InvoiceCow

Data Processing Addendum

Last updated: 2026-10-23

This Data Processing Addendum ("DPA") is part of the InvoiceCow Terms of Service (the "Agreement") between Latent Software LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("InvoiceCow," "we" or "us"), and the merchant that has accepted the Agreement ("Customer" or "you"). Words that this DPA does not define have the meaning in the Agreement.

This DPA is based on the Common Paper DPA Standard Terms, Version 1.1, used and adapted under CC BY 4.0.

How this DPA takes effect. This DPA is part of the Agreement and takes effect automatically, for every Customer whose use of the Service involves the processing of personal data that Data Protection Laws protect. No signature is needed on either side: when Customer accepts the Agreement and uses the Service, both parties are deemed to have executed this DPA and the Standard Contractual Clauses that it incorporates. Customer may also accept this DPA in the settings of the Service, and the Service records that acceptance. We do not sign customer-specific copies or third-party templates, and we do not negotiate custom data processing terms. One consistent DPA for all customers is part of what keeps the Service free.

1. Definitions

"Data Protection Laws" means all laws that apply to the processing of personal data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and the comprehensive privacy laws of the US states, including the California Consumer Privacy Act as amended ("CCPA") (together, "US State Privacy Laws"), in each case as amended.

"Customer Personal Data" means the personal data that we process for Customer in providing the Service, as Annex I.B describes: mainly the personal data of Buyers and of other people in Customer's Sales and Documents. It does not include the data for which we are a controller, which the Privacy Policy governs: the data of Customer's account and users; the security events of the Portal; the records of a Buyer's acceptance of the Buyer Terms and of each statement that a Buyer confirms under them; and the specific records that we need to establish, exercise or defend our own legal claims, for as long as that need lasts.

"Archive" has the meaning in Section 2 of the Agreement, and "Archive Period" the meaning in Section 10.1 of the Agreement (ten years from the issue of each Document).

"SCCs" means the standard contractual clauses for the transfer of personal data to third countries in the annex to European Commission Implementing Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

"Subprocessor" means a third party that we engage to process Customer Personal Data.

Terms such as "controller", "processor", "processing", "data subject", "personal data" and "personal data breach" have the meanings in the GDPR, and "business", "service provider", "sell" and "share" have the meanings in the CCPA.

2. Roles and scope

  1. Customer is the controller of Customer Personal Data (or, where Customer acts for its own clients, their processor). We are Customer's processor (or subprocessor) and, under US State Privacy Laws, Customer's service provider.
  2. Each party complies with its own obligations under Data Protection Laws.
  3. This DPA applies for as long as we process Customer Personal Data, including during the Archive Period after the Agreement ends.

3. Instructions

  1. We process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless Union or Member State law to which we are subject requires otherwise. In that case, we will tell Customer of that legal requirement before we process, unless that law prohibits it on important grounds of public interest. We assess a request or a demand under any other law under Data Protection Laws and, where they apply, Clauses 14 to 16 of the SCCs; its existence alone does not authorize processing that those rules do not allow.
  2. The Agreement, this DPA and Customer's use and configuration of the Service are Customer's complete documented instructions. Other instructions need our prior written agreement. The documented instructions include the instructions to:
    • (a) read Sales and their data through Customer's Connections and imports;
    • (b) issue, number, render and store Documents in the name of Customer's Issuers, including the automatic Documents of Section 7.7 of the Agreement;
    • (c) run the Portal for Customer's Buyers, including sending single-use links to Buyers, recording Buyer Details and checking VAT numbers against the European Commission's VIES service;
    • (d) keep the Archive for the Archive Period, including after the Agreement ends, unless Customer instructs us under Section 9 to delete or return it earlier;
    • (e) send Documents to the recipients that Customer chooses, and, if Customer turns on the AccountingYear sync for an Issuer, to Customer's AccountingYear organization, where the AccountingYear terms govern their further processing; and
    • (f) produce statistics that identify no person and no customer, to operate, secure and improve the Service.
  3. We will tell Customer promptly if, in our opinion, an instruction infringes Data Protection Laws. We are not obliged to review Customer's instructions for legality.
  4. Customer must not deliberately give the Service special categories of personal data (Article 9 GDPR) or personal data about criminal convictions and offences (Article 10 GDPR), and gives government identifiers of individuals (such as a personal tax number) only where a law requires them on a Document. The Service is not designed for such data. A product name or a description in a Sale can reveal such data incidentally (for example, the name of a health product); Customer is responsible for having an applicable condition under Article 9 or 10 GDPR for it, and we protect it with the same measures as all Customer Personal Data (Annex II).
  5. Customer represents and warrants, and is responsible for, the lawfulness of its instructions, having a lawful basis to give us Customer Personal Data and to have it processed as the Agreement describes, the notices that it owes to Buyers and to other data subjects (including that it uses a service provider to issue invoices and run the Portal), any consent that it needs, and the accuracy of the Customer Personal Data that it or its Connections give us.
  6. Customer's indemnity. Section 18 of the Agreement applies to claims of data subjects, supervisory authorities and other third parties that arise from Customer's breach of Data Protection Laws or of this DPA, from Customer's instructions, or from the lack of a lawful basis or a notice that Customer owes. Neither this Section nor Section 18 of the Agreement covers the part of the responsibility for damage that Article 82 GDPR or Clause 12 of the SCCs places on us, or a fine whose reimbursement the law prohibits; Article 82(5) GDPR and Clause 12(f) of the SCCs govern recourse for that part.

4. Confidentiality

We make sure that each person whom we authorize to process Customer Personal Data is bound by a duty of confidentiality, under contract or under law.

5. Security

  1. We implement and maintain the technical and organisational measures in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects (Article 32 GDPR).
  2. We may update those measures from time to time, provided that the updates do not materially reduce the overall level of protection.

6. Subprocessors

  1. Customer gives us general written authorisation to engage Subprocessors.
  2. The current list of Subprocessors is published at invoicecow.com/legal/subprocessors, with each Subprocessor's legal entity, purpose and processing location.
  3. At least 15 business days before a new or replacement Subprocessor begins to process Customer Personal Data, we will tell Customer by email to the address of its account, and update that page. The notice names the Subprocessor, the processing, the location and the safeguards.
  4. Customer may object on reasonable data protection grounds within 10 business days after the notice, by writing to [email protected]. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may end the Agreement before the Subprocessor begins, and instruct us under Section 9 to return and delete the Archive; we will not let the new Subprocessor process Customer's data while that instruction is carried out within a reasonable time. That is Customer's remedy for the objection.
  5. We impose on each Subprocessor, by written contract, data protection obligations that give at least the same level of protection as this DPA, including the SCCs or another transfer mechanism of Chapter V GDPR where a transfer requires one, and we remain fully liable to Customer for the performance of each Subprocessor's obligations, subject to Section 13.

7. Assistance

  1. Data subject requests. Taking into account the nature of the processing, we assist Customer by appropriate technical and organisational measures, insofar as possible, to answer requests from data subjects to exercise their rights (Chapter III GDPR). Customer can read, export and, before Release, correct Buyer Details in the Service; after Release, a correction takes the form of the correction method of the Service (by default, a correction credit note and a replacement invoice; Documents that Stripe or a platform issued follow that issuer's process). If a data subject asks us directly about Customer Personal Data, we will refer the person to Customer, and we will not answer on the substance unless Customer instructs us or the law requires it.
  2. Security, breach notification, impact assessments and prior consultation. Taking into account the nature of the processing and the information available to us, we assist Customer to meet its obligations under Articles 32 to 36 GDPR, including reasonable assistance with its data protection impact assessments (Article 35) and prior consultations (Article 36), insofar as they concern the Service.
  3. Costs of assistance. The self-service features of the Service (reading, exporting and correcting data) are free. For other assistance, Customer reimburses our reasonable costs, except where Data Protection Laws or the SCCs do not allow a charge, or where our breach of this DPA made the assistance necessary.

8. Personal data breach

We notify Customer without undue delay after we become aware of a personal data breach that affects Customer Personal Data. The notice describes, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide updates as more information becomes available. Our notice is not an acknowledgement of fault or liability. Customer decides on, and makes, the notifications that it owes as controller to supervisory authorities and to data subjects (Articles 33 and 34 GDPR), and bears their cost, subject to Section 13.1.

9. Deletion and return

  1. The Archive. At Customer's choice, we return (by export) and delete the Archive. Unless Customer chooses otherwise, Customer instructs us to keep the Archive for the Archive Period, including after the Agreement ends, as an archive service, and to delete it afterwards. Customer may at any time instruct us in writing at [email protected] to delete the Archive earlier; we will then delete it within a reasonable time. Customer remains responsible for keeping the records that its law requires.
  2. Other Customer Personal Data. Customer may export its data before the Agreement ends. When the Agreement ends, we delete Customer Personal Data that is not part of the Archive (for example, Sales without a Document) within a reasonable time. An export never excuses the deletion of our remaining copies.
  3. Exceptions. We delete remaining copies unless Union or Member State law requires their storage. Where local law prohibits the return or the deletion of Customer Personal Data within the meaning of Clause 8.5 of the SCCs, we apply that Clause together with the safeguards, the notices and the suspension and termination rules of the SCCs, keep protecting the data under this DPA, and process it only to the extent and for as long as that law requires. This Section does not authorize any retention that Data Protection Laws prohibit. Where we need a specific record to establish, exercise or defend a legal claim of our own, we keep only that record, only for that purpose and for as long as that need lasts, as a controller under the Privacy Policy. Deleted data expires from encrypted backups in their ordinary rotation (Annex II). Data in Customer's AccountingYear organization is governed by the AccountingYear terms.
  4. If the Service is discontinued as a whole, Section 23.2 of the Agreement applies: we continue to keep the Archive under Section 9.1 for the rest of each Archive Period.

10. Audits and information

  1. We make available to Customer the information reasonably needed to demonstrate compliance with Article 28 GDPR, including this DPA, Annex II and the Subprocessor list.
  2. We do not currently hold a SOC 2 report or an ISO 27001 certification. Annex II is kept at a level of detail that is intended to substitute for such reports.
  3. Where that information is not sufficient to demonstrate compliance, Customer (or an independent auditor that Customer mandates, that is not our competitor, and that is bound by confidentiality) may audit us, limited to the information and systems relevant to Customer Personal Data. A routine audit takes place no more than once in any 12 months, on at least 30 days' written notice, during business hours, without undue disruption to the Service, and under confidentiality. Customer bears its own costs and reimburses our reasonable costs of supporting the audit.
  4. These scheduling terms do not restrict an audit that a competent supervisory authority requires, or that is reasonably required by evidence of non-compliance, by a material change of the processing, or by a personal data breach of Customer Personal Data; such an audit may take place on reasonable shorter notice. No charge or condition in this Section prevents Customer from exercising its audit rights under Article 28(3)(h) GDPR or Clause 8.9 of the SCCs.

11. International transfers

  1. Customer acknowledges that we process Customer Personal Data in the United States, and authorises transfers to the locations in the Subprocessor list.
  2. For transfers of Customer Personal Data that the GDPR governs, the parties enter into the SCCs, which are incorporated into this DPA by reference:
    • Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. Customer is the "data exporter"; we are the "data importer".
    • Clause 7 (docking clause): not included.
    • Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in Section 6.3 of this DPA.
    • Clause 11(a): the optional wording on an independent dispute resolution body is not included.
    • Clause 13 and Annex I.C: the competent supervisory authority is set out in Annex I.C.
    • Clause 17: Option 1; the SCCs are governed by the law of Ireland.
    • Clause 18(b): disputes are resolved before the courts of Ireland.
    • Annexes I and II of the SCCs are Annexes I and II of this DPA. Annex III of the SCCs is the Subprocessor list in Section 6.2.
    • The parties are deemed to have signed the SCCs, with their Annexes, when this DPA takes effect.
  3. For transfers from the United Kingdom, the UK Addendum is incorporated by reference and deemed executed. Tables 1 to 3 of the UK Addendum are completed with the information in the SCCs and the Annexes of this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.
  4. For transfers from Switzerland, the SCCs apply as adapted for the FADP: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority under Annex I.C; references to the GDPR are references to the FADP; and the term "Member State" does not exclude data subjects in Switzerland from enforcing their rights in their place of habitual residence.
  5. We are not certified under the EU-U.S. Data Privacy Framework. The SCCs are the transfer mechanism of this DPA. Where a Subprocessor is certified, that certification is in addition to the contractual safeguards, not a substitute for them.

12. US State Privacy Laws

Where US State Privacy Laws apply to Customer Personal Data, we:

  1. process it only for the business purposes in Section 3.2, which are the limited and specified purposes of the processing;
  2. do not sell or share it, and do not retain, use or disclose it for any other purpose, including any commercial purpose other than providing the Service, or outside the direct business relationship between Customer and us;
  3. do not combine it with personal data that we receive from or on behalf of another person, or that we collect from our own interaction with a consumer, except as US State Privacy Laws permit for a service provider;
  4. comply with the obligations that US State Privacy Laws place on service providers and processors, and give the same level of privacy protection that they require;
  5. tell Customer if we decide that we can no longer meet these obligations; and
  6. allow Customer, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

We certify that we understand and will comply with these restrictions.

13. Liability and precedence

  1. Our liability under or in connection with this DPA and the SCCs is subject to the exclusions and limitations of liability in the Agreement (Sections 19 and 20), and it counts against the one aggregate cap of Section 20.3 of the Agreement, to the extent that the SCCs and Data Protection Laws allow. Nothing in the Agreement limits (a) a party's liability to data subjects under Clause 12 of the SCCs, (b) a party's liability to the other party under Clause 12 of the SCCs for a breach of the SCCs, or a right of recourse under that Clause, or (c) any liability that cannot be limited under Data Protection Laws. The limitations of the Agreement protect us; they do not limit Customer's liability or its indemnity.
  2. If this DPA conflicts with the Agreement about the processing of Customer Personal Data, this DPA prevails. If the SCCs conflict with this DPA or the Agreement, the SCCs prevail.
  3. This DPA does not change the parties' rights and obligations about data for which we are a controller, which the Privacy Policy describes.
  4. Section 21 of the Agreement governs disputes under this DPA, except a dispute that Clause 18 of the SCCs requires the courts named in Section 11.2 to decide.

Annex I. Description of the processing

A. List of parties

Data exporter: the Customer named in the Agreement (its name, address and contact details are those of its InvoiceCow account). Role: controller (or processor, as Section 2.1 says). Activities: use of the InvoiceCow invoicing service for its Sales.

Data importer: Latent Software LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Contact: [email protected]. Role: processor. Activities: provision of the InvoiceCow service described in the Agreement.

B. Description of the transfer

  • Categories of data subjects: Customer's Buyers who are individuals; contact persons and other people who act for Buyers that are organizations; other people named in Customer's Sales and Documents; Customer's own personnel, where their data appears in a Document.
  • Categories of personal data: names and company names; email addresses; billing addresses and countries; phone numbers where a Connection gives them; tax and VAT identifiers (including personal tax numbers where a law requires them on a Document) and the results and dates of their VIES checks; purchase order numbers and cost centres; purchase data (amounts, currencies, dates, products, line items, tax charged, refunds and disputes); identifiers of processors and platforms (such as customer and payment ids); the event data that Connections send, which can include limited card details (card brand, last four digits, expiry month and year, issuing country), but not full card numbers or security codes, which the Service does not request; the content and the revisions of Documents; the time, the IP address and the browser of Portal actions (changes, previews and downloads); and the language preference of a Buyer.
  • Sensitive data: none is intended (Section 3.4). Product names or descriptions may reveal special categories of data incidentally. Restrictions and safeguards: access only for Customer's account and our authorized personnel under Annex II.4, encryption in transit and at rest of files and backups (Annex II.1 and II.2), no use beyond Customer's instructions, and no disclosure except under Section 3.2 or as the law requires.
  • Frequency of the transfer: continuous, for the term of the Agreement and the Archive Period.
  • Nature of the processing: retrieval from Connections and imports; storage; issue, numbering, rendering and validation of Documents; operation of the Portal; email delivery of single-use links and of Documents that Customer sends; VIES checks; export; and, on Customer's instruction, the AccountingYear sync.
  • Purpose: the provision of the Service to Customer, on Customer's instructions.
  • Retention: the Archive for the Archive Period (Section 9.1); other Customer Personal Data for the term of the Agreement, and then as Section 9.2 says; database backups are scheduled for deletion after 30 days, with a storage rule that expires them after 60 days (Annex II.6).
  • Transfers to Subprocessors: as the Subprocessor list sets out, for hosting, network delivery and protection, email delivery, file storage and backups.

C. Competent supervisory authority

The supervisory authority of the EEA Member State in which the data exporter is established (for an exporter established in Germany, the competent authority of the relevant Land). Where the data exporter is not established in the EEA but the GDPR applies to it under Article 3(2), the supervisory authority of the Member State in which its representative under Article 27(1) GDPR is established, or, if it has none, the supervisory authority of a Member State in which the data subjects concerned are located. For UK transfers, the Information Commissioner. For Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex II. Technical and organisational measures

  1. Encryption in transit. All traffic to the Service is encrypted with TLS, and HTTPS is enforced, with certificates provisioned and renewed automatically.
  2. Encryption at rest. The file store and the database backups are stored with server-side encryption (AES-256) at the storage provider. API keys and webhook secrets of Connections are encrypted in the database.
  3. Credentials. Account passwords are stored only as salted adaptive hashes. Connections use API keys with the least permissions that the Service needs (for Stripe, restricted keys), each scoped to one Connection and revocable by Customer.
  4. Access control and tenant isolation. Every Document, file and download is authorized against Customer's account and Issuer on each request. The Portal uses single-use links that are bound to an email address and an Issuer, expire, and are stored only as hashes; it limits the rate of requests and does not reveal the purchases of other Buyers. Administrative access is restricted to named operators: to the servers over key-based SSH, and to the administrative web pages through an administrator account. Service credentials follow least privilege.
  5. Integrity. Each revision of a Document is an unchangeable record with a stored content hash, and each released revision is served from its stored bytes. Issue, revision, release, replacement, correction, import and sync events are logged with the actor, the time and a payload hash. Webhooks from Connections are accepted only with a valid signature and inside a replay window.
  6. Availability and backups. The database is backed up nightly to an off-site store with server-side encryption. Backups are scheduled for deletion after 30 days, with a storage rule that expires them after 60 days, and their freshness is monitored.
  7. Development security. Changes ship through version control with an automated test suite and continuous integration, including dependency and static security audits. Production secrets are stored encrypted and never committed in plaintext.
  8. Incident response. Service health and backup freshness are checked by a health endpoint that reports each failed check. Personal data breaches are handled under Section 8.
  9. Minimisation. The Service does not request full card numbers or security codes, and Customer must not submit them (Privacy Policy, Section 3.1). Product analytics contain no Buyer personal data.
  10. Subprocessor safeguards. Each Subprocessor processes Customer Personal Data under a written agreement as Section 6.5 requires.
  11. Assistance. Customer can read and export Customer Personal Data in the Service, and correct Buyer Details as Section 7.1 describes. We assist as Section 7 says.

Annex III. List of Subprocessors

The authorised Subprocessors, with their legal entities, purposes and locations, are published at invoicecow.com/legal/subprocessors, which is incorporated into this DPA by reference. Section 6 governs updates and objections.