Data Processing Addendum

Last updated 25 October 2026 · Nexora Futureworks Pty Ltd, Berwick, Victoria, Australia

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Nexora Futureworks Pty Ltd ("Processor") and the customer that agreed to them ("Customer"). It applies automatically when InvoiceTurbo processes Customer Personal Data. No signature is needed; if you need a countersigned copy, email privacy@invoiceturbo.com.

1. Definitions

Data Protection Laws: all privacy laws that apply to the processing, including the UK GDPR and Data Protection Act 2018, the EU GDPR (including as applied in Ireland), PIPEDA (Canada), the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, and US state laws such as the CCPA/CPRA.
Customer Personal Data: personal data that Customer or its users submit to the Service, or that the Service collects for Customer, about Customer's clients, contacts and team members.
Subprocessor: a third party engaged by Processor to process Customer Personal Data.
Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

Terms such as controller, processor, data subject and processing have the meanings given in the GDPR. "Service provider" has the meaning given in the CCPA.

2. Roles

Customer is the controller (or a processor acting for its own controller) and Processor is a processor of Customer Personal Data. For the CCPA, Processor is a service provider. Processor is an independent controller of account, billing and security data about Customer's users, as described in the Privacy Policy.

3. Processing instructions

Processor will process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's use of the Service are those instructions.
Processor will tell Customer if it believes an instruction breaks Data Protection Laws, unless the law prohibits it.
Customer is responsible for having a lawful basis and giving any notices needed for the processing, and for the accuracy of the data it submits.

4. CCPA commitments

Processor will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with personal data from other sources except as the CCPA allows. Processor will tell Customer if it can no longer meet these obligations.

5. Confidentiality

Processor will ensure that anyone it authorises to process Customer Personal Data is bound by confidentiality obligations.

6. Security

Processor will maintain the technical and organisational measures in Annex 2, and may update them as long as overall protection is not reduced.

7. Subprocessors

Customer gives general authorisation for Processor to engage Subprocessors. The current list is at /legal/subprocessors.
Processor will give at least 30 days' notice of a new Subprocessor by updating that page and, on request, by email.
Customer may object on reasonable data-protection grounds within that notice period. The parties will discuss it in good faith; if no resolution is found, Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.
Processor will impose data-protection terms on each Subprocessor that are no less protective than this DPA and remains liable for their performance.

8. Data subject requests

Taking into account the nature of the processing, Processor will help Customer respond to requests from data subjects, mainly through the Service's own features (editing, exporting and deleting records). If Processor receives a request directly, it will refer the person to Customer and won't respond itself unless required by law.

9. Security incidents

Processor will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe the incident, the data and data subjects affected, likely consequences and the steps taken, as that information becomes available. Processor will take reasonable steps to contain and remedy it.

10. Assistance

Processor will give Customer reasonable help with data protection impact assessments and consultations with supervisory authorities about the Service, to the extent the information is available to Processor.

11. Deletion and return

Customer can export its data from the Service at any time. When Customer deletes its business, Processor will delete Customer Personal Data 30 days after the request, and from backups within the following [35] days, except where the law requires it to keep records (such as sent invoices kept for tax purposes), which Processor will keep protected and use only for that purpose.

12. Audits

Processor will make available information reasonably needed to show compliance with this DPA, including summaries of its security practices and third-party certifications where available. If that is not enough to meet a legal requirement, Customer may audit once a year with 30 days' notice, during business hours, at its own cost, under confidentiality, and without accessing other customers' data.

13. International transfers

For transfers of EU personal data to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with the following choices: clause 7 (docking) applies; clause 9 option 2 (general authorisation) with the notice period in section 7; clause 11 optional wording does not apply; clauses 17 and 18 are governed by and resolved in the courts of Ireland. Annexes I–III are completed by Annexes 1–3 of this DPA.
For UK personal data, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) applies, with Tables 1–3 completed by this DPA and either party able to end it under Table 4.
Where Processor is certified under the EU-US Data Privacy Framework and its UK extension, transfers may rely on that instead.
For other jurisdictions, Processor will protect transferred data as Data Protection Laws require.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow them. If this DPA conflicts with the Terms, this DPA wins for data protection matters; if the SCCs conflict with this DPA, the SCCs win.

15. Term

This DPA lasts as long as Processor processes Customer Personal Data.

16. Governing law

This DPA is governed by the law that governs the Terms (Victoria, Australia), except where Data Protection Laws or the SCCs require another law to apply.

Annex 1: Details of processing

Data exporter	Customer, as identified in its InvoiceTurbo account. Role: controller.
Data importer	Nexora Futureworks Pty Ltd, Berwick, Victoria, Australia. Contact: privacy@invoiceturbo.com. Role: processor.
Subject matter and purpose	Providing the Service: creating, sending, sealing and tracking invoices, quotes and receipts; collecting payments; reminders; reporting; support.
Data subjects	Customer's clients and their contacts; Customer's team members; other people Customer adds.
Categories of data	Names, email addresses, phone numbers, postal addresses, tax IDs, document contents, payment status and partial card details, document activity (sent, opened, paid), receipt and attachment images, IP addresses of document viewers.
Sensitive data	None intended. Customer should not submit special category data.
Frequency	Continuous, for the duration of the Terms.
Retention	As set out in section 11.
Competent supervisory authority	Processor has no establishment in the EU or UK. Where EU or UK data protection law applies, the supervisory authority determined under clause 13 of the SCCs or the UK Addendum.

Annex 2: Security measures

Encryption of data in transit (TLS 1.2+) and at rest (AWS Lightsail managed database and storage, S3 server-side encryption).
Passwords stored with a strong one-way hash; optional TOTP two-factor authentication; session listing and revocation.
Role-based permissions for team members (owner, admin, staff, accountant); tenant isolation between businesses.
Audit and security event logs for sensitive actions, such as sign-ins, deletions and exports.
Short-lived, single-purpose access codes for clients viewing protected documents.
Digital signatures (Ed25519) on sent documents, with signing keys held in a secret manager.
Card and bank details handled by Stripe (PCI DSS Level 1) and never stored by Processor.
Rate limiting, input validation and dependency updates; least-privilege access for staff; regular backups with tested restores.
Email bounce and complaint suppression to prevent misdirected messages.

Annex 3: Subprocessors

As listed at /legal/subprocessors on the date the processing takes place.