Data Processing Agreement.

Scope

This Data Processing Agreement ("DPA") forms part of the InvoiceGap Master Subscription Agreement where InvoiceGap processes personal data on behalf of the Customer.

Terms such as controller, processor, personal data, processing and data subject have the meaning given to them by applicable data-protection law.

Roles

Where the Customer determines the purposes and means of processing personal data contained in Customer Data, the Customer acts as controller and InvoiceGap acts as processor.

Each party remains responsible for its own independent processing activities.

Documented instructions

InvoiceGap will process Customer personal data only on documented instructions from the Customer, including instructions arising from the Customer's use of the Services, the applicable Subscription Order and any authorised international transfer.

InvoiceGap may process personal data where required by applicable law and will inform the Customer of that requirement unless the law prohibits such notice.

If InvoiceGap reasonably believes that a Customer instruction infringes applicable data-protection law, InvoiceGap will inform the Customer without undue delay.

Confidentiality

Persons authorised to process Customer personal data must be subject to appropriate confidentiality obligations.

Access will be limited to persons and service components that reasonably require access for the agreed purposes.

Security

InvoiceGap will implement and maintain appropriate technical and organisational measures taking into account the nature of the processing and the risks to personal data.

The baseline measures applicable to the Services are described in Annex B and the current Security & Data information.

Current security information is described on the Security & Data page.

Subprocessors

The Customer gives general written authorisation for InvoiceGap to engage subprocessors where reasonably required to provide the Services.

InvoiceGap will require each subprocessor that processes Customer personal data to be bound by written data-protection obligations providing an equivalent level of protection for that personal data.

InvoiceGap will make its current subprocessor list available to Customers and will give reasonable notice of a material new or replacement subprocessor so that the Customer has an opportunity to raise a reasonable data-protection objection.

InvoiceGap remains responsible to the Customer for the performance of its subprocessors' data-protection obligations.

Data-subject requests

Taking into account the nature of the processing, InvoiceGap will provide reasonable assistance to help the Customer respond to requests from data subjects where required by applicable law.

If InvoiceGap receives a request relating primarily to Customer Data processed on the Customer's behalf, InvoiceGap may refer the requester to the Customer unless law requires another response.

Security incidents

InvoiceGap will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data.

InvoiceGap will provide information reasonably available to it to assist the Customer in meeting applicable notification obligations.

DPIAs and regulatory assistance

Taking into account the nature of processing and information available to InvoiceGap, InvoiceGap will provide reasonable assistance with data-protection impact assessments and relevant regulatory consultations where legally required.

International transfers

If Customer personal data is transferred internationally, InvoiceGap will use any lawful transfer mechanism required by applicable data-protection law, including an applicable adequacy decision or recognised contractual safeguards where required.

Deletion and return

Following termination of the relevant Services, InvoiceGap will, at the Customer's choice, delete or return Customer personal data and delete remaining copies, unless applicable law requires continued storage.

Personal data contained in backups may remain until the relevant backup cycle expires. During that period it will remain protected and will not be used for any new purpose.

Audit information

InvoiceGap will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and reasonably contribute to audits or inspections carried out by the Customer or an auditor appointed by the Customer.

Audits must protect the security and confidentiality of InvoiceGap and other customers and be conducted with reasonable notice and during normal business hours. Unless required by a regulator, applicable law or a relevant security incident, audits will normally be limited to once in any twelve-month period.

Customer obligations

The Customer is responsible for ensuring that its instructions are lawful and that it has an appropriate legal basis for personal data it submits to InvoiceGap.

The Services are not intended for special category data or other particularly sensitive personal data unless that processing has been expressly agreed and is lawful.

Annex A — Processing details

Subject matter

Processing business and financial records selected by the Customer for reconciliation, evidence review, reporting and related support.

Nature of processing

Receiving, storing, reading, extracting, normalising, classifying, linking, analysing, reconciling, displaying, exporting, securing and deleting Customer-selected records as required to provide the Services.

Duration

For the duration of the relevant subscription or other agreed service period, plus any documented retention period.

Categories of data subjects

• Customer users and personnel
• Buyer and supplier business contacts
• Finance, accounts receivable and operations personnel
• Other persons identified in Customer business records

Categories of personal data

• Names and business contact details
• Job titles and organisational information
• Account and workspace information
• Invoice, delivery, claim, payment and remittance references
• Information contained in Customer-selected business documents
• Service, support and security records

Annex B — Baseline security principles

• Authenticated user access
• Organisation-scoped data separation
• Server-side protection of credentials, secrets and sensitive application logic
• Secure password hashing
• Encrypted transport for production traffic
• Controlled production access
• Security and operational logging