Invoicing. In the palm of your hand.

Data processing agreement

Draft for solicitor review. This is a starting draft and has not been checked by a solicitor. It is not yet in force.

This data processing agreement (DPA) covers the personal information your business keeps in Invola about its own customers and other people. It forms part of our terms and applies automatically when your business accepts them. It is written to meet Article 28 of the UK GDPR.

1. Who this is between

  • You: the business that has an Invola account. For this information, you are the controller: you decide what to keep and why.
  • We: [FILL IN: company name] Ltd, trading as Invola, a company registered in England and Wales (company number [FILL IN]), registered office [FILL IN]. For this information, we are your processor: we handle it only to provide Invola to you.

Information about you and your team as our customers (accounts, billing, support) is not covered here. We are the controller for that, and our privacy notice covers it.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. What we process

The people

  • your customers, including landlords, tenants, occupiers and site contacts;
  • people who send enquiries through your website or email your business;
  • people who sign quotes, certificates and site reports;
  • other people named in your records, such as suppliers or other trades;
  • visitors to your Invola business website.

The information

  • names, addresses, site addresses, phone numbers and email addresses;
  • sites, appliances, readings, gas rates and appliance history;
  • jobs, bookings, notes and job messages, including emails to and from your customers and their attachments;
  • photos, signatures, and the name, time and IP address recorded when someone signs or accepts a document;
  • quotes, invoices, statements, payments and payment reminders, including payments matched by a bank feed you connect;
  • gas, heating, plumbing and other certificates and site reports;
  • website enquiries and the photos sent with them;
  • on your business website, a cookie recording the visitor's cookie choice and, if you switch it on and the visitor accepts, Google Analytics.

Invola is not designed for special category data (for example health information). Only record it where you truly need it for the work, such as a note that an occupier is vulnerable, and you have a lawful condition for it under data protection law.

What we do with it, and for how long

We store, organise, encrypt, back up, show, send and delete the information so that you can use Invola's features. This includes sending your emails, receiving and filing your customers' replies, making PDFs, running the reminders you switch on, publishing your website and the customer pages for signing and paying, checking outgoing emails for signs of payment fraud, and applying sending limits. We do this for as long as your account exists, and then as set out in section 9.

3. Your instructions

We only process this information on your documented instructions. These terms, this DPA, the way you set up and use Invola, and anything you ask us in writing (for example in a support message) are your instructions. The exception is where the law requires us to process it. In that case we will tell you first, unless the law forbids it.

If we think an instruction breaks data protection law, we will tell you.

We will not use your customers' information for our own purposes. We will not sell it or use it for marketing, and we will not use it to train artificial intelligence.

4. Your responsibilities

  • You must have a lawful basis for the information you keep in Invola and for contacting your customers, including for any reminders and emails you send.
  • You must give your customers the privacy information the law requires, including that you use service providers such as Invola.
  • You must keep your account secure and decide which team members can see what.
  • If you switch on Google Analytics on your website, it only loads after a visitor accepts the banner, and the choice is remembered for 6 months. You are responsible for your website's cookie and privacy wording and for your own agreement with Google.
  • If you connect a Starling bank feed, that is your choice under your agreement with Starling.
  • If you share a calendar feed with Google or Apple Calendar, or share links through WhatsApp, the information then goes to those services at your choice.

5. Our people

Everyone we allow to process this information is bound to keep it confidential. Our own admin tools do not show your customers, jobs or documents. We only access them where you ask us to (for example to help with a support request), to restore your data after a fault, or where the law requires it.

6. Security

We keep the information secure with appropriate technical and organisational measures, including:

  • a separate database, database logins and encryption key for each business;
  • encryption of customer names, addresses and messages in the database;
  • HTTPS for every connection;
  • private file storage that can only be reached through signed links;
  • website enquiries sealed with your business's own key until the app files them;
  • nightly encrypted backups to a separate provider, which cannot be changed or deleted during their retention period, and regular checks that they can be restored;
  • passwords stored as hashes, optional two-step sign-in, a list of signed-in devices and alerts when a new device signs in;
  • roles and permissions for your team;
  • an audit log of what was deleted, restored and changed, by whom and when;
  • the 48-hour wait before changed bank details take effect, and the fraud guard, which holds outgoing emails that look like bank detail fraud until the owner checks them;
  • spam checks on website contact forms (Cloudflare Turnstile) and sending limits to protect email delivery.

7. Sub-processors

You give us general permission to use sub-processors. We currently use:

  • Hetzner Online GmbH, Germany: servers, databases and file storage, in Germany.
  • Postmark (ActiveCampaign, LLC), USA: sending your emails and receiving your customers' replies.
  • Cloudflare, Inc., USA: Turnstile spam checks on your website's contact form (the visitor's browser and IP address), and DNS.
  • Backblaze, Inc., USA, EU Central region: encrypted backups. The backups are encrypted before they leave our servers, and Backblaze cannot read them.

[DECIDE: confirm this list at launch.]

Each sub-processor is bound by a written contract with data protection terms at least as protective as this DPA. We remain responsible to you for what they do. We will tell you at least [DECIDE: 30] days before we add or replace a sub-processor, by email to the owner or a notice in the app. If you have a reasonable data protection objection, tell us. If we cannot resolve it, you can cancel and we will refund any period you have paid for and not used.

Stripe takes payments from you for Invola itself. It does not process your customers' information, so it is not a sub-processor under this DPA.

8. International transfers

Your data is stored in Germany. Where a sub-processor handles it outside the UK and the European Economic Area, we make sure a safeguard allowed by UK data protection law is in place: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. [DECIDE: confirm the safeguard for each provider.]

9. Deleting or returning the information

  • While your account is open: you control deletion. A deleted item goes to the Recycle bin for 30 days, then it is deleted for good. Each item shows the date it will be deleted, and it can be restored until then. Sent invoices, receipts and credit notes and issued certificates that must stay on record are never deleted this way. The owner can also delete an item for good sooner. If a customer asks you to erase their data, the owner can do it from the audit log. Their personal details are removed, and the money figures stay so that you can meet your tax duties.
  • Your audit log: it is part of your records, so no time limit deletes it. It is kept for the life of your account, including each automatic deletion from the Recycle bin, and deleted with your account.
  • Getting your data out: the owner can download everything at any time with Export My Data, including when the account is read-only. It gives you spreadsheets, a PDF of every document and certificate, and your photos, in a password-protected zip file. The download is deleted after 7 days.
  • When your account closes: when you ask us to close your account, we delete its database and all its stored files (photos, PDFs, uploads and exports) 30 days after you confirm. Encrypted database backups are deleted within 200 days. Stored files deleted from Invola are removed from our encrypted copy of stored files 30 days later.
  • We keep information after this only where the law requires us to.

Some information is deleted automatically sooner:

  • emails held by the fraud guard or sending limits, after they have been sent or have failed: 30 days; emails the owner rejected: 365 days;
  • email for a suspended account: 30 days, and filed if the account reopens before then;
  • records of attachments sent, used to spot one file being sent to many customers: 1 day;
  • sealed website enquiry files no longer needed: 3 days, or 30 days if the enquiry could not be filed;
  • website pictures uploaded but never used: 30 days;
  • records of team booking reminders sent: 60 days.

10. Helping you

  • Requests from people. Invola gives you tools to answer requests from your customers: search, export, correction, the recycle bin and erasure from the audit log. If a request comes to us, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.
  • Personal data breaches. We will tell you without undue delay, and within [DECIDE: 48] hours, after we become aware of a personal data breach affecting your data. We will give you the information you need to decide whether to report it to the ICO within 72 hours and whether to tell the people affected, and we will update you as we learn more.
  • Other help. We will give you reasonable help with data protection impact assessments, consulting the ICO, and your security duties, taking into account what we do and the information we have. [DECIDE: whether we can charge for help beyond what is reasonable.]

11. Information and audits

We will give you the information you reasonably need to show that we meet this DPA, starting with a written description of our security measures. If that is not enough, or a regulator requires it, we will allow and help with an audit by you or an independent auditor bound by confidentiality, at a time we agree, with at least 30 days' notice, and no more than once a year unless there has been a breach. Each side pays its own costs. [DECIDE: who pays for audits.]

12. Liability

Each of us is responsible for our own failure to meet data protection law and this DPA. The limits of liability in our terms apply to this DPA, except where the law does not allow it. [DECIDE with solicitor: whether a separate, higher cap applies to data protection claims.]

13. How long this lasts

This DPA lasts as long as we process personal data for your business, including during the 30 days after closure and while backups still exist. If this DPA and the terms disagree about personal data, this DPA wins. It is governed by the law of England and Wales.

We may update this DPA to reflect changes in the law, the ICO's guidance or our sub-processors, as set out in section 7 and in our terms. We will not reduce the protection it gives your data without your agreement.

Version draft-2026-10