Data Processing Addendum
Last updated
This addendum sets out how we process personal data about your clients on your behalf. It is incorporated into our Terms, so you don't need to sign anything separately. If you need a countersigned copy, contact us.
1. Scope and parties
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Customer”, the controller) and PayNudge (“Processor”). It applies when the Processor processes personal data on the Customer's behalf in providing PayNudge (“Customer Personal Data”), and is entered into to meet Article 28 of the EU GDPR and the UK GDPR, and equivalent requirements of other applicable data protection laws.
It takes effect automatically when the Customer accepts the Terms. If this DPA conflicts with the Terms, this DPA prevails for Customer Personal Data.
2. Details of processing
| Subject matter | Providing the PayNudge service: tracking invoices and preparing, scheduling and sending payment reminders on the Customer's instructions. |
|---|---|
| Duration | The term of the Customer's account, plus the period until deletion under section 10. |
| Nature and purpose | Storage, organisation, AI-assisted extraction and drafting, email transmission, retrieval and deletion, solely to provide the Service. |
| Data subjects | The Customer's clients' contact persons (for example accounts payable staff, directors and project contacts), and any individuals named in invoices, contracts or correspondence the Customer uploads; the Customer's team members. |
| Categories of data | Names, business email addresses, job titles, business postal addresses and phone numbers, invoice and payment information, contract terms, email correspondence content, notes. |
| Special categories | None intended. The Customer agrees not to upload special category or criminal offence data. |
3. Processing on instructions
The Processor processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service, unless required by law, in which case it will inform the Customer unless the law prohibits it. The Processor will tell the Customer if it believes an instruction infringes data protection law. The Customer is responsible for having a lawful basis for the processing and for the accuracy of the data.
4. Confidentiality
The Processor ensures that anyone authorised to process Customer Personal Data is bound by confidentiality and only accesses it as needed to provide, secure or support the Service.
5. Security
The Processor implements the technical and organisational measures described in Annex 1 (section 13) and keeps them under review, taking into account the state of the art, cost, and the risks to data subjects.
6. Subprocessors
The Customer gives general authorisation for the subprocessors listed on our Subprocessors page. The Processor imposes data protection terms on each subprocessor no less protective than this DPA and remains liable for their performance. The Processor will give at least 30 days' notice of new subprocessors; the Customer may object on reasonable grounds and, if no solution is found, terminate the affected Service.
7. International transfers
Where Customer Personal Data is transferred outside the UK or EEA to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference, or on another valid transfer mechanism such as the EU-US Data Privacy Framework.
8. Assistance and data subject requests
Taking into account the nature of processing, the Processor will help the Customer respond to data subject requests (most can be handled directly in the Service by editing or deleting records), and with security, breach notification, data protection impact assessments and prior consultations. If the Processor receives a request directly from a data subject, it will forward it to the Customer without responding substantively.
9. Personal data breaches
The Processor will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed. The Processor will provide further information as it becomes available.
10. Deletion and return
On termination, or when the Customer deletes its account or workspace, the Processor will delete Customer Personal Data from live systems promptly. Backup copies are overwritten on a rolling schedule and deleted within 14 days. Before deletion the Customer may export data using the Service's export features where available on its plan, or by request. The Processor may retain data only where required by law, and will keep it confidential.
11. Records and audits
The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to security questionnaires. Where that is not sufficient, the Customer may, at its own cost, on at least 30 days' written notice and no more than once a year (unless required by a supervisory authority or following a breach), conduct an audit through an independent auditor bound by confidentiality, in a way that does not disrupt the Service or compromise other customers' data.
12. Liability
Each party's liability under this DPA is subject to the limitations in the Terms, except where such limitation is not permitted by law.
13. Annex 1: Technical and organisational measures
- Encryption in transit: HTTPS (TLS) for all web traffic, with automatic certificate management; TLS for connections to subprocessors.
- Access control: each record belongs to one workspace; every query is scoped to the workspace on the server; role-based permissions (owner, admin, member).
- Authentication: salted, slow password hashing; mandatory email verification; tokens for verification, password reset and invitations stored hashed with expiry; rate limits on sign-in and other sensitive actions.
- Files: uploads stored under random, non-guessable keys and served only to authenticated members of the owning workspace.
- Infrastructure: hosted on a virtual private server where only the HTTPS web server is exposed to the internet; the database and application run in isolated containers, the application as a non-root user; physical and disk-level security provided by the hosting provider.
- Resilience: daily backups of the database and uploaded files, retained for 14 days, with restore procedures.
- Email: sending through Microsoft 365; at-most-once delivery for reminders; logging of each send.
- Application security: security headers, input validation on every server action, dependency updates, and no logging of passwords or tokens.
- Personnel: access to production limited to those who need it, bound by confidentiality.
- AI: use of a commercial AI API that does not train on customer data; minimised context sent per request.
14. Contact
Privacy and DPA questions: support@paynudge.site. PayNudge, Indonesia.