Data Processing Addendum

1. Roles

For Customer Personal Data (personal data about your clients, their contacts and other individuals that you or your clients put into the Service), you are the controller and Blync is the processor. Each of us will comply with the data protection laws that apply to us.

2. Details of the processing

• Subject matter and purpose: providing the Service under the Terms, including drafting, storing, generating and sending invoices, quotes, credit notes, reminders, expenses and related records, and hosting client document pages.
• Duration: for as long as you use the Service, plus the deletion period in section 9.
• Nature of processing: collection, storage, organisation, retrieval, AI-assisted analysis and drafting, transmission by email, display, and deletion.
• Data subjects: your clients and prospective clients, their employees and contacts, your suppliers and payees, and other individuals named in your content.
• Categories of data: names, business names, email addresses, phone numbers, postal addresses, tax and registration numbers, invoice and payment details, bank details shown on documents, and messages or files submitted on client pages.
• Special categories: none are required. You agree not to submit special categories of data or data about criminal convictions.

3. Your instructions

Blync will process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use of the Service's features, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). We will tell you if we believe an instruction breaks data protection law. You are responsible for having a lawful basis and giving any notices required for the data you add.

4. Confidentiality and security

Anyone at Blync authorised to access Customer Personal Data is bound by confidentiality. Blync maintains appropriate technical and organisational measures, including:

• encryption of data in transit (TLS) and at rest by our hosting providers;
• access restricted to authorised personnel who need it, with strong authentication;
• tenant separation so each workspace's data is only accessible to its members;
• hashed passwords, email verification codes, rate limiting and abuse prevention;
• logging and monitoring, and regular backups through our database provider.

5. Subprocessors

You give Blync general authorisation to use the subprocessors listed on our Subprocessors page. Blync imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance.

We will update that page at least 14 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds, tell us within that period; if we can't address the objection, you may stop using the affected part of the Service or close your account.

6. International transfers

Customer Personal Data may be processed in the United States and other countries where Blync or its subprocessors operate. Where a transfer requires safeguards, the parties agree that the EU Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable), with the UK International Data Transfer Addendum where relevant, are incorporated into this DPA by reference, and Blync will rely on equivalent mechanisms for transfers from the UAE and other countries.

7. Assisting you

Taking into account the nature of the processing, Blync will help you respond to requests from individuals exercising their rights (you can access, correct and delete most data directly in the app), and with data protection impact assessments and consultations with authorities where required. If we receive a request directly from one of your data subjects, we will refer them to you.

8. Personal data breaches

Blync will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information reasonably available to help you meet your own notification obligations, and take reasonable steps to contain and remedy the breach.

9. Deletion and return

You can export your documents at any time while your account is open. When your account is closed, Blync will delete or anonymise Customer Personal Data within 30 days, unless the law requires us to keep it. Backup copies are overwritten on our providers' rolling schedule and are protected in the meantime.

10. Audits

On reasonable written request, and no more than once a year unless a breach or authority requires it, Blync will make available the information necessary to demonstrate compliance with this DPA, such as answers to security questionnaires and our subprocessors' certifications. Any on-site audit must be agreed in advance, at your cost, and subject to confidentiality.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the law allows. If this DPA conflicts with the Terms on data protection, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.