Data processing agreement

1. Parties and acceptance

• The parties are you, the business with a MinsoBill account ("Customer", the controller), and MinsoBill (the processor).
• You accept this agreement by using MinsoBill. It forms part of our terms of service. If you need a signed copy, email support@minsobill.com and we will send one.
• If this agreement and the terms disagree about personal data, this agreement wins.

Contact us at support@minsobill.com.

2. What we process (Annex 1)

Subject matter and purpose

Providing MinsoBill: storing client and product records, creating, sending and tracking quotes and invoices, reminders, client pay pages, exports and, if you use it, AI quick-create.

Duration

For as long as you have an account, then until deletion as described in section 9.

Data subjects

Your clients and their contacts, and people who open your invoice and quote links.

Types of personal data

Names, email addresses, phone numbers, postal addresses, tax numbers, what you invoice them for, amounts and payments, notes you write, and what clients send through your links (payment reports, quote answers and the name they type). IP addresses only as a one-way keyed hash, to limit abuse.

Special category data

None is needed. Do not put health or other special category data into MinsoBill.

3. Our obligations

We will:

1. process the data only on your documented instructions, which are your use of MinsoBill and these terms, unless the law requires otherwise (we will tell you if so, where the law allows);
2. make sure everyone who can access the data is bound to keep it confidential;
3. keep it secure with the measures in section 4;
4. use other processors only as set out in section 5;
5. help you answer requests from people exercising their rights, mostly through the app itself (editing, export, deletion);
6. help you with security, breach notifications, data protection impact assessments and prior consultations, as far as our part of the processing allows;
7. delete or return the data when you stop using MinsoBill, as in section 9;
8. give you the information you need to show this agreement is kept, and allow and contribute to reasonable audits (section 8).

We tell you straight away if we believe an instruction breaks data protection law.

4. Security (Annex 2)

• Encryption in transit (HTTPS) everywhere, and encryption at rest by our database provider.
• Each business's data is separated in the database itself with row-level security, tested on every change so one business cannot read or write another's.
• Issued invoices are locked and kept with their snapshot; every change of state is logged.
• Public invoice links use revocable tokens and are rate-limited.
• Secrets stay on the server; changing bank details needs your password again and alerts the owner.
• Daily backups by our database provider, a nightly encrypted copy with a second provider in another region, and a monthly restore drill.
• Automated dependency audits and secret scanning, and a strict Content-Security-Policy.

5. Sub-processors

• You give general authorisation for the sub-processors on our sub-processors page.
• We give at least 30 days' notice on that page before a new sub-processor starts. If you object on reasonable data protection grounds, tell us; if we cannot address it, you may stop using MinsoBill and export your data.
• Each sub-processor is bound by a written contract with data protection duties at least as strict as these. We remain responsible to you for them.

6. International transfers

The data is hosted in the United States. For each sub-processor we rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise on the EU Standard Contractual Clauses with the UK Addendum or the UK IDTA, as listed on the sub-processors page.

Where the law requires transfer safeguards between you and us, the EU Standard Contractual Clauses (Module 2, controller to processor), with the UK Addendum for UK data, are incorporated into this agreement by reference.

7. Personal data breaches

If we become aware of a personal data breach affecting your data, we tell you without undue delay, with what we know: what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We add details as we learn them, so you can meet your own duty to notify.

8. Information and audits

On request, we give you the information you reasonably need to show compliance, such as answers to a security questionnaire and our sub-processors' certifications. Where that is not enough, you may carry out an audit, or have an independent auditor do so, with reasonable notice, at your cost, during business hours and under a duty of confidentiality.

9. When you stop using MinsoBill

You can export all your data at any time. When your account is deleted, we delete the data from the live service. Copies in backups expire on their own: daily copies within 35 days and monthly copies within 13 months. We keep data longer only where the law requires it.

10. Liability and law

Liability under this agreement is subject to the limits in our terms of service, except where the law does not allow that. This agreement is governed by the same law as the terms.