Data Processing Addendum

1. Roles

For personal data that LatePilot reads from your Xero organisation (mainly your customers' contact names and email addresses, and invoice details that relate to identifiable people such as sole traders), you are the controller and Ihtesham ul Haq is your processor. For your own account details (your name and email) we are the controller, as set out in the privacy notice (latepilot.com/en/privacy).

2. What we process, and why

• Subject matter and purpose: providing LatePilot, which shows your overdue invoices with statutory interest, drafts reminders, keeps the reminder history you record and creates draft invoices in Xero when you ask.
• Data subjects: contact persons of your customers, and your own users.
• Personal data: names, email addresses, invoice numbers, dates and amounts linked to them, and records of reminders you marked as sent.
• Duration: while your account exists. Invoice and contact data is read from Xero when you open the app and is not kept; reminder history and Add to Xero records are kept for about 13 months, or until you delete the organisation or your account.

3. Our commitments

• We process the data only on your documented instructions; using the app is your instruction. We will tell you if we think an instruction breaks data-protection law.
• Anyone who can access the data is bound by confidentiality.
• Security: data is hosted by Amazon Web Services in Frankfurt (EU); traffic is encrypted with TLS; the database is encrypted at rest and Xero access tokens are additionally encrypted (AES-256-GCM); access is limited to what each part of the system needs; LatePilot never sees your Xero password.
• We help you answer data-subject requests and meet your security, breach and impact-assessment obligations, as far as the data in LatePilot allows.
• We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
• When you delete an organisation or your account, we delete its data at once; database backups roll off within 35 days.
• We make available the information needed to show compliance with this addendum and allow reasonable audits, normally by written questions.

4. Sub-processors

You authorise these sub-processors. We will list any change here at least 14 days before it applies, and you may object by email; if we can't resolve it you may close your account.

• Amazon Web Services EMEA SARL (Luxembourg): hosting, database and email delivery (Amazon SES), Frankfurt region.
• ImprovMX: forwarding of email sent to our support address.

5. International transfers

Data is stored in the EU. The operator may access it from Pakistan to run and support the service. For such access the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor) and, for UK data, the UK International Data Transfer Addendum, both incorporated by reference.

6. Xero

Xero processes your data under your own agreement with Xero; it is not our sub-processor.

7. Order of precedence

This addendum forms part of the Terms of Service (latepilot.com/en/terms). If they conflict on personal data, this addendum applies.