Data processing agreement
Part of the terms of use. It covers the personal data you put into invoxi about your clients and others, which we process for you under GDPR Art. 28.
In force from 16 October 2026. This is a translation; the Latvian version prevails. The Latvian and Russian versions are on the same page, in the language switch.
1. Parties and roles
The customer (the company or person using invoxi) is the controller; SIA Balt Bee Group is the processor. This agreement is part of the terms of use and is accepted with them.
2. What is processed
- Subject: providing invoxi as described in the terms of use, for as long as the customer uses it.
- Purpose and nature: storing, organising, displaying, sending by e-mail, reading uploaded documents with AI, and deleting data, only to provide the service.
- Data subjects: the customer’s clients and their contact persons, the customer’s team members, payers who open invoice links, people named in uploaded documents.
- Personal data: names, contacts, addresses, registration and VAT numbers, personal codes, bank accounts, invoice contents and amounts, payment information, e-mail delivery status, and what is in uploaded documents. No special categories of data are intended; the customer should not upload them.
3. Our obligations
- We process the data only on the customer’s documented instructions, which are these terms and the customer’s use of invoxi, unless the law requires otherwise; we tell the customer if an instruction seems unlawful.
- Everyone with access is bound to confidentiality.
- We keep appropriate technical and organisational security measures (Art. 32): encryption in transit, encryption of personal codes at rest, access by role, sign-in through Google, logging and monitoring.
- We help the customer answer data subjects’ requests and meet its obligations under Art. 32–36, as far as the nature of the service allows.
- We notify the customer of a personal data breach without undue delay, and within 48 hours of becoming aware of it, with what we know.
- We make available the information needed to show compliance and allow audits once a year, on 30 days’ notice, at the customer’s cost, without access to other customers’ data.
4. Sub-processors
The customer gives general authorisation to use sub-processors. The current ones are listed by category in the privacy policy (section 5); the full list with names and locations is available on request.
We tell customers about a new sub-processor at least 30 days in advance by e-mail. A customer who objects may stop using invoxi and delete its data before the change. Sub-processors are bound by the same data protection obligations, and we remain responsible for them.
Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the standard contractual clauses.
5. End of processing
When the customer deletes a company or its account, the data is deleted from the live system at once and from backups as they rotate, within 30 days, unless the law requires us to keep it. Before deleting, the customer can download invoices and ask for a copy of all its data at support@invoxi.io.
6. Other
Liability under this agreement follows the terms of use. This agreement is governed by the laws of the Republic of Latvia. If it conflicts with the terms of use about personal data, this agreement prevails.