1. Parties, scope and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Tatic ApS (CVR 42532940), Mejsevej 2, Hadbjerg, 8370 Hadsten, Denmark, operating open-banking.io under the secondary name OpenBanking IO ApS ("Processor", "we", "us"), and the business customer using the service ("Controller", "you").
It applies under Article 28 of the GDPR whenever you connect bank accounts whose statements or transactions contain personal data (such as counterparty names, IBANs, employee salaries or payment references). Questions: privacy@open-banking.io.
2. Nature, purpose and duration of processing
We process personal data solely to provide the open-banking.io service: retrieving account and transaction data via PSD2 APIs during syncs, encrypting sensitive banking payloads under your registered public key, storing the resulting records and structural sync metadata, and serving them back to you through the web application and API.
Processing continues for as long as your account remains active and ends when you remove an individual bank account or delete your user account.
3. Categories of data subjects and personal data
- Data subjects: account holders, counterparties, customers, suppliers and employees whose details appear in your connected bank accounts and transaction statements, as well as authorised users of your account.
- Personal data: account identifiers (IBAN, BBAN, account numbers), account holder and counterparty names, transaction amounts, descriptions and payment references (sealed under your public key once registered), together with structural metadata required for syncing, deduplication and PSD2 compliance (bank identifier, currency, booking/value dates, encrypted session/account UIDs, PSU IP address and User-Agent on attended syncs, and 90-day API and sync operational logs).
Bank login credentials are never collected, seen or stored by us.
4. Documented instructions and client-side encryption
We process personal data only on your documented instructions — namely your configuration and use of the service and API — unless required to do otherwise by EU or Danish law.
Once you register an ECDH P-256 public key, sensitive banking payloads retrieved via Enable Banking (account holder and counterparty names, IBAN/BBAN, transaction amounts, remittance descriptions and raw bank JSON) are sealed under your public key (ephemeral ECDH P-256 + HKDF-SHA256 + AES-256-GCM) so that we cannot decrypt those payloads at rest unless you explicitly enable temporary support debugging for a bounded window.
5. Confidentiality and security measures (GDPR Art. 32)
Anyone authorised by us to access infrastructure is bound by strict confidentiality obligations.
We implement technical and organisational measures appropriate to the risk:
- End-to-end envelope encryption under keys generated and held on your devices or systems
- TLS 1.2/1.3 encryption for all data in transit
- Hosting in ISO/IEC 27001:2022-certified EU data centers with strict Kubernetes network policies and least-privilege access
- European DDoS mitigation, Web Application Firewall (WAF) and rate limiting at the network edge
6. Authorised sub-processors
You grant general written authorisation for the following European sub-processors:
- Enable Banking Oy (Espoo, Finland) — PSD2 Account Information Service Provider (AISP) supervised by the Finnish Financial Supervisory Authority (FIN-FSA).
- Hetzner (Hetzner Online GmbH / Hetzner Finland Oy, Germany and Finland) — ISO/IEC 27001:2022-certified data center hosting and storage.
- Bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia) — DDoS protection, WAF, DNS and network edge on European infrastructure.
- Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing and invoicing.
We bind each sub-processor to data protection obligations no less protective than this DPA and remain liable for their performance. We notify you by email before adding or replacing a sub-processor so you may object by closing your account before the change takes effect.
7. EU data residency and international transfers
All bank and account data is stored and processed exclusively within the European Union and EEA (Germany, Finland and EU edge infrastructure). We do not transfer your bank data outside the EU/EEA.
8. Assistance, breach notification and audits
Because your banking data is accessible directly to you through the app and API, you can export or erase records at any time. Taking into account the nature of the processing, we assist you upon request to privacy@open-banking.io with data subject requests, security assessments and DPIA inquiries.
We notify you without undue delay — and within 48 hours of becoming aware — of any personal data breach affecting your account, providing the details required under GDPR Article 33.
We make available all information reasonably necessary to demonstrate compliance with GDPR Article 28 and allow audits or inspections upon reasonable prior written notice.
9. Deletion upon termination and governing law
Disconnecting a bank connection revokes the PSD2 session and stops new syncs while keeping your imported history available until you remove the account. When you remove an individual bank account or delete your user account, the account and transaction records are permanently deleted from active databases and aged out of database backups within 30 days (with only statutory billing and bookkeeping records retained under the Danish Bookkeeping Act and short-lived operational logs expiring within 90 days).
This DPA is governed by Danish law and subject to the jurisdiction of the Danish courts. Contact for all data protection matters: privacy@open-banking.io.