Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms & Conditions between Invoyr Limited, company number 17502051(“Invoyr”, the “Processor”) and the customer agreeing to those Terms (the “Customer”, the “Controller”).

It applies where Invoyr processes personal data on the Customer’s behalf, and is designed to meet Article 28 of the UK GDPR and the EU GDPR. Where this DPA conflicts with the Terms on the subject of data protection, this DPA prevails.

Terms such as “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in applicable data protection law. “Customer Data” has the meaning given in the Terms.

1. Roles of the parties

The Customer is the controller of personal data contained in Customer Data. Invoyr is the processor of that data and processes it only on the Customer’s documented instructions.

Invoyr is a separate controller for account, billing, security and usage data relating to the Customer itself. That processing is governed by the Privacy Policy, not this DPA.

2. Subject matter, duration, nature and purpose

• Subject matter: provision of the Invoyr invoicing and business administration service.
• Duration:for the term of the Customer’s subscription, plus the deletion periods described in clause 11.
• Nature and purpose: hosting, storing, organising, retrieving, displaying, transmitting, backing up and deleting Customer Data so the Customer can create and send invoices, manage clients, record payments and expenses, and — where the Customer enables it — send reminders to its clients.

3. Types of personal data

Determined by what the Customer chooses to enter, but typically:

• names and business names of the Customer’s clients;
• contact details, including email addresses, phone numbers and postal addresses;
• invoice, estimate and credit note contents, including line-item descriptions of goods or services;
• payment records, amounts, payment status and payment references;
• expense records and any receipts or attachments uploaded;
• where the Customer connects a bank account, transaction data including counterparty names and references;
• names and email addresses of the Customer’s own team members invited to the account.

Invoyr does not require special category data, and the Service is not designed to process it. The Customer should not enter special category data into free-text fields.

4. Categories of data subjects

• the Customer’s clients and their staff or contacts;
• the Customer’s own team members and authorised users;
• suppliers or counterparties appearing in expense or bank transaction records.

5. Invoyr’s obligations

Invoyr will:

• process Customer Data only on the Customer’s documented instructions, including as to international transfers, unless required to do otherwise by law — in which case it will inform the Customer first, unless the law prohibits that;
• ensure that personnel authorised to process Customer Data are bound by confidentiality;
• implement the security measures described in clause 7;
• respect the conditions in clause 8 for engaging another processor;
• assist the Customer, so far as reasonably possible, in responding to data subject requests;
• assist the Customer with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to Invoyr;
• delete or return Customer Data as set out in clause 11; and
• make available the information reasonably necessary to demonstrate compliance with this DPA, as set out in clause 9.

The Terms, this DPA and the Customer’s use of the Service’s features constitute the Customer’s complete documented instructions. Invoyr will notify the Customer if it believes an instruction infringes data protection law.

6. Customer’s obligations

The Customer:

• is responsible for the accuracy, quality and legality of Customer Data and for how it was obtained;
• must have a lawful basis for the processing it instructs, including for any automated reminders sent to its clients;
• must provide its own privacy information to its clients and other data subjects;
• must configure the Service, manage user access and remove users appropriately for its own security needs.

7. Security measures

Invoyr maintains technical and organisational measures appropriate to the risk, including:

• encryption of data in transit, and encryption of stored banking access tokens;
• row-level database security so that each business’s data is isolated and cannot be read by another;
• role-based access control within a customer account;
• authentication protections including leaked-password checks and anti-bot verification;
• rate limiting on public endpoints;
• audit logging of significant account activity;
• regular backups, and restricted administrative access to production systems.

Invoyr may update these measures as the Service evolves, provided the level of protection is not materially reduced.

8. Sub-processors

The Customer gives general authorisation for Invoyr to engage the sub-processors listed below. Each is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, and Invoyr remains liable for their performance.

• Supabase — Database, authentication and file storage — where Customer Data is held at rest. Processed in: European Union (Frankfurt).
• Vercel — Application hosting and content delivery — processes requests in transit. Processed in: United States, with global edge network.
• Resend — Sending transactional and marketing email. Processed in: United States / European Union.
• Stripe — Subscription billing, and card payments collected by Customers from their clients. Processed in: United States / European Union.
• PayPal — Payments collected by Customers from their clients, where enabled. Processed in: United States / European Union.
• TrueLayer — Open Banking connections and bank transaction data, where a Customer connects an account. Processed in: United Kingdom / European Union.
• Cloudflare — Turnstile anti-bot checks on sign-up and contact forms. Processed in: Global edge network.
• Upstash — Rate limiting — stores short-lived counters keyed to IP addresses. Processed in: European Union.

Invoyr will give reasonable notice before adding or replacing a sub-processor. If the Customer reasonably objects on data protection grounds, it may raise the objection with Invoyr and, if no reasonable resolution is available, terminate the affected part of the Service.

9. Audit and information

Invoyr will make available the information reasonably necessary to demonstrate compliance with Article 28, and will contribute to audits or inspections conducted by the Customer or a mandated auditor.

In practice, Invoyr will first provide written responses to reasonable security questionnaires and any available documentation. An on-site or hands-on audit may be requested where that is insufficient and is required by law or a supervisory authority, subject to reasonable notice, no more than once in any twelve-month period except following a personal data breach, during business hours, without disrupting the Service, and subject to confidentiality. Invoyr may charge for time spent beyond a reasonable level of assistance.

10. Personal data breaches

Invoyr will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to it — the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

Notification is not an admission of fault. Responsibility for notifying a supervisory authority or affected data subjects about Customer Data rests with the Customer as controller, and Invoyr will provide reasonable assistance.

11. Deletion and return

The Customer may export Customer Data at any time while its account exists, including after a subscription lapses.

Following termination or account deletion, Invoyr will delete Customer Data from active systems in accordance with the Terms — ordinarily within 7 days — unless retention is required by law, or is temporarily necessary for security, fraud prevention, dispute resolution or legal claims.

Data may remain in encrypted backups after deletion and will be overwritten on Invoyr’s normal backup-retention cycle. It will not be restored except for disaster recovery, security or continuity purposes.

12. International transfers

Customer Data is stored at rest in the European Union. Certain sub-processors listed in clause 8 process personal data in the United States or across a global network.

Where personal data is transferred outside the UK or EEA, Invoyr relies on an appropriate transfer mechanism, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, together with supplementary measures where required.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except to the extent that applicable law does not permit those limitations.

14. Duration and changes

This DPA takes effect when the Customer accepts the Terms and continues while Invoyr processes Customer Data.

Invoyr may update this DPA to reflect changes in law, guidance, sub-processors or the Service, provided the update does not materially reduce the protections it provides. The date at the top of this page shows when it was last updated.

15. Contact

Data protection queries, including requests for a signed counterpart of this DPA, can be sent to:
Email: support@invoyr.io
Business: Invoyr / Invoyr Limited
Address: 128 City Road, London, United Kingdom, EC1V 2NX