Data Processing Agreement (DPA)
Last updated 11 June 2026
The PDF includes a signature block for both parties. Sign it and email it to privacy@d20invoice.com for a countersigned copy.
The processor terms that apply when D20 processes personal data in your invoices on your behalf.
1. Scope and roles
This Data Processing Agreement forms part of the Terms of Service between D20 Invoice AI ("D20", "we", "us") ("Processor") and the Customer ("Controller"). It applies to personal data contained in invoices, emails, supplier records and accounting data that the Customer submits to the Service ("Customer Personal Data"). It is drafted to satisfy Article 28 UK GDPR and, where applicable, EU GDPR.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the D20 invoice coding, approval and accounting-sync service |
| Duration | The term of the Customer's subscription plus the 30-day export window |
| Nature and purpose | Storage, OCR/AI extraction, categorisation, duplicate detection, approval workflow, reporting and transmission to accounting systems chosen by the Customer |
| Categories of data subjects | Customer's staff; staff and contacts of the Customer's suppliers; individuals named on invoices |
| Categories of personal data | Names, business contact details, job titles, bank details printed on invoices, VAT and company numbers, amounts and payment status, sign-in and audit metadata |
| Special category data | None intended; the Customer must not submit special-category or criminal-offence data |
3. Processor obligations
- Process Customer Personal Data only on the Controller's documented instructions (the Service configuration and these terms), unless required by law, in which case we tell you first where permitted.
- Ensure staff with access are bound by confidentiality.
- Implement the technical and organisational measures described on the Security page.
- Assist the Controller with data-subject requests, security, breach notification and DPIAs, taking into account the nature of processing.
- Notify the Controller of a personal-data breach without undue delay and within 72 hours of becoming aware.
- Delete or return Customer Personal Data at the end of the Service as described in the Privacy Policy, unless law requires retention.
- Make available the information needed to demonstrate compliance and allow audits (see section 6).
4. Sub-processors
The Controller gives general authorisation to the sub-processors below. We will give at least 30 days' notice by email to workspace admins before adding or replacing a sub-processor; the Controller may object on reasonable data-protection grounds, in which case either party may terminate the affected part of the Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Emergent (hosting & AI gateway) | Application hosting, managed database, routing of AI extraction requests | EU / US |
| OpenAI | AI extraction and ledger-code suggestions from invoice documents | US |
| Stripe | Subscription billing and payments | US / EU |
| Resend | Transactional email and inbound forwarding address | EU (inbound) / US |
| Google (Gmail API) | Only if the Customer connects a Gmail mailbox | US / EU |
| Xero, FreshBooks, Zoho, Sage | Only the accounting system(s) the Customer connects | Per provider |
5. International transfers
Transfers outside the UK are made under the UK International Data Transfer Addendum to the EU SCCs, an adequacy regulation, or another valid mechanism. We will provide copies of the relevant terms on request.
6. Audit
Once in any 12-month period, on 30 days' notice, the Controller may audit our compliance with this DPA by written questionnaire and review of our security documentation; an on-site audit may be requested where a regulator requires it or following a breach, at the Controller's cost and subject to confidentiality.
7. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service. If there is a conflict between this DPA and the Terms, this DPA prevails for data-protection matters.
8. Signing
This DPA is accepted electronically by the Customer when creating a workspace. Customers who require a countersigned copy can email privacy@d20invoice.com and we will return a signed PDF within 5 business days.