Your clients’ data, processed only for you.
This addendum sets out how we process the personal data you put into WhizInvoice or collect through it. It is part of our terms automatically, with nothing to sign.
Last updated 24 October 2026
1. What this addendum is
This Data Processing Addendum (“addendum”) is between you, the business that holds a WhizInvoice account, and WhizInvoice (“WhizInvoice”, “we”, “us”). It forms part of our Terms of service (“terms”) and applies automatically whenever we process Customer Personal Data for you. It meets the requirements of Article 28 of the GDPR and of the UK GDPR, and the other laws named in sections 15 to 17.
If this addendum and the terms conflict on data protection, this addendum wins. If the Standard Contractual Clauses apply and conflict with this addendum, the Standard Contractual Clauses win.
If your business needs a countersigned copy, email legal@whizinvoice.com.
2. Definitions
- Customer Personal Data: personal data in the data you put into WhizInvoice or collect through it, which we process for you.
- Data Protection Laws: all laws that apply to the processing of Customer Personal Data, including the GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and other US state privacy laws, and the other laws named in this addendum.
- Subprocessor: any processor we engage to process Customer Personal Data.
- Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data.
- Standard Contractual Clauses: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
- UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022.
Controller, processor, data subject, personal data and processing have the meanings the GDPR gives them, and include the matching terms in other Data Protection Laws, such as business, service provider and contractor under the CCPA.
3. Our roles
For Customer Personal Data, you are the controller and we are your processor. If you process that data for your own client as their processor, we are your subprocessor, and you confirm that your client has authorised our appointment.
For the account data of you and your team members, we are the controller, and our Privacy policy applies instead of this addendum.
You are responsible for having a lawful basis for the Customer Personal Data you collect, for the notices you give to the people it is about, and for the lawfulness of your instructions.
4. Details of the processing
The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.
5. Your instructions
We process Customer Personal Data only on your documented instructions, including on transfers to other countries, unless the law requires otherwise. If the law requires otherwise, we will tell you before we process, unless the law forbids that on important grounds of public interest.
The terms, this addendum, your settings and the way you use WhizInvoice are your complete instructions. We will tell you straight away if we think an instruction breaks Data Protection Laws.
6. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and may access it only as needed to provide and support WhizInvoice.
7. Security
We apply the technical and organisational measures in Annex 2 to protect Customer Personal Data, as Article 32 of the GDPR requires. We may change these measures over time, but never in a way that lowers the overall protection of Customer Personal Data.
8. Subprocessors
You give us general authorisation to use the Subprocessors listed in Annex 3.
We will tell you at least 30 days before we add or replace a Subprocessor, by email to your account owner and by updating Annex 3. You can object on reasonable data protection grounds by emailing privacy@whizinvoice.com within those 30 days. If you object, we will work with you in good faith to address your concern. If we cannot, you may stop using the feature concerned or close your account before the change takes effect.
We put a written contract in place with each Subprocessor that gives Customer Personal Data the same level of protection as this addendum. We remain responsible to you for the work of our Subprocessors.
9. Requests from data subjects
If someone asks us to use a data protection right over Customer Personal Data, we will pass the request to you without undue delay, and we will not answer it ourselves except to tell them we have done so.
WhizInvoice lets you find, correct, download and delete Customer Personal Data yourself. Where you need more help to answer a request, we will give you reasonable assistance, taking into account the nature of the processing.
10. Other assistance
Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your security obligations, data protection impact assessments and consultations with data protection authorities.
11. Personal Data Breaches
We will notify you of a Personal Data Breach without undue delay, and within 72 hours of becoming aware of it.
Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures we have taken or propose to take. Where we cannot give all of this at once, we will give it in stages without undue delay.
We will take reasonable steps to contain the breach and limit its effects. Notifying you of a breach is not an admission of fault.
12. Return and deletion
You can download Customer Personal Data at any time using the export tools in the app, including after you cancel a paid plan. Cancelling a paid plan moves your account to the Free plan and does not delete anything.
When you ask us to delete your account or Customer Personal Data, we delete it within 30 days, and copies roll out of our backups within a further 30 days, unless the law requires us to keep it. Where we must keep it, we keep protecting it under this addendum and use it only for that legal purpose.
13. Information and audits
We will make available the information reasonably needed to show that we meet our obligations under this addendum, and answer a reasonable written security questionnaire from you once a year.
If that is not enough, you may audit our compliance by reasonable request, or ask an independent auditor bound by confidentiality to do so. Please give us at least 30 days notice. Audits take place during normal business hours, no more than once in any 12 months unless there has been a Personal Data Breach or a data protection authority requires it, at your cost, and without access to other customers’ data or to our providers’ systems.
14. International transfers
Customer Personal Data is stored on servers in Frankfurt, Germany, in the European Union. Where we or our Subprocessors process it in a country that does not have an adequacy decision covering it, we protect it with appropriate safeguards, as sections 15 to 17 set out.
15. Europe, the UK and Switzerland
15.1 European Union and EEA
Where your transfer of Customer Personal Data to us is a transfer to a third country under Chapter V of the GDPR, the Standard Contractual Clauses are incorporated into this addendum by reference, with you as data exporter and us as data importer, as follows:
- Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor;
- the optional docking clause in Clause 7 applies;
- under Clause 9(a), Option 2 (general written authorisation) applies, with 30 days notice of changes, as section 8 sets out;
- the optional wording in Clause 11(a) does not apply;
- under Clause 13, the competent supervisory authority is the one identified in Annex 1;
- under Clause 17, the clauses are governed by the law of the EU Member State in which you are established, or, if that law does not allow third party beneficiary rights or you are not established in the EU, by the law of Ireland;
- under Clause 18, disputes are resolved by the courts of the Member State whose law governs the clauses;
- Annexes I, II and III of the clauses are completed by Annexes 1, 2 and 3 of this addendum.
For our own Subprocessors outside the EEA, we put in place the Standard Contractual Clauses or, where a US Subprocessor is certified, rely on the EU US Data Privacy Framework.
15.2 United Kingdom
Where the UK GDPR applies to a transfer, the UK Addendum is incorporated into this addendum by reference. Table 1 is completed with the parties’ details in Annex 1, Table 2 with the modules and options in section 15.1, and Table 3 with Annexes 1, 2 and 3. For Table 4, neither party may end the UK Addendum when the approved addendum changes.
15.3 Switzerland
Where the Swiss Federal Act on Data Protection applies to a transfer, the Standard Contractual Clauses apply as set out in section 15.1, with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers, references to the GDPR include the Federal Act on Data Protection, and data subjects in Switzerland may bring claims in Switzerland, where they habitually live.
16. United States
16.1 California
Where the California Consumer Privacy Act (CCPA) applies, we act as your service provider or contractor, and you disclose Customer Personal Data to us only for the limited and specified business purpose of providing WhizInvoice to you under the terms. We:
- will not sell or share Customer Personal Data, where share means sharing for cross context behavioural advertising;
- will not retain, use or disclose it for any purpose, commercial or otherwise, other than that business purpose, or outside our direct business relationship with you;
- will not combine it with personal information we receive from others or collect ourselves, except as the CCPA regulations allow;
- will comply with the CCPA and give Customer Personal Data the level of privacy protection the CCPA requires;
- will tell you if we can no longer meet our obligations under the CCPA;
- give you the right, on notice, to take reasonable and appropriate steps to stop and remedy any unauthorised use of Customer Personal Data, and to check that we use it in a manner consistent with your CCPA obligations;
- will help you respond to consumer requests, as section 9 sets out, and will require the same commitments from our Subprocessors.
We certify that we understand these restrictions and will comply with them.
16.2 Other US states
Where another US state privacy law applies, such as those of Virginia, Colorado, Connecticut, Texas or Oregon, we act as your processor. This addendum sets out your instructions, the nature and purpose of the processing, the types of data and its duration, and our duties of confidentiality, assistance, deletion, information, audit and Subprocessor contracts, as those laws require.
17. Other regions
Where another data protection law applies to Customer Personal Data, we meet the processor duties it sets, using the commitments in this addendum. In particular:
17.1 Canada
Under PIPEDA and the provincial laws, we protect Customer Personal Data with safeguards comparable to those you must apply, use it only for the purposes in this addendum, and notify you of any breach so you can assess the risk of significant harm.
17.2 Australia and New Zealand
We handle Customer Personal Data consistently with the Australian Privacy Principles, including APP 11 on security, and the Information Privacy Principles of the New Zealand Privacy Act 2020. We will notify you of a breach promptly so you can assess it under the Notifiable Data Breaches scheme or the New Zealand privacy breach rules.
17.3 Asia
We act as your data processor under India’s Digital Personal Data Protection Act 2023, as your data intermediary under Singapore’s PDPA, protecting the data, keeping it only as long as needed and notifying you of breaches without undue delay, and as your entrusted party under Japan’s APPI, subject to your supervision.
17.4 Latin America
We act as your operator under Brazil’s LGPD. Where the LGPD requires it for a transfer out of Brazil, the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) apply between us. We also meet the processor duties under the laws of Mexico, Argentina, Colombia and Chile.
17.5 Middle East and Africa
We act as your operator under South Africa’s POPIA, processing Customer Personal Data only with your knowledge or authorisation, treating it as confidential, applying the security measures in Annex 2, and notifying you straight away if we reasonably believe it has been accessed or acquired by an unauthorised person. We meet the processor duties under the laws of the United Arab Emirates, including the DIFC and ADGM, Saudi Arabia, Nigeria and Kenya in the same way.
18. Liability
Each party’s liability under this addendum is subject to the limits in the terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow those limits. Nothing in this addendum limits the rights of data subjects under the Standard Contractual Clauses.
19. Duration
This addendum lasts for as long as we process Customer Personal Data for you, including after your account ends until the data is deleted.
20. Changes to this addendum
We may update this addendum to reflect changes in the law or in our service. If a change materially reduces the protection of Customer Personal Data, we will not make it. Other material changes take effect after 30 days notice, as the terms set out.
21. Which law applies
Where the Standard Contractual Clauses, the UK Addendum or Data Protection Laws decide which law governs a matter, that law applies. Everything else follows the terms.
22. Contact
Questions about this addendum: privacy@whizinvoice.com. Legal notices: legal@whizinvoice.com.
Annex 1. Details of processing
- Data exporter: you, the business named in your WhizInvoice account, as controller or, where you act for your own client, as processor. Contact: the account owner’s email address. Activity: using WhizInvoice.
- Data importer: WhizInvoice, as processor or subprocessor. Contact: privacy@whizinvoice.com. Activity: providing WhizInvoice.
- Categories of data subjects: people who send enquiries through your website forms or whose enquiry emails you forward to us; your customers and clients, and the contact people at client businesses; anyone else whose personal data you put into WhizInvoice.
- Categories of personal data: enquiry fields as submitted on your forms, such as name, email, phone, postcode, suburb, address, service, message and any other fields; enquiry emails you forward to your private address, and what is read from them; the address of the page each form was sent from; customer records; quotes, including the name, signature, choices and IP address recorded when your client accepts one; invoices, including what your client tells us when they tap I’ve paid; jobs, visits and calendar entries; payments you record or confirm, and the paid notices your own Stripe account sends us; and the addresses of your connected websites.
- Sensitive data: none is intended. You should not put special category or sensitive data into WhizInvoice unless you need it and the law allows it. If you do, the measures in Annex 2 apply.
- Frequency: continuous, for as long as you use WhizInvoice.
- Nature of the processing: hosting and storage; receiving the enquiry emails you forward to us and reading them into enquiries; organising, displaying and searching; turning enquiries into quotes, jobs and invoices; matching payments to invoices; sending emails, quotes and invoices on your instruction; AI processing of the text needed for an action, only when a user chooses an AI feature; export and deletion.
- Purpose: to provide WhizInvoice to you under the terms.
- Duration and retention: for as long as you keep the data in your account. Deletion follows section 12.
- Transfers to Subprocessors: as listed in Annex 3, for the same nature and purpose, and for the same duration.
- Competent supervisory authority: the authority of the EU Member State where you are established. If you are not established in the EU but the GDPR applies to you under Article 3(2), the authority of the Member State where your Article 27 representative is established, or if you do not need one, the authority of the Member State where the people whose data is transferred are located.
Annex 2. Technical and organisational measures
- Encryption in transit: HTTPS on every page, with HSTS on the app.
- Passwords: stored only as Argon2id hashes, at least 10 characters including a capital letter, a small letter and a special character, and checked against known breached passwords on the live app using the k-anonymity range method.
- Sign in: email verification by code, optional two factor sign in with an authenticator app (secret stored encrypted), and rate limits of 5 attempts a minute for each email address and IP address and 30 an hour for each IP address. Sign ups are limited to 5 an hour for each IP address.
- Sessions: session cookies are encrypted, secure, httpOnly and SameSite Lax.
- Separation of customers: each account’s data is separated at the application level, and automated tests on every release check that one account can never read another account’s data.
- Website connections: connection secrets are encrypted at rest, connector requests are signed with HMAC SHA-256, and requests older than 5 minutes are rejected.
- Billing: card details never touch our servers, and billing webhooks are signature checked.
- Application protection: a strict Content Security Policy, framing denied, and app pages never stored by shared caches.
- Server protection: application code and secrets sit outside the public web folder.
- Logging: audit logs of sign ins, billing changes and security events, kept for 12 months.
- Location: data stored on servers in Frankfurt, Germany, in the European Union.
- Data minimisation for AI: data goes to AI providers only when a user uses an AI feature, and only the text needed for that action.
- People: everyone authorised to process Customer Personal Data is bound by confidentiality.
- Data subject rights: tools in the app to find, correct, download and delete data.
- Subprocessors: written contracts giving the same level of protection as this addendum.
Annex 3. Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Hostinger International Limited | Hosting of the app and its MariaDB database, and the content delivery network that carries traffic to it | Company in Cyprus. Servers in Frankfurt, Germany (EU) |
| Brevo (Sendinblue SAS) | Sending emails: sign up confirmation codes, password resets, and the invoices, quotes and visit messages you send. Receiving the enquiry emails forwarded to your private in.whizinvoice.com address and passing them to WhizInvoice | France (EU) |
| Freemius, Inc. | Reseller and merchant of record for subscriptions. Receives account billing data only, never Customer Personal Data | United States |
| OpenAI | AI features, only when a user uses an AI feature, and only the text needed for that action | United States |
| Anthropic | AI features, only when a user uses an AI feature, and only the text needed for that action | United States |
Freemius is listed for completeness. It sells our subscriptions as our reseller and handles payment data for that purpose, and it does not receive the data you put into WhizInvoice. Under their API terms, OpenAI and Anthropic do not use the data we send them to train their models.