Receivable Desk

Data processing addendum (draft)

Last updated 22 October 2026 · draft-2026-10-22

Status: draft for review, not yet executed. This page summarizes the data processing addendum (DPA) that will apply when a customer imports personal data about their own clients into Receivable Desk. The annexes (subprocessor list with confirmed regions, security measures, transfer mechanisms) are not yet confirmed and are marked pending until the operator confirms them. No signatures have been exchanged.

Roles

For workspace data you enter or import — your clients' names, billing emails and invoice details — you are the controller and Receivable Desk is your processor. For your own account data, Receivable Desk is the controller (see the Privacy notice).

Core commitments (Article 28 GDPR concepts)

  • We process customer-controlled data only on your documented instructions: to store it, compute balances and aging, generate reminder drafts, and export or delete it when you ask.
  • People with access are bound to confidentiality; access is limited to what operation of the service requires.
  • Security measures are those described on the Security page.
  • Subprocessors are listed on the Subprocessors page; changes will be announced with an opportunity to object.
  • We assist you with data-subject requests for your clients' data — access, correction, deletion, portability — through your self-service export/delete tools and the contact route below.
  • On account closure you may choose export (return) before deletion; customer-controlled data is then deleted or anonymized per the retention schedule in the Privacy notice. Minimal payment records may be retained where law requires.
  • We notify you without undue delay if a personal-data breach affects your workspace data, and we assist with your own notification obligations.
  • If we believe one of your instructions infringes data-protection law, we will tell you (unlawful-instruction notice).
  • You may audit our compliance: the executed DPA will provide for reasonable audit or independent assurance reports, with details finalized before execution.
  • You authorize the listed subprocessors generally; we will announce changes in advance and you may object — if an objection cannot be resolved, you may stop importing data and close the account.
  • International transfers: the mechanisms (such as standard contractual clauses) for each subprocessor are pending confirmation and will be listed in the annex before this DPA is executed.

Annexes (pending)

  • Annex I — processing details: subject matter, duration, nature, purposes, data categories (client names, billing emails, invoice facts), data subjects (your business clients' contacts).
  • Annex II — technical and organizational measures: to be finalized against the Security page.
  • Annex III — subprocessor list with regions and transfer safeguards: pending operator confirmation.

Contact

To review or execute a DPA, email cyle.heaney@receivabledesk.com.