Paysoon

Data Processing Addendum

Effective October 15, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Controller") and Paysoon (the "Processor") and applies when we process personal data on your behalf that is subject to the GDPR, the UK GDPR or similar data protection laws.

1. Details of processing

  • Subject matter and purpose: sending invoice payment reminders and providing the related client invoice page and activity tracking, as instructed by you through the Service.
  • Duration: for as long as you use the Service, plus the retention periods in our Privacy Policy.
  • Data subjects: your clients and their contact persons.
  • Personal data: names, email addresses, invoice details, messages you write, and interactions with reminders and invoice pages.
  • Special categories: none. You agree not to add them.

2. Processor obligations

  • Process personal data only on your documented instructions (your use of the Service and its settings), unless the law requires otherwise.
  • Ensure everyone authorized to process the data is bound by confidentiality.
  • Implement appropriate technical and organizational security measures (described in our Privacy Policy), including encryption in transit, access control, hashed credentials and backups.
  • Assist you, taking into account the nature of processing, with data subject requests, security, breach notifications and data protection impact assessments.
  • Notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your data.
  • At the end of the Service, delete your personal data (you can export it first from Settings), except where the law requires us to keep it. Backups roll off within 14 days.
  • Make available the information reasonably necessary to demonstrate compliance with this DPA.

3. Sub-processors

You authorize us to use sub-processors for email delivery (Resend), payments (Stripe) and hosting and infrastructure. We impose data protection obligations on them equivalent to this DPA and remain responsible for them. We'll give notice of new sub-processors by updating our Privacy Policy, and you may object on reasonable grounds by contacting us; if we can't resolve your objection, you may terminate the affected Service.

4. International transfers

Where personal data is transferred outside the EEA or UK to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum are incorporated by reference.

5. Your obligations

You confirm you have a lawful basis to provide the personal data and to have reminders sent, and that your instructions comply with applicable law.

6. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service.

Contact

Paysoon. Email: MelloDaMonke193@gmail.com.