Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between InvoiceFold ("Processor") and the Customer ("Controller") for the provision of invoicing and related services.

This DPA applies where InvoiceFold processes Personal Data on behalf of the Customer in accordance with GDPR and other applicable data protection laws.

2. Scope of Processing

InvoiceFold processes Personal Data as follows:

• Subject Matter: Provision of invoicing and payment processing services
• Duration: For the term of the service agreement
• Categories of Data: Contact information, billing details, payment data
• Data Subjects: Customer's clients and end users

3. Processor Obligations

InvoiceFold shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Delete or return Personal Data upon termination of services
• Allow and contribute to audits and inspections

4. Subprocessors

InvoiceFold may engage subprocessors to assist in providing the services. A current list of subprocessors is maintained at our Subprocessors page.

We will notify you of any changes to subprocessors and provide you the opportunity to object.

5. Security Measures

InvoiceFold implements the following security measures:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Incident response and breach notification procedures

6. Data Breach Notification

In the event of a Personal Data breach, InvoiceFold will notify the Controller without undue delay after becoming aware of the breach, and in any event within 48 hours.

7. Contact

For DPA inquiries, please contact: legal@invoicefold.com