Last Updated: 04-24-2026
Effective Date: 04-24-2026
Version: 2026.1
This Data Processing Agreement ("DPA") forms part of the InvoiceCast Terms of Service between 9344-2481 Québec Inc. ("InvoiceCast," "we," "us," or "Processor") and the customer using the InvoiceCast Service ("Customer," "you," or "Controller").
This DPA applies when Customer uses InvoiceCast to process personal information relating to Customer’s clients, contractors, invoice recipients, employees, representatives, or other third parties.
Customer is the controller of Customer Personal Data.
InvoiceCast acts as a processor when it processes Customer Personal Data on behalf of Customer through the Service.
Customer determines the purposes and means of processing Customer Personal Data. InvoiceCast processes Customer Personal Data only to provide, secure, maintain, support, and improve the Service in accordance with Customer’s instructions, the Terms of Service, this DPA, and applicable law.
For personal information relating directly to InvoiceCast’s own relationship with Customer, including account registration, billing, security, support, and legal compliance, InvoiceCast acts as an independent controller as described in the Privacy Policy.
"Applicable Data Protection Laws" means all privacy and data protection laws applicable to the processing of Customer Personal Data, including, where applicable, Quebec’s Act respecting the protection of personal information in the private sector, PIPEDA, GDPR, UK GDPR, and applicable U.S. state privacy laws.
"Customer Personal Data" means personal information or personal data that Customer submits, uploads, stores, or otherwise processes through the Service and for which Customer acts as controller.
"Data Subject" means an identified or identifiable individual to whom Customer Personal Data relates.
"Processing" has the meaning given under Applicable Data Protection Laws and includes collection, storage, use, access, transmission, disclosure, deletion, and anonymization.
"Sub-processor" means a third-party service provider engaged by InvoiceCast to process Customer Personal Data on behalf of InvoiceCast.
InvoiceCast processes Customer Personal Data for the following purposes:
InvoiceCast will not process Customer Personal Data for advertising, resale, third-party marketing, or AI/model training.
Customer Personal Data may include:
Customer Personal Data may relate to:
Customer instructs InvoiceCast to process Customer Personal Data as necessary to provide the Service and as otherwise described in the Terms of Service, Privacy Policy, and this DPA.
InvoiceCast will not process Customer Personal Data outside those instructions unless required by applicable law. If InvoiceCast is legally required to process Customer Personal Data for another purpose, InvoiceCast will notify Customer unless legally prohibited from doing so.
Customer is responsible for ensuring that:
InvoiceCast will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or are subject to appropriate statutory confidentiality duties.
InvoiceCast will limit access to Customer Personal Data to personnel and contractors who need access to provide, secure, maintain, or support the Service.
InvoiceCast will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
These measures include, as applicable:
InvoiceCast may update its security measures from time to time, provided such updates do not materially reduce the overall security of the Service.
Customer authorizes InvoiceCast to use Sub-processors to provide the Service.
InvoiceCast’s current Sub-processors include:
| Sub-processor | Purpose |
|---|---|
| Amazon Web Services | Cloud infrastructure (EC2), storage (S3) , backups (S3), transactional email (SES) |
| Vultr | Cloud infrastructure, hosting, storage, logs |
| Google Cloud | Storage and backups |
| Brevo | Transactional email delivery |
| Cloudflare | CDN, DNS, DDoS protection, security, network routing |
| Stripe | Subscription billing and payment processing |
InvoiceCast will ensure that each Sub-processor is bound by written obligations that provide at least substantially similar protection for Customer Personal Data as this DPA.
InvoiceCast remains responsible for its Sub-processors’ processing of Customer Personal Data to the extent required by Applicable Data Protection Laws.
InvoiceCast may add or replace Sub-processors from time to time. InvoiceCast will update its Privacy Policy and/or Sub-processor list and provide 30-day prior notice of new/replacement sub-processors.
Customer may object to new/replacement sub-processors by contacting InvoiceCast within the notice period. InvoiceCast will consider reasonable objections in good faith and may offer mitigation measures, which may include:
If InvoiceCast cannot accommodate a reasonable objection, Customer may terminate the Service without penalty within the notice period.
Customer Personal Data is stored at rest in data centers located in the United States.
Certain limited processing of Customer Personal Data and related technical or transactional metadata may occur outside the United States through InvoiceCast's Sub-processors. Such processing is limited to:
These activities do not change the primary storage location of Customer Personal Data.
Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a third country (including the United States), InvoiceCast relies on the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, or another lawful transfer mechanism recognized under Applicable Data Protection Laws. InvoiceCast is not currently self-certified under the EU-US Data Privacy Framework.
InvoiceCast has carried out a Transfer Impact Assessment in accordance with EDPB Recommendations 01/2020. A redacted summary is available on request to [email protected].
The country of import for each Sub-processor is published in the current Sub-processor list (Privacy Policy §5.2 and DPA §9). Customer will be notified of changes to Sub-processors in accordance with §9.
InvoiceCast will provide reasonable assistance to Customer in responding to Data Subject requests, including requests for access, correction, deletion, portability, restriction, or objection.
Where possible, Customer should respond to such requests using the self-service tools available in the Service.
If InvoiceCast receives a request directly from a Data Subject relating to Customer Personal Data, InvoiceCast may refer the Data Subject to Customer unless legally required to respond directly.
Taking into account the nature of the processing and information available to InvoiceCast, InvoiceCast will provide reasonable assistance to Customer with:
InvoiceCast may charge reasonable fees for assistance that is outside normal support or requires significant technical, legal, or operational work.
InvoiceCast will notify Customer without undue delay and, where feasible, within 24 hours after confirming a security incident involving Customer Personal Data that presents a real risk of significant harm or otherwise requires notification under Applicable Data Protection Laws.
The notice will include, where available:
InvoiceCast’s notification of a security incident is not an admission of fault or liability.
Customer is responsible for determining whether it must notify affected Data Subjects, regulators, or other third parties, except where InvoiceCast has a direct legal obligation to do so.
During the term of the Service, Customer may export Customer Personal Data using InvoiceCast’s self-service export tools.
Upon account deletion or termination, InvoiceCast will delete or anonymize Customer Personal Data in accordance with the Terms of Service and Privacy Policy.
InvoiceCast may retain limited data where required or permitted by law, including for tax, accounting, security, fraud prevention, dispute resolution, legal compliance, backup, or audit purposes.
Backups are deleted on a rolling schedule. Customer Personal Data may remain in encrypted backups for a limited period after deletion until those backups expire.
Upon reasonable written request, InvoiceCast will provide Customer with information reasonably necessary to demonstrate compliance with this DPA.
Customer may not conduct security testing, penetration testing, vulnerability scanning, or audits of InvoiceCast systems without prior written approval.
Where an audit is legally required, the parties will agree on reasonable scope, timing, confidentiality, and security restrictions. InvoiceCast may satisfy audit obligations by providing security summaries, policy excerpts, third-party certifications, questionnaires, or equivalent documentation.
InvoiceCast will not use Customer Personal Data, Customer Content, invoice data, client data, contractor data, or usage-derived data to train, develop, improve, fine-tune, or evaluate artificial intelligence models, machine learning systems, large language models, or similar technologies.
This restriction applies whether the AI system is operated by InvoiceCast or by a third party.
InvoiceCast may use aggregated, anonymized, non-personal usage statistics to improve the Service, provided such data cannot identify Customer, any Data Subject, or any Customer Content.
If InvoiceCast receives a legally binding request from a government authority, court, regulator, or law enforcement agency seeking Customer Personal Data, InvoiceCast will notify Customer unless legally prohibited from doing so.
InvoiceCast will disclose only the information it reasonably believes is legally required.
Customer is responsible for:
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except to the extent such limitations are prohibited by Applicable Data Protection Laws.
Nothing in this DPA limits liability that cannot be limited under applicable law.
If there is a conflict between this DPA and the Terms of Service, this DPA controls with respect to the processing of Customer Personal Data.
If there is a conflict between this DPA and the Privacy Policy, this DPA controls with respect to Customer Personal Data processed by InvoiceCast as processor, and the Privacy Policy controls with respect to personal information processed by InvoiceCast as controller.
This DPA remains in effect for as long as InvoiceCast processes Customer Personal Data on behalf of Customer.
Sections that by their nature should survive termination will survive, including confidentiality, deletion, security, liability, and audit-related provisions.
Questions about this DPA may be sent to:
InvoiceCast
9344-2481 Québec Inc.
Email: [email protected]
Privacy Officer: [email protected]