Data processing terms
Last updated 14 October 2026 · 2 minute readWhen your business, practice or clients keep books in BillingEase, those books contain personal data about other people: customers, suppliers and employees. These terms set out how we process that data on your behalf, as UK GDPR Article 28 and Sri Lanka’s PDPA require.
Draft, to be reviewed by a lawyer. This document isn’t in force yet and will change before BillingEase launches.
On this page · 6 sections
In short
- You (the business, or the practice for its clients) decide what personal data goes in; we process it only on your instructions.
- Everyone at BillingEase who can reach it is bound to confidentiality.
- We tell you without undue delay if a breach affects your data.
- At the end, the data is returned or deleted, apart from what the law makes us keep.
1. Roles
The business using BillingEase is the controller of the personal data in its books. BillingEase is the processor. When an accountant, practice or tax practitioner works in a client’s books, they act for that client, under their own engagement with the client.
2. What we process
- People: your customers, suppliers, employees and contacts, and your own staff who use BillingEase.
- Data: names, contact details, addresses, tax references, amounts owed and paid, bank details printed on invoices, and, for payroll, salary, NIC or National Insurance number, EPF numbers and deductions.
- Purpose: keeping the books, issuing documents, calculating payroll and producing summaries, for as long as the account is open.
3. What we commit to
- Process personal data only on your documented instructions, which are these terms and the way you use the app.
- Make sure everyone with access is bound to confidentiality.
- Keep appropriate security measures in place, including separating each business’s data and an append-only ledger.
- Help you answer requests from people exercising their rights, and with security, breach notifications and impact assessments.
- Tell you without undue delay after becoming aware of a personal data breach affecting your data.
- Return or delete your data when the service ends, unless the law requires us to keep it.
- Make available the information you need to show compliance, and allow reasonable audits.
4. Sub-processors
We use other providers for parts of the service, under written contracts with the same protections. The list is still being finalised before launch; currently it covers:
- Hosting and storage: to be decided (a UK or EU region for UK businesses; a PDPA-compliant choice for Sri Lankan businesses).
- Email delivery: a transactional email provider that sends the invoices and reminders you ask us to send.
- AI (Ask and Capture): Google Cloud (Gemini on Vertex AI), which receives the question and the relevant parts of your books when you use Ask, and the photo or PDF when you send a receipt or bill to be read. It doesn’t use them to train its models.
We’ll give notice before adding or replacing a sub-processor, so you can object.
5. International transfers
Where personal data leaves the UK, we’ll use a safeguard UK law recognises, such as the International Data Transfer Agreement or the UK Addendum, with a transfer risk assessment. Transfers from Sri Lanka will follow the PDPA’s cross-border rules. The hosting decision will be reflected here.