Who is responsible
- Lab0 — [legal entity name], [registered address], [registration number] ("Lab0", "we") — develops and maintains the App and publishes it on Microsoft AppSource. Lab0 does not operate any server in the document flow.
- The Customer is the controller of all business data in its Business Central environment, including everything the App reads, stores and transmits.
- TCA (Tax Compliance Agent) — [legal entity name, address] — operates the Peppol Access Point the App connects to and the connection to the UAE Federal Tax Authority. TCA processes the documents the Customer submits under the Customer's separate agreement with TCA and TCA's own privacy terms.
- Microsoft hosts Business Central and processes data under the Customer's Microsoft agreement.
What the App processes
The App runs entirely inside Business Central. It reads, stores and transmits the following categories of data. All of it is classified as Customer Content in the App's data classification, except the user identity noted in 2.6.
Invoice and credit-note content (outbound and inbound)
Document number, dates, currency, totals, VAT breakdown; line items with descriptions, quantities, prices, discounts, charges, VAT category and, where applicable, HS or SAC commodity codes; payment means and account details; credit reasons and references to the corrected invoice; delivery address for exports and e-commerce; transaction type flags required by the UAE specification.
Party identifiers
For the Customer, its customers and its suppliers: legal name, address, emirate, country, FTA Tax Identification Number (the Peppol endpoint), VAT registration number, legal registration identifier and type (trade licence, Emirates ID, passport number or Cabinet Decision reference) and issuing authority. Where a party is an individual, this can include a passport number and country of issue, which the UAE specification requires.
Configuration
The TCA environment and API client ID, seller identity, document defaults, VAT category classifications, retention settings, and the record that an administrator accepted these terms (see 2.6).
Credentials
The TCA client secret. It is stored only in Business Central Isolated Storage, scoped to the company, encrypted by the platform. It is never written to a table, a log, telemetry, or the API; it is never shown again after entry; it is only used to obtain access tokens from TCA. Access tokens are held in memory for the duration of a call and are never stored or logged.
Status and diagnostic data
For each submitted document: TCA's identifier, lifecycle state, delivery and FTA status codes, error text returned by TCA, timestamps. A diagnostic log of every call the App makes to TCA holds the operation, HTTP method, URL, status code, duration, document number and an excerpt of the response. Full request and response bodies are stored only if the administrator switches on “Store Diagnostic Payload Bodies”, which is off by default and intended for temporary investigation.
User identity
The Business Central user ID of the administrator who accepted the license terms, and of the person who approved, rejected or converted a received document, with the time. These are the only fields classified as end-user identifiable information.
Received documents
The signed XML exactly as delivered by the supplier's Access Point, plus the parsed content above. The XML is the legal record of what was received.
Where data goes
The App sends data to exactly two destinations outside your Business Central tenant, both over HTTPS only:
| Destination | What is sent | Why |
|---|---|---|
| The TCA Access Point API Sandbox API host | The document's name, invoice number, issue date, document type and storage path; credential exchange for access tokens; status and received-document queries. | Filing and delivery of e-invoices, and receipt of documents addressed to you. |
| TCA document storage on Amazon Web Services S3 | The PINT AE XML of a document being sent; download of a received document's XML. | TCA stores documents there; the App uploads and downloads directly using single-use URLs that expire, without an authorisation header. |
The App refuses any storage URL that is not HTTPS on an amazonaws.com host, and any API URL outside the configured TCA environment. A production Business Central environment can connect only to TCA's production environment.
No data is sent to Lab0, except the telemetry in section 4. No data is sent to any advertising, analytics or third-party service.
Telemetry
The App writes three kinds of telemetry event to Microsoft's telemetry pipeline for the publisher (Application Insights): one per call to TCA (operation, HTTP method and status code), one when Assisted Setup completes, and one when retention housekeeping runs (counts of items removed). These events carry no document content, no party identifiers, no credentials and no user names; they are classified as system metadata. Lab0 uses them to detect failures and support customers. The Customer can additionally route the same events to its own Application Insights resource through Business Central's tenant telemetry.
Retention
| Data | Default | Control |
|---|---|---|
| Raw XML of sent and received documents | 365 days after sending or receipt | “Keep Document XML (days)”, 1–3650, in TCA Setup |
| Diagnostic API log entries | 30 days | “API Log Retention (days)”, 1–3650, in TCA Setup |
| Submission and received-document records (without XML) | Kept with the accounting records | Deleted only with the Business Central company or by the Customer |
| Client secret | Until replaced or cleared | “Clear Client Secret” in TCA Setup; removed with the company |
| Posted Business Central documents | Not affected | Standard Business Central retention |
Housekeeping runs automatically with the background jobs and can be run on demand. Uninstalling the App does not delete its tables; Business Central keeps the data until the Customer removes the App's data or the company.
TCA's own retention of submitted documents is governed by TCA's terms and by UAE law.
Legal basis and purpose
The Customer uses the App to meet its obligations under the UAE e-invoicing framework (Ministry of Finance and Federal Tax Authority regulations). Lab0 processes telemetry on the basis of its legitimate interest in operating and supporting the App. Lab0 does not act as a processor of the Customer's documents, because it has no access to them.
Security
- All connections use HTTPS; plain HTTP is refused except to a developer's own machine from a Business Central sandbox.
- Credentials live in Isolated Storage and are never logged.
- Access is governed by four permission sets: Administrator, Operator, Inbound Reviewer and Background Processing, so credential management, sending and approving received documents can be separated.
- Nothing is posted to the ledger automatically from a received document; a person creates and posts the draft.
- Installing the App performs no external call and enables nothing; sending begins only when an administrator completes Assisted Setup and enables the integration.
International transfers
Business Central data stays in the Customer's chosen Microsoft region. Documents submitted to TCA are processed by TCA and its storage provider; the storage region is determined by TCA. Telemetry is processed in Lab0's Application Insights resource in [region]. Customers outside the UAE should assess these transfers under their own law.
Your rights and choices
- Turn payload-body logging on only while investigating and off afterwards.
- Set retention periods to what your policy requires.
- Disable the integration at any time without losing configuration; disable either background job independently.
- Clear the client secret at any time.
- Individuals whose details appear in documents should direct requests to the Customer, which controls that data; Lab0 will assist the Customer where the App's design is relevant.
Changes
We will publish revisions at this URL with a new effective date. Material changes to what the App transmits will also be described in the App's release notes on AppSource.