Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (the “DPA”) is between the business that uses Invoicer (the “Customer”, the controller) and Oxus Technologies Limited, company number 818468, registered office Greenhills Road, Walkinstown, Dublin 12, D12 DX80, Ireland (“Oxus”, the processor). It forms part of the Terms of Service and applies whenever Oxus processes personal data on the Customer's behalf in providing Invoicer.

It sets out the terms required by Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Words defined in the GDPR, such as personal data, processing, controller, processor and data subject, have the same meaning here.

It does not cover personal data Oxus processes as a controller in its own right, such as the Customer's account and billing details. That is covered by our Privacy Policy.

2. Details of the processing

• Subject matter: the provision of Invoicer to the Customer under the Terms.
• Duration: for as long as the Customer uses Invoicer, and then until the data is deleted as set out in end of processing.
• Nature and purpose: storing, organising, displaying and transmitting personal data so that the Customer can manage clients and contractors, issue and receive invoices and credit notes (including self-billed invoices), have contracts and agreements signed, send documents by email, collect payments and keep records.
• Types of personal data: contact details (names, email addresses, phone numbers), business and billing addresses, tax identifiers (VAT, CRO and PPS numbers where entered), bank details (IBAN), invoice and contract contents, and audit trail data (name, time, IP address and browser user agent recorded on acceptances and signatures).
• Data subjects: the Customer's clients, suppliers and contractors and their contact people, and the Customer's own team members.
• Special category data: none is required, and the Customer must not upload it.

3. Processing on documented instructions

Oxus processes the personal data only on the Customer's documented instructions, including with regard to transfers outside the EEA, unless EU or Irish law requires otherwise; in that case Oxus will tell the Customer before processing, unless the law forbids it. The Terms, this DPA and the Customer's use of Invoicer's features are the Customer's instructions. Oxus will tell the Customer if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

Oxus ensures that everyone it authorises to process the personal data is bound by a duty of confidentiality, whether contractual or statutory, and has access only as far as their role needs.

5. Security (Article 32)

Oxus implements appropriate technical and organisational measures to protect the personal data, taking into account the state of the art, the cost, and the risks to data subjects. They include:

• encryption of data in transit (TLS) and at rest;
• row level security in the database, so one customer's data cannot be read by another;
• role-based access within each customer account;
• encryption of third-party credentials held for the Customer;
• least-privilege access to production systems for Oxus staff;
• audit logging of acceptances, signatures and invoice decisions;
• regular backups.

6. Sub-processors

The Customer gives Oxus general authorisation to engage sub-processors. The current list is at Sub-processors.

• Oxus will give the Customer at least 30 days' notice by email before adding or replacing a sub-processor.
• The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may stop using the affected service and close its account.
• Oxus imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for their performance.

7. Assistance to the Customer

Taking into account the nature of the processing, Oxus will help the Customer, by appropriate technical and organisational measures where possible:

• to respond to requests from data subjects exercising their rights. If a data subject contacts Oxus directly, Oxus will pass the request to the Customer promptly and will not respond on its own initiative;
• with data protection impact assessments and prior consultation with the Data Protection Commission, where the Customer needs them for its use of Invoicer;
• to meet its security and breach notification obligations.

Much of this the Customer can do itself: Invoicer lets the Customer view, correct, export and delete the records it holds.

8. Personal data breaches

Oxus will notify the Customer of a personal data breach affecting the Customer's data without undue delay, and in any case within 48 hours of becoming aware of it. The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Oxus will provide further information as it becomes available.

9. End of processing

When the Customer's account ends, the Customer can export its data for 30 days, and Oxus will return it on request during that time. After that, Oxus deletes it, unless EU or Irish law requires Oxus to keep it. Copies in backups are deleted as those backups rotate out.

10. Information and audits

Oxus will make available on request the information reasonably needed to demonstrate compliance with this DPA and Article 28. Where that information is not enough, the Customer (or an auditor it appoints, bound by confidentiality) may carry out an on-site audit, on reasonable written notice, during business hours, at the Customer's cost, and no more than once in any twelve months, unless a breach or a supervisory authority requires otherwise.

11. International transfers

Customer data is stored in Ireland (AWS eu-west-1). Where a sub-processor processes personal data outside the EEA, Oxus ensures the transfer is covered by an adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified, or by the European Commission's Standard Contractual Clauses, with any supplementary measures they require.

12. The Customer's obligations

• The Customer is responsible for having a lawful basis for the personal data it enters, and for giving data subjects the information the GDPR requires.
• The Customer's instructions must comply with data protection law.
• The Customer is responsible for the accuracy of the data it enters, and for managing the access of its own team members.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it to be limited. If this DPA and the Terms conflict on the processing of personal data, this DPA takes precedence.

14. Signed copy and contact

Data protection questions: info@oxus.ie