Data Processing Addendum

For Customer Personal Data processed through Avriloq on the Customer's documented instructions, the Customer acts as controller or, where applicable, as a processor acting for another controller, and Avriloq acts as processor or subprocessor. Each party remains responsible for the obligations that apply to its role under applicable data-protection law.

“Customer Personal Data” means personal data submitted to, generated in or made available to Avriloq by or for the Customer in connection with the service, excluding personal data Avriloq processes independently for its own account administration, subscription billing, security, fraud prevention, support, legal obligations or other documented controller purposes.

Avriloq will process Customer Personal Data only on the Customer's documented instructions, including instructions expressed through the Customer's configuration, authorised users and use of the service, unless applicable UK law requires otherwise. Instructions include transfers of Customer Personal Data to the locations and authorised providers necessary to deliver the configured service, subject to the transfer protections in this DPA.

Where law requires Avriloq to process Customer Personal Data outside the Customer's instructions, Avriloq will inform the Customer before processing unless the law prohibits that notice. Avriloq will inform the Customer if, in Avriloq's reasonable view, an instruction infringes applicable data-protection law and may pause the affected processing while the parties resolve the issue.

Avriloq will ensure that people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and that access is limited to what is reasonably required to provide, secure and support the service.

Taking account of the nature, scope, context and purposes of processing and the relevant risks, Avriloq will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Current product safeguards are described in the Avriloq Trust Centre. Security measures may evolve as the service changes, provided the overall level of protection is not materially reduced during the agreement.

The Customer gives Avriloq general written authorisation to appoint subprocessors necessary to provide the service. Avriloq will enter into a written contract with each subprocessor that imposes data-protection obligations providing a level of protection for the relevant Customer Personal Data that is materially equivalent to the obligations Avriloq has under this DPA, as required by applicable law. Avriloq remains responsible to the Customer for the performance of those subprocessor obligations to the extent required by applicable law and this DPA.

Avriloq publishes its current downstream provider list at Service providers & integrations. Where Avriloq introduces a new subprocessor that will materially process Customer Personal Data, Avriloq will provide reasonable advance notice through that page, the service or another agreed channel where the Customer has requested contractual subprocessor-change notice. The Customer may object on legitimate data-protection grounds during the applicable notice period. The parties will work in good faith to address a reasonable objection; if no reasonable alternative is available, either party may terminate the affected processing or service as permitted by the Customer agreement.

Some services a Customer chooses to connect are not simply downstream subprocessors appointed by Avriloq. Examples may include QuickBooks Online/Intuit, Xero, Salesforce and Stripe or other payment services, depending on the feature and provider terms. When the Customer connects such a service, the Customer instructs and authorises Avriloq to exchange the data reasonably necessary to provide that integration within the scopes approved by the Customer.

Those providers may act as independent controllers, processors for the Customer, processors for Avriloq, or in more than one role depending on the service. Their own terms, privacy notices and data-processing terms apply to their processing. Avriloq will not describe a provider as a Avriloq subprocessor where that classification does not accurately reflect the relevant processing relationship.

Taking into account the nature of the processing, Avriloq will provide reasonable assistance through appropriate technical and organisational measures to help the Customer respond to requests from individuals exercising applicable data-protection rights. If Avriloq receives a request that clearly concerns Customer Personal Data controlled by the Customer, Avriloq will direct the requester to the Customer or notify the Customer where appropriate and will not independently determine the merits of the request unless legally required.

Avriloq will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. Avriloq will provide information reasonably available to it that the Customer needs to assess the incident and meet applicable notification obligations, and will take reasonable steps to contain, investigate and remediate the incident.

Taking into account the nature of processing and information available to Avriloq, Avriloq will reasonably assist the Customer with security obligations, breach notifications, data-protection impact assessments and prior consultation with a supervisory authority where those obligations relate to Avriloq's processing for the Customer.

At the end of the services involving Customer Personal Data, Avriloq will, at the Customer's choice and subject to applicable law and available product functionality, delete or return Customer Personal Data and delete remaining copies under Avriloq's control. Limited data may be retained where required by law, for security or fraud prevention, legal claims, or within protected backup cycles until overwritten in the ordinary course. Any retained Customer Personal Data remains protected by this DPA for as long as Avriloq processes it as processor.

Avriloq will make information reasonably necessary to demonstrate compliance with these processor obligations available to the Customer. Subject to appropriate confidentiality, security and operational safeguards, Avriloq will allow and contribute to reasonable audits or inspections required by applicable data-protection law. The parties will first use available documentation, questionnaires and remote evidence where those measures can reasonably satisfy the request, unless an on-site audit is legally required or reasonably necessary following a material incident or substantiated compliance concern.

Avriloq will not make a restricted transfer of Customer Personal Data unless an applicable lawful transfer mechanism or exception is in place. Depending on the processing, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another legally recognised safeguard. Avriloq will take reasonable steps to assess transfer arrangements relevant to its subprocessors.

The Customer is responsible for ensuring it is entitled to provide Customer Personal Data to Avriloq, that its instructions are lawful, and that it gives individuals the information required about its use of Avriloq. The Customer will configure user access, automation, retention choices and integrations appropriately for its business and the sensitivity of the data involved, and will avoid providing special-category or similarly sensitive information that is unnecessary for the service.

This DPA applies for as long as Avriloq processes Customer Personal Data for the Customer. If this DPA conflicts with the main Customer agreement on the processing of Customer Personal Data, this DPA prevails to the extent of that conflict. Other commercial terms, including liability provisions, continue to apply unless this DPA expressly states otherwise or applicable data-protection law requires a different result.

Subject matter and purpose

Providing Avriloq's invoicing, payment tracking, collections, customer administration, communications, reporting and configured AI/automation functionality, together with service security, support, maintenance and customer-authorised integrations.

Duration

For the duration of the applicable Customer agreement and any limited period required for secure deletion, backup expiry or lawful retention.

Nature of processing

Collection, recording, storage, organisation, retrieval, consultation, structuring, calculation, transmission to authorised providers, generation of invoices and communications, classification and other configured operations necessary to provide Avriloq.

Categories of data subjects

The Customer's customers, prospective customers, suppliers and other business contacts whose information the Customer is authorised to manage, plus authorised Customer users where their activity forms part of Customer Content.

Typical personal data

Names, business/contact details, invoice and transaction-related information, payment status, jobs/bookings or service descriptions, communications, accounting identifiers and customer-service or collections records supplied or generated through the service.

Special-category and high-risk data

Avriloq is not intended to be a general repository for special-category personal data, criminal-offence data, health data, government identifiers or other sensitive information unnecessary for invoicing and business administration. The Customer must not instruct Avriloq to process such data unless the parties have expressly assessed and agreed the additional requirements.

The current security overview is maintained in the Trust Centre. The current operational provider register and distinction between Avriloq subprocessors and Customer-authorised external integrations is maintained at Service providers & integrations. Those pages form part of the operational description of this DPA and may be updated as Avriloq develops, subject to the protections and applicable notice rights in this DPA.