Invoice Bridge data processing addendum

Parties, roles, and instructions

This addendum is between Robert Collie, operating as Fortylights, and the organization accepting the service terms. For buyer and staff information processed on that organization's instructions, the organization is the controller or other responsible business and Fortylights is its processor or service provider, as applicable. Actual processing and law determine the roles.

The terms, authorized connections, selected settings, and documented support requests describe the organization's instructions. We process information only to provide and support the integration, follow lawful instructions, and meet legal requirements. We will report an instruction we believe violates applicable data protection law unless prohibited from doing so.

Processing details and restrictions

The service prepares and reconciles invoices and paid orders, matches contacts, logs confirmed payments and refunds, handles approvals and goods references, assigns follow-up work, and answers data requests. Data subjects include buyers, contacts, and authorized staff. Data can include names, email, phone, delivery addresses, order and invoice lines, payment-result references, CRM ownership identifiers, approval decisions, and optional tax certificates. Do not submit card details or unrelated sensitive records.

We do not sell this information, use it for unrelated advertising or model training, or combine clients' information for unrelated purposes. We do not retain, use, or disclose it outside the permitted relationship except as allowed or required by law. Where applicable, we will meet service-provider or contractor duties, assist verification, and notify the organization if we can no longer meet them.

Security and confidentiality

We will maintain reasonable safeguards appropriate to the processing, described in the Security Overview. Personnel must have appropriate confidentiality obligations and only the access their work requires. We remain responsible for our own obligations. A disclaimer cannot remove a duty the law makes mandatory.

Subprocessors and transfers

The Subprocessor Register identifies current service providers and roles. Appropriate written terms must cover delegated processing, and we remain responsible for delegated obligations. We will give at least 30 days' notice of a proposed new subprocessor for this service, except an urgent protective replacement, when notice follows as soon as practical. Promptly send a reasonable data-protection objection. If it cannot be resolved, the organization may end the affected service and request review of its unused paid period.

We will not claim that a location requirement or transfer safeguard is satisfied without verification. Restricted EEA, UK, or other international transfers require an applicable approved safeguard, completed party and processing details, and any required assessment before processing begins. Those instruments control a conflict about the transfer. Where required, we will arrange the applicable transfer instrument before processing begins.

Requests and incidents

Taking account of the service and applicable law, we will assist with access, correction, deletion, security, impact-assessment, and regulator requests. Buyers may be directed to the merchant controlling the sale. We verify authority before disclosure and do not act beyond instructions unless legally required.

We will notify the organization without undue delay after becoming aware of a personal-data breach affecting its data, provide available information reasonably needed for its response, and cooperate in containment and recovery. Initial information may be supplemented. Notice does not decide legal responsibility. Each party must meet its own mandatory reporting duties.

Return, deletion, and recovery

Use available export and redaction tools or contact rob@fortylights.com. App-managed deletion removes affected active data and app-managed backups as described in the Privacy Notice. Full store erasure also removes the workspace's acceptance records from the app registry. Shopify and Pipedrive source records remain under the organization's control. Verified resolved invoice and order details are subject to the 90-day app retention policy. Open or unverified work remains available. Minimal order, deal, and payment references remain for reconciliation and duplicate prevention.

DreamHost does not include automated backups with its unmanaged VPS. Any infrastructure recovery copies DreamHost maintains follow its service and data-processing terms. We will assist the organization with applicable deletion requests for those copies. Deleted data must not become active again through a restore. Completed deletion requests must be reapplied before normal processing resumes. Legally required retention must be limited to the necessary information, purpose, and duration with restricted access.

Compliance and priority

We will provide reasonable evidence of compliance and cooperate with a proportionate review, protecting confidential information and other clients' data. A regulator's lawful requirements take priority over ordinary review limits. No terms limit a data subject's or regulator's rights that cannot legally be limited.

This addendum controls conflicts about processing personal data. Mandatory transfer instruments control their transfers. Liability allocation in the service terms applies only where lawful and cannot override mandatory duties. Contact: rob@fortylights.com.