Data Processing Addendum
Effective 3 November 2026
This addendum forms part of the Terms of Service between Orrivelo [to be completed before launch] ("we", the processor) and the business using Orrivelo ("you", the controller). It sets out the terms required by Article 28 of the UK GDPR for personal data we process on your behalf.
1. Details of the processing
| Subject matter | Providing Orrivelo: storing invoices and customer records, drafting and sending payment reminders you approve, tracking delivery and recording replies. |
|---|---|
| Duration | For as long as you use Orrivelo, until your workspace is deleted. |
| Data subjects | Your customers, and their staff or contacts. |
| Types of personal data | Names, email addresses, phone numbers and other contact details; invoice and payment details; reminder emails; replies and notes; email delivery events. |
| Special category data | None is required. Please don't add special category or criminal offence data to Orrivelo. |
2. Our obligations
- We process your personal data only on your documented instructions, which are given by these terms and by how you use and configure Orrivelo, unless the law requires otherwise (in which case we'll tell you first, unless the law forbids it).
- Everyone we authorise to process the data is bound by confidentiality.
- We apply appropriate technical and organisational security measures, including encryption in transit, encryption of sensitive values at rest, separation of each business's data with automated testing, access controls, rate limiting and audit logging.
- We tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations.
- We help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation. Many requests can be handled directly using Orrivelo's export, edit, suppression and delete features.
- We make available the information reasonably necessary to show we comply with this addendum, and allow for and contribute to reasonable audits by you or an auditor you appoint, with reasonable notice and no more than once a year unless required by a regulator or following a breach.
- When you delete your workspace, we delete your personal data straight away from the live system; it is removed from backups within 30 days. You can export your data before deleting.
- We tell you immediately if we believe an instruction from you breaks data protection law.
3. Sub-processors
You give general authorisation for us to use sub-processors. Those currently used to process your customer data are listed below. We impose data protection terms on each that are at least as protective as this addendum, and we remain responsible for them. We'll give you at least 30 days' notice by email before adding or replacing a sub-processor; if you object on reasonable data protection grounds and we can't address it, you may cancel and we'll refund any prepaid fees for the remaining period.
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Resend | Sending reminder, invite and account emails; receiving replies; delivery tracking | United States | Recipient email addresses, email content, delivery events |
| Anthropic | Writing reminder drafts with AI (only when AI drafts are switched on) | United States | Invoice facts: business and customer names, contact name, invoice number, amounts, dates, payment link, email signature. Never email addresses |
| Hosting and database provider [to be completed before launch] | Running the application and storing its database | UK or EU region (planned) | All data held in Orrivelo |
Anthropic is used only when AI drafts are switched on.
4. International transfers
Where a sub-processor processes your data outside the UK, we make sure the transfer is covered by UK adequacy regulations (including the UK–US data bridge for certified providers) or by appropriate safeguards such as the UK International Data Transfer Addendum.
5. Your obligations
- You're responsible for having a lawful basis to process your customers' data and to contact them about money they owe, and for giving them any privacy information the law requires.
- You make sure the data you add is accurate, and you deal with requests and complaints from your customers, with our help where needed.
- Orrivelo honours unsubscribes and stop requests by suppressing the address; don't work around a suppression without a proper reason.
6. General
If this addendum conflicts with the Terms of Service, this addendum takes priority for the processing of personal data. Our liability under this addendum is subject to the limits in the Terms. Questions: orrivelo@outlook.com.