Data Processing Addendum

This addendum forms part of the Terms of Service between the company using Invoverse ("Customer", the controller) and the operator of this Invoverse platform ("Processor").

1. Subject. Processor processes personal data that Customer puts into the Service (its members' accounts, its clients' and contacts' details, and any personal data in its documents and messages) only to provide the Service, on Customer's documented instructions, which are these terms and Customer's use of the Service.
2. Confidentiality. People authorised to process the data are bound to confidentiality.
3. Security. Processor keeps appropriate technical and organisational measures, including encryption of each company's secrets with its own key, isolation of companies and of agents' commands, access controls with two-factor sign-in, and logged, permission-based support access.
4. Sub-processors. Customer authorises hosting, email delivery, payment (Stripe) and the AI providers Customer chooses. Processor will tell Customer about new sub-processors in advance; Customer may object.
5. Assistance. Processor helps Customer answer data subjects' requests and meet its security, breach notification and impact-assessment obligations, taking into account the nature of the processing.
6. Breaches. Processor tells Customer without undue delay after becoming aware of a personal data breach.
7. Deletion. When Customer deletes its company, Processor deletes its data and destroys its encryption key; copies in backups expire on their normal schedule.
8. Audits. Processor makes available the information needed to show compliance with this addendum.
9. Transfers. Where data leaves Customer's region, Processor uses a lawful transfer mechanism.

Contact for data protection matters: the contact address of this platform.