Privacy policy
How we collect, use and protect personal data under UK GDPR and the Data Protection Act 2018. Last updated: [date].
Draft for review. Have this checked by a solicitor before publishing, replace every item in [square brackets], then delete this box.
Who we are
[Registered company name], company no. [00000000], registered office [address], is the data controller for our customers' account data. We are registered with the Information Commissioner's Office (ICO), registration number [ZA000000].
For the information you enter about your own clients (names, addresses, quotes, invoices), you are the controller and we are your processor. We only use it to provide the service to you, under our data processing terms.
What we collect
- Account details: your name, email, phone, business name and address, and VAT and company numbers.
- Billing details: your plan and payment history. Card and bank details are handled by our payment providers and are not stored by us.
- Your content: clients, price lists, quotes, invoices, signatures and payments.
- Security data: IP address, browser and log-in times.
- Problem reports: what you tell us when you report a problem. Automatic error reports are only sent if you allow them, and contain the page, time, browser and error message, not your clients' or invoice details.
- Referrals: who referred whom, so both of you receive the reward.
- Cookies: see our cookie policy.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service, billing and support | Contract |
| Security, fraud prevention, backups and fixing faults | Legitimate interests |
| Automatic error reports | Consent, which you can withdraw in Settings at any time |
| Renewal reminders and important service notices | Contract and legal obligation |
| Keeping invoices and billing records for HMRC | Legal obligation |
| Product news and offers | Consent, only if you opt in |
Where your data is stored
Our app, database and backups are hosted in the United Kingdom. See GDPR and UK hosting for our providers and where each one processes data.
Who we share it with
Only the service providers we need to run Invoice Universe, each under a written data processing agreement. We don't sell personal data.
Who at Invoice Universe can see your data
Your company data is confidential to your company. No one, including Invoice Universe staff, can see it unless you authorise it. If our support team needs to look at your account to help you, we email you for permission; access is read-only, time-limited and can be withdrawn. Every visit is logged and shown to you in Settings, Data and privacy. Our IT developer can see technical logs and problem reports but not your clients, quotes, invoices or bank details.
How long we keep it
- While your account is open.
- For 90 days after you close it, read-only, so you can download your data. Then we delete it.
- Billing records about your subscription: 6 years, for HMRC.
- Backups roll off after 30 days (monthly copies after 12 months).
- Problem reports: 2 years.
Security
Data is encrypted in transit (HTTPS) and backups are encrypted at rest. Staff accounts use two-step login. If a breach is likely to put you at risk, we will tell you and, where required, the ICO within 72 hours.
Your rights
You can ask to see, correct, delete or move your data, restrict or object to how we use it, and withdraw consent. Email mail@invoiceuniverse.com. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.