosting providers.

Each customer’s data is kept separate by account, and every request is checked against the accounts the signed-in user may access.

Sign-in is handled by a dedicated identity provider. Loomi tax team accounts must use two-step verification, re-verified every hour on the Filing desk.

File uploads use signed, short-lived links. Links sent to an accountancy practice’s clients are single-use and stored only as a cryptographic fingerprint.

Review decisions, approvals and filings are recorded with who acted and when.

Error monitoring excludes request bodies and cookies.