Data Processing Agreement

This Data Processing Agreement ("DPA") is between the business that uses the Malta Calculator payroll and payslip features (the "Customer") and Codevera Labs Ltd (registered in Malta, C 116774, 86, Triq il-Merkanti, Valletta VLT 1177, Malta) ("we", "us"). It forms part of our Terms of Service and applies automatically when you create a company account. It meets the requirements of Article 28 of the EU General Data Protection Regulation ("GDPR") and the Maltese Data Protection Act (Cap. 586).

For the personal data of your employees that you enter in the Service, you are the controller and we are your processor. For your own account data (sign-in, billing, support emails) we act as an independent controller under our Privacy Policy. The free public calculators do not process employee data on your behalf and are outside this DPA.

Subject matter

Hosting and processing of payroll data so that you can calculate salaries, issue payslips and prepare FS3, FS5 and FS7 returns.

Nature and purpose

Storage, calculation, display, PDF generation, archiving, delivery of payslips to your employees (secure link, PIN or employee app) and deletion.

Data subjects

Your employees and former employees, and the people you add as account users.

Categories of data

Name, address, email, phone, date of birth, ID card number, social security number, job title and department, salary, allowances, bonuses, overtime, tax and SSC deductions, payslip history and employee app device tokens. We do not ask for special category data; please do not enter health or other sensitive details in free-text fields.

Duration

For as long as your account exists, then until deletion as described in section 9.

• We process the data only on your documented instructions, which are this DPA, the Terms and the actions you take in the Service, unless EU or Maltese law requires otherwise; we will tell you if we believe an instruction breaks data protection law.
• We do not sell your data, use it for advertising or use it to train AI models.
• Everyone at Codevera Labs who can access the data is bound by confidentiality.
• We help you answer requests from your employees (access, rectification, erasure, portability), mainly through the export and edit tools in the Service, and help with data protection impact assessments and prior consultations where relevant.
• We make available the information needed to show compliance with Article 28 and allow audits by you or an auditor you appoint, with 30 days' notice, at most once a year unless there was a breach, and primarily by providing documentation and our sub-processors' certifications.

We apply the technical and organisational measures of Article 32 GDPR, including:

• TLS encryption in transit and AES-256 encryption at rest.
• Database row-level security; server-side checks that every request belongs to the signed-in company.
• Payslip links signed with secret tokens, optional employee PIN and Cloudflare Turnstile against automated guessing.
• Issued payslips are frozen with a SHA-256 fingerprint and cannot be altered, only voided with a reason, and are archived as PDFs.
• Access to production systems limited to authorised staff, with separate production credentials.
• Managed database backups, error monitoring and regular dependency updates.

If we become aware of a personal data breach affecting your data we will notify you without undue delay and in any case within 48 hours, by email to your account address. The notice will describe what happened, the data and employees likely affected, the likely consequences and the measures taken, so that you can meet your own 72-hour duty to notify the Information and Data Protection Commissioner (IDPC).

You give us general authorisation to use the sub-processors listed below. Each is bound by a written agreement with data protection terms at least as protective as this DPA, and we remain liable for their work. We will announce any new or replacement sub-processor on this page and by email at least 14 days before it starts processing your data. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate and receive a refund of any prepaid, unused period.

List last updated: November 8, 2026

• Supabase
  Supabase, Inc.

  Purpose

  Primary database (PostgreSQL) for companies, employees and payslips

  Data: All customer payroll data

  Location

  EU (Ireland, AWS eu-west-1)

  Transfer safeguard

  Data stored in the EU; SCCs for support access

• Vercel
  Vercel Inc.

  Purpose

  Application hosting, serverless functions and request logs

  Data: Data in transit while a request is processed; technical logs

  Location

  Global edge network, functions in the EU and USA

  Transfer safeguard

  EU–US Data Privacy Framework and SCCs

• Clerk
  Clerk, Inc.

  Purpose

  Sign-in and account management for account users

  Data: Account user name, email address, sign-in metadata

  Location

  USA

  Transfer safeguard

  EU–US Data Privacy Framework and SCCs

• Stripe
  Stripe Payments Europe, Ltd.

  Purpose

  Subscription billing, invoices and VAT calculation

  Data: Billing contact, company name and VAT number. No employee data

  Location

  EU (Ireland), with transfers to Stripe, Inc. (USA)

  Transfer safeguard

  EU–US Data Privacy Framework and SCCs

• Resend
  Plus Five Five, Inc. (Resend)

  Purpose

  Transactional email (billing, trial, account notices)

  Data: Account user email address and message content

  Location

  USA

  Transfer safeguard

  SCCs

• Cloudflare
  Cloudflare, Inc.

  Purpose

  R2 storage of the archived payslip PDFs, Browser Rendering to create those PDFs, Turnstile bot protection

  Data: Issued payslip PDFs; IP address for bot checks

  Location

  North America (R2 bucket), global network

  Transfer safeguard

  EU–US Data Privacy Framework and SCCs

• Amazon Web Services
  Amazon Web Services EMEA SARL

  Purpose

  Storage of company logos uploaded for payslips

  Data: Company logo image

  Location

  EU (Frankfurt, eu-central-1)

  Transfer safeguard

  Data stored in the EU

• PostHog
  PostHog, Inc.

  Purpose

  Product analytics and (with consent) masked session replays

  Data: Usage events and pseudonymous account id. Salary and name fields are masked

  Location

  EU (Frankfurt, PostHog EU Cloud)

  Transfer safeguard

  Data stored in the EU; SCCs

• Sentry
  Functional Software, Inc. (Sentry)

  Purpose

  Error monitoring

  Data: Technical error reports, which may include a request URL or account id

  Location

  EU (Germany, de.sentry.io)

  Transfer safeguard

  Data stored in the EU; SCCs

• Firebase Cloud Messaging
  Google Ireland Limited

  Purpose

  Push notifications to the Malta Calculator employee app

  Data: Device token and notification text (for example 'Your October payslip is ready')

  Only when you invite employees to the employee app

  Location

  EU and USA

  Transfer safeguard

  EU–US Data Privacy Framework and SCCs

• Anthropic
  Anthropic, PBC

  Purpose

  AI model behind the Malta Calculator AI assistant, the payroll assistant, AI payslip explanations, employee reply drafts and PDF employee import

  Data: The question asked and the figures needed to answer it, with employee names replaced by references (E1, E2) and ID/SSC numbers removed; payslip figures being explained. For PDF employee import only: the PDF you upload, including the employee details in it

  Only when you use an AI feature. PDF import sends a file only after you confirm it on screen

  Location

  USA

  Transfer safeguard

  SCCs; inputs are not used to train models

Your main database is hosted in the EU. Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified US companies) or on the European Commission's Standard Contractual Clauses, together with the supplementary measures listed in section 4.

• You have a lawful basis for the payroll data (usually Article 6(1)(b) and (c) GDPR: employment contract and legal obligation) and inform your employees as required by Articles 13 and 14.
• You keep payroll and tax records for as long as Maltese law requires from employers. Download them with Settings → Export data before you delete your account.
• You keep your sign-in details secure and only invite people who should see payroll data.

You can export your company data at any time (Settings → Export data): a ZIP with your company profile, employees and payslips as JSON and CSV, plus every archived payslip PDF.

When you delete your account (Settings → Delete account) we cancel your subscription immediately and lock the dashboard. You can undo the request for 30 days. During that time the payslip links you already sent keep working, so your employees can save their payslips. After that we permanently delete all of your data: company profile, employees, draft, issued and voided payslips, archived PDFs, logo, pending invitations and your sign-in account. We remove the Stripe customer record, while Stripe keeps invoices it must retain by law. Copies in rolling backups are overwritten within 30 days. We email you when deletion is complete.

We keep only what we are legally required to keep as a business ourselves: our invoices to you and related accounting records (for the periods required by Maltese tax and company law), which contain no employee data.

Liability under this DPA is subject to the limits in the Terms of Service, except where the GDPR does not allow a limit. If this DPA conflicts with the Terms, this DPA wins for matters of personal data. It is governed by the laws of Malta and the courts of Malta have jurisdiction. We may update this DPA to reflect changes in law or in our sub-processors; material changes will be emailed to you in advance.

You do not need to sign anything: this DPA is accepted when you create your account. If your auditor needs a countersigned copy, email [email protected] with your company name and registration number and we will send you a PDF. Data protection questions go to the same address; we reply within 2 business days (Monday to Friday, CET).