Last updated 6 November 2026 (receipts on an invoice’s lines)
This agreement is between the Customer and Odisal, as defined in the terms of service, and forms part of those terms.
When the Customer puts personal data into the Service — about its clients, their contacts, or anyone named on its documents — the Customer is the controller of that data and Odisal is its processor. This agreement governs that processing.
Separately, Odisal is the controller of the account data of Authorised Users (their name, email address and sign-in records), which it handles as described in the privacy notice. This agreement does not cover that data.
Words not defined here have the meaning given in the terms of service or in the UK GDPR and the Data Protection Act 2018, and, where it applies to the Customer, the EU GDPR (together, “Data Protection Law”).
The subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects, are set out in Annex 1.
3.1 Odisal processes the Customer’s personal data only on the Customer’s documented instructions. The Customer’s instructions are these terms and this agreement, and the Customer’s use of the Service’s features — for example, creating an invoice, sharing a Client Link, exporting data, or deleting a record — each of which is an instruction to carry out that action.
3.2 Odisal may process the data otherwise only where the law requires it to, and will tell the Customer of that requirement first unless the law forbids it.
3.3 Odisal will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.
3.4 The Customer confirms that it has a lawful basis for the personal data it puts into the Service, that it has given the people concerned any notice the law requires, and that it gives access only to people who should see that data.
Odisal ensures that everyone it authorises to process the Customer’s personal data is bound by a duty of confidentiality. Access is limited to the people who need it to run, support and secure the Service, and is used only for those purposes.
Today that is one person, the director of Odisal Ltd.
Odisal implements the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk, as Article 32 requires. Odisal may change those measures, provided the overall level of protection is not reduced.
6.1 The Customer gives general authorisation for Odisal to use the sub-processors listed in Annex 3.
6.2 Odisal will give the Customer at least 30 days’ notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may end the terms of service before the change takes effect, and Odisal will refund any fees paid in advance for the period after termination.
6.3 Odisal will put in place with each sub-processor a written contract giving the Customer’s personal data at least the same protection as this agreement, and remains responsible to the Customer for the sub-processor’s performance.
7.1 Odisal will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data.
7.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of people and records concerned, its likely consequences, and what Odisal has done or proposes to do about it. Where not everything is known at once, Odisal will provide it in stages, without further undue delay.
7.3 Odisal will cooperate with the Customer and take reasonable steps to contain and investigate the breach and reduce its effects. Odisal will not notify the Customer’s clients or the Information Commissioner about a breach of the Customer’s data on the Customer’s behalf unless the Customer asks it to or the law requires it.
8.1 Requests from individuals. The Service lets the Customer find, correct, export and delete the personal data it holds, which is how most requests are answered. If Odisal receives a request directly from an individual about the Customer’s data, it will pass it to the Customer without undue delay and will not answer it itself, other than to say it has been passed on.
8.2 Other obligations. Taking into account the nature of the processing and the information available to it, Odisal will give the Customer reasonable help with its obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner. Odisal may charge reasonable costs for help beyond what the Service itself provides, and will say so before it does.
When the terms of service end, Odisal will, at the Customer’s choice, return the Customer’s personal data by providing a full export (if requested within 30 days), and will then delete it from the live Service within 30 days. Copies in backups are deleted as those backups expire, within about six months at most, and are not restored or used in the meantime except to recover from a failure of the Service. This clause does not apply to data Odisal is required by law to keep.
10.1 Odisal keeps the record of processing activities that Article 30(2) requires, will make available to the Customer the information reasonably necessary to demonstrate compliance with this agreement and Article 28, and will answer reasonable written questions about its processing.
10.2 Where that information is not enough, the Customer may carry out an audit, or have an independent auditor bound by confidentiality do so, on at least 30 days’ notice, during business hours, no more than once in any 12 months (unless a personal data breach or a regulator requires otherwise), and at the Customer’s own cost. The audit must not give access to any other customer’s data.
11.1 The Customer’s personal data is stored in the United Kingdom (London), with an off-site backup copy in Sweden (Stockholm), which is in the European Economic Area. Transfers from the UK to the EEA are permitted under the UK’s adequacy regulations.
11.2 Odisal will not transfer the Customer’s personal data to any other country without first giving notice under clause 6.2 and putting in place a transfer mechanism that Data Protection Law recognises.
Each party’s liability under this agreement is subject to the limits in the terms of service. Where this agreement and the terms of service conflict on the processing of personal data, this agreement prevails.
| Subject matter | Hosting the Customer’s invoicing records and producing documents from them through the Service. |
|---|---|
| Duration | For as long as the terms of service are in force, then until deletion under clause 9. |
| Nature | Storing, retrieving, displaying, calculating, formatting into documents (on screen, print and PDF), creating Client Links on the Customer’s instruction, storing the receipts the Customer attaches to an invoice’s lines and showing them through its Client Link, sending the emails the Customer asks the Service to send (invoices, quotes, reminders and receipts) and recording whether they were delivered, exporting, keeping a change history, backing up and restoring, and deleting. |
| Purpose | Providing the Service to the Customer under the terms of service. |
| Data subjects | The Customer’s clients and prospective clients, and their contact people; individuals named in the Customer’s documents (for example, people whose work is billed); the Customer’s own staff and sole traders where they appear on its documents; and the Customer’s Authorised Users, as recorded in the change history. |
| Personal data | Names; postal addresses; email addresses; any other contact details entered; the content of quotes and invoices (descriptions of work, amounts, dates, notes); receipts the Customer attaches to an invoice’s lines, as photos or PDFs, with whatever they show; records of payments received; the Customer’s own business details, which for a sole trader may include bank details and a VAT number; a history of changes to these records, including which Authorised User made each change; a record of each email sent (who to, the subject, a copy of the message, when, and whether it arrived); and the addresses that bounced or marked an email as spam. |
| Special category data | None is intended. The Service is not designed for it, and the Customer must not enter it unless it is genuinely needed on a document and it has a lawful basis. |
These describe the Service as it runs today.
| Sub-processor | What it does | Where |
|---|---|---|
| Amazon Web Services (Amazon Lightsail) | Hosts the server and its disks (Amazon Lightsail), where the Service and the Customer’s data run. | United Kingdom (London) |
| Amazon Web Services (Amazon S3) | Holds the encrypted off-site copy of the nightly backups (Amazon S3), in a separate account from the server. | Sweden (Stockholm) |
| Amazon Web Services (Simple Email Service) | Delivers the emails the Customer asks the Service to send (invoices, quotes, reminders and receipts), and reports whether each bounced or was marked as spam. | United Kingdom (London) |
Not sub-processors, for clarity: