Data Processing Agreement

This Agreement is between Invatechs Ltd (company number 13176452, Blue Tower, MediaCityUK, Salford Quays, Salford, England, M50 2ST) — "we", the processor — and you, the payed.me account holder, the controller.

It forms part of, and is incorporated into, the payed.me Terms & Conditions. It takes effect when you create an account and requires no separate signature.

1. Roles

You are the controller and we are the processor of the personal data described in Annex I ("Customer Personal Data"). Each of us complies with the data protection law applicable to us.

You confirm that you have a lawful basis for the Customer Personal Data you load, and that you have given your own data subjects whatever privacy information they are owed. We have no relationship with your clients and cannot answer to them for your records.

Nothing here makes us a joint controller. Where we process your ownaccount data we act as a controller in our own right, and the Privacy Policy governs that.

2. Our instructions

We process Customer Personal Data only on your documented instructions, including as to international transfers, unless required otherwise by law — in which case we will tell you first, unless the law forbids it.

Your instructions are this Agreement, the Terms & Conditions, and your use of the service's features. Sending an invoice instructs us to email it. Switching on payment reminders instructs us to chase it. Using the AI assistant instructs us to process the relevant records as described in clause 7.

We will tell you if we think an instruction breaches data protection law.

3. Confidentiality and security

Everyone we authorise to process Customer Personal Data is bound by a duty of confidence, and only those who need access for a specified purpose have it. We implement the technical and organisational measures described in Annex II, keep them under review, and may change them provided the level of protection is not reduced.

4. Sub-processors

You give general authorisation for us to appoint the sub-processors listed in Annex III. We impose obligations on each of them no less protective than this Agreement, and we remain fully liable to you for their performance.

If we intend to add or replace a sub-processor we will give at least30 days' notice by email or in the app. You may object on reasonable data protection grounds before it takes effect; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund for the unused period.

5. International transfers

We are established in the United Kingdom and our infrastructure is in the United Kingdom and the EEA. Transfers between the UK and the EEA rely on the adequacy decisions in force in both directions.

Where a sub-processor in Annex III processes outside the UK and EEA, the transfer is made under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, incorporated into that provider's data processing terms.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours, with the information we hold — the nature of the breach, the categories and approximate numbers affected, the likely consequences, and the measures taken.

Notifying your supervisory authority and your data subjects is your responsibility as controller, not ours. The 72-hour clock is yours, and it starts when you become aware.

7. The AI assistant

The assistant processes Customer Personal Data only when one of your users invokes it. If nobody uses it, no Customer Personal Data reaches any provider in Annex III part (c).

• Field-level restriction. Email addresses, telephone numbers, postal addresses and tax numbers are excluded before the request is built. The assistant cannot see them.
• Value-level substitution. Identifying values in the fields that are sent — customer and contact names, supplier names, colleague names, journey start and end points, and a customer's town — are replaced with stable substitutes and restored in the reply.
• Routing restriction. The gateway is instructed to use only providers that do not retain request content and do not train on it, and only those named in Annex III part (c).
• Confirmation gate. The assistant cannot create, change or delete a record without a user confirming that specific action.

8. Assisting you

Taking account of the nature of the processing and the information available to us, we will assist you with data subject requests, and with security, breach notification and impact assessments. The service lets you read, correct, export and delete Customer Personal Data yourself, which will usually be sufficient. If a data subject contacts us directly we will not respond substantively but will refer them to you without undue delay.

9. Deletion and return

On termination you may export Customer Personal Data through the service, and we recommend you do so before closing your account. Within30 days of termination we will delete it, except where we are required by law to keep it. Backups age out on their own cycle and are not individually purged; while they exist they remain protected by this Agreement.

10. Audits

We will make available the information reasonably necessary to demonstrate compliance with Article 28, and allow and contribute to audits by you or an auditor you mandate. Audits must be on reasonable notice, no more than once in any twelve-month period unless required by a supervisory authority or following a breach, during business hours, subject to confidentiality, and conducted so as not to disrupt the service or compromise other customers' data. You bear your own costs and ours, unless the audit identifies a material breach of this Agreement by us.

11. Precedence and changes

Where this Agreement conflicts with the Terms & Conditions on the processing of Customer Personal Data, this Agreement prevails. We may update it to reflect a change in law, in the service or in our sub-processors, on 30 days' notice. Liability under this Agreement is subject to the limits in the Terms & Conditions.

Annex I — Details of the processing

Subject matter: provision of the payed.me invoicing service.Duration: for as long as your account is open, plus the deletion period in clause 9. Frequency: continuous.

Nature and purpose: storing, organising, retrieving, rendering to PDF, transmitting by email, and — where you use the assistant — submitting to a language model, so that you can manage clients, invoices, quotes, receipts, credit notes, expenses, mileage, time, tasks, inventory and purchase requests, and be paid.

Categories of data subject:

• Your clients, and the individual contacts at them
• People you invite to your team
• Suppliers and vendors you record against expenses and purchase requests
• Any individual you name in a free-text field

Types of personal data:

Special category data: none is requested and none should be entered. The service is not designed for it.

Annex II — Technical and organisational measures

Access control. Passwords hashed with bcrypt and never stored in readable form. Session tokens are opaque rather than self-describing. Role-based access separates users, team members and administrators, and every data access is scoped to the owning account at the query layer.

Encryption in transit. TLS between browsers and the service, and between the service and its database, object storage and third-party providers. The database connection is encrypted and certificate-authenticatedagainst the provider's certificate authority, which is pinned explicitly rather than trusted by default.

Encryption at rest. Document attachments are stored with AES-256 server-side encryption, object versioning enabled and all public access blocked, reached with a least-privilege credential restricted to a single bucket.

Network exposure. The database, cache and message broker publish no ports to the internet and require credentials. The application binds to a single named interface rather than to all of them.

Application controls. Input is validated against typed schemas at the API boundary, public endpoints are rate-limited, and payment confirmation is driven by signature-verified webhooks rather than browser redirects, idempotent against replay.

AI-specific controls. A field allow-list, value pseudonymisation with a secret held only by us, an explicit provider allow-list, a no-retention routing instruction, and a confirmation gate on every write. See clause 7.

Organisational. Access to production is restricted to authorised personnel, changes are version-controlled and reviewed, and database schema changes are applied deliberately rather than automatically on deploy.

Annex III — Authorised sub-processors

(a) Infrastructure — always engaged

(b) Service delivery — engaged when the relevant feature is used

(c) AI assistant — engaged only when a user invokes the assistant

The gateway is configured with an explicit allow-list, so a request cannot reach any inference provider outside this table.