Data Processing Agreement

Who is responsible for what

When you add a client to VanBill — their name, address, email, phone number — you decide why that information is collected and what happens to it. In data protection terms you are the controller and we are the processor. We hold that information and act on it because you told us to, and for no other reason.

Separately, we are the controller of your own account details — your name, email and subscription. That part is covered by our Privacy Policy, not by this agreement.

What this covers

• Why we process it: to provide the invoicing service you signed up for — storing your client records and using them to produce quotes, invoices, PDFs and the emails or links you choose to send.
• How long for: for as long as your account is open, and then as described under “When you leave” below.
• What kind of information: the names, addresses, email addresses, phone numbers and VAT numbers of your clients, along with the job and payment details you record against them.
• Whose information: your clients, and the people you deal with at them.
• Your rights: you decide what goes in, you can correct or remove any of it at any time from your account, and you can export all of it as CSV whenever you want.

Only what you tell us to do

We process your clients' personal data only on your documented instructions. Using the product is itself an instruction: adding a client, sending an invoice, or deleting a record all tell us what to do. If you want to instruct us to do something else, email support@vanbill.co.uk so there is a written record of it. The only exception is where UK law requires us to act differently, and if that happens we will tell you unless the law forbids it.

Who can see it

Anyone who can access your clients' data is bound to keep it confidential. Today that is a very short list, because VanBill is run by one person. If that changes, the same duty applies to anyone who joins, whether employed, contracted or temporary.

Keeping it safe

We take appropriate technical and organisational measures to keep your clients' data secure, as Article 32 requires. In practice:

• Every business's data is separated at the database level by row level security, so one account physically cannot read another's. We test this by attempting it, automatically, before releases.
• Encrypted in transit and at rest.
• Invoice PDFs are held in private storage that is not publicly readable.
• Access to a business's data requires that business's own login. Two-factor authentication is available and we recommend it.
• A record is kept of who changed what on financial documents, so changes can be traced.

The companies we use

By using VanBill you give us general authorisation to use the sub-processors below. Each one is under contractual data protection obligations equivalent to those in this agreement, and we remain responsible to you for what they do.

• Supabase — stores the database and files. London region.
• Vercel — runs the application, so requests pass through it.
• Resend — delivers any invoice or quote you choose to send by email, which includes your client's name and address.

Stripe is not on this list on purpose: it handles your own subscription payment and never receives your clients' data.

If we intend to add or replace a sub-processor we will tell you by email at least 30 days beforehand, and you may object. If you object and we cannot offer a reasonable alternative, you may cancel and take your data with you, without penalty.

Your database and files stay in London. Vercel and Resend are US companies, so some processing happens outside the UK, covered by the UK International Data Transfer Addendum in our contracts with them.

When one of your clients asks

If one of your clients asks to see, correct, delete or receive a copy of their data, that request is yours to answer — they are your customer, not ours. The product is built so you can do it yourself: client records are editable and deletable, and everything exports to CSV. If a request needs something the product cannot do, tell us and we will help. If a client contacts us directly, we will not act on it ourselves — we will point them to you and let you know.

If something goes wrong

We will help you meet your own obligations, so far as the nature of the processing and the information we hold allow. If there is a personal data breach affecting your clients' data, we will tell you without undue delay once we become aware of it, with what we know: what happened, who is affected, and what we are doing about it. That is so you can meet your own 72-hour deadline for reporting to the ICO. We will also help with data protection impact assessments and any consultation with the ICO that follows.

When you leave

Delete your business from Settings and everything goes immediately — clients, quotes, invoices, payments and PDFs. There is no waiting period and no copy kept back. Export what you need first; the delete screen puts those downloads in front of you before it will let you continue, because afterwards there is nothing to fetch.

One honest exception: routine encrypted backups may still hold a copy for a short period after deletion. Those are not readable in normal operation, are never used to restore an account you deleted, and roll off on their normal cycle within 7 days.

Checking we do what we say

You can ask us to demonstrate that we are meeting the obligations in this agreement, and we will give you the information needed to show it. If you need a formal audit or inspection, whether your own or by an auditor you appoint, email us and we will make reasonable arrangements — at a sensible time, without disrupting other customers, and no more than once a year unless a regulator or an actual incident requires otherwise.

Changes to this agreement

If we change this agreement we will notify you by email or in the app before it takes effect. Questions: support@vanbill.co.uk.