DRAFT — pending legal review, not yet in effect. This document is a working template and is not a binding agreement.

Data Processing Addendum

Effective date: [to be set on finalization]

This DPA forms part of the Terms between [Legal entity] (“Processor”) and the customer (“Controller”) and applies where we process personal data on your behalf.

1. Roles & scope

You are the Controller of the personal data in the invoices and accounts you process; we are the Processor, acting on your documented instructions (your use of the Service).

2. Processing details

Subject matter: invoice capture, AI extraction, approval routing, and accounting sync.
Data subjects: your staff and your vendors’ contacts named on invoices.
Data types: business contact details, invoice amounts, and related financial data.

3. Sub-processors

You authorize the sub-processors listed here. We will give notice of changes and remain responsible for their performance.

4. Security

We maintain technical and organizational measures appropriate to the risk, including tenant isolation, encryption of secrets at rest, access controls, and MFA.

5. Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data.

6. Assistance

We will reasonably assist you with data-subject requests and with your security, DPIA, and regulator obligations.

7. Deletion

On termination, we will delete or return your personal data except where retention is required by law.

8. Governing law

This DPA is governed by [Governing law]. Contact: invoxaisupport@gmail.com.