Data processing agreement

When you use Remitide you give us personal data that is neither yours nor ours: your customers’ names, tax IDs (NIF), email addresses and payment history. Those people have not given us their consent and probably don’t know we exist.

The GDPR (the EU General Data Protection Regulation) governs this situation precisely: you are the controller, because you decide what that data is used for; we are the processor, because we process it on your behalf. Article 28.3 requires the relationship to be governed by a contract with specific content. This is that contract.

You accept this agreement when you create your account, together with the terms of service. It is binding on both parties. If you need a signed copy for your compliance records, ask for one at soporte@remitide.com.

• Subject matter. The processing of the personal data needed for you to keep track of your invoices and send payment reminders to your customers.
• Duration. For as long as your account is active. When you close it, the section on returning data applies.
• Nature and purpose. Collection, storage, organisation, consultation, use to create and send payment reminders, receipt of the replies your customers send through the link in the reminders, comparison of your portfolio with official insolvency publications if your plan includes insolvency monitoring, access by your accounting firm (gestoría) if you authorise it, retention as a record of what was sent, and erasure.
• Categories of data subjects. Your customers: individuals, self-employed people, and the contact people at the businesses you invoice.
• Types of data. Identification data (name, company name, tax ID (NIF)), contact data (email address, phone number, postal address) and financial data relating to their business relationship with you (invoices, amounts, due dates, payments, non-payments, notes and communications, including the replies they send through the link in the reminders).
• What is not processed. Special categories of data under Article 9 (health, beliefs, trade union membership and the rest) are neither requested nor needed. Nor is data about criminal offences. Don’t upload it.

As processor, Blixma Capital Group, S.L. undertakes to:

• Process the data only on your instructions. The documented instructions are this agreement and what you set up in the application. The data is not used for any purpose of our own: not for advertising, not for shared statistics and not to train artificial intelligence models.
• Keep it confidential, including after the relationship ends, and ensure that everyone authorised to process it is bound by the same commitment.
• Apply the security measures required by Article 32, which are described below.
• Help you with your customers’ rights. If one of them exercises the right of access, rectification, erasure or objection, the application lets you handle it yourself directly. If the request reaches us, we pass it on to you without delay and don’t answer it on our own initiative.
• Help you comply with Articles 32 to 36: security, breach notification and impact assessments, to the extent of the information available to us.
• Tell you about a breach without undue delay as soon as we become aware of it, with what we know, so that you can meet your 72-hour deadline with the Spanish Data Protection Agency (AEPD).
• Warn you if we believe an instruction of yours is unlawful, instead of silently carrying it out.
• Return or delete the data at the end, as you choose, and delete any copies unless a law requires them to be kept.
• Make available the information needed to demonstrate compliance, and allow audits on the terms set out below.

This agreement has two sides, and yours is the one most providers leave in the small print. As controller, it is up to you to:

• Have a legal basis for processing your customers’ data and for writing to them. Chasing payment of your own invoice normally relies on the performance of your contract with them or on your legitimate interest, but that is for you to assess, as you know the relationship.
• Have informed your customers about the processing of their data, as required by Articles 13 and 14, including the existence of a processor.
• Make sure the data you upload is accurate and up to date. A mistyped email address on a customer record sends a debt reminder to an unrelated third party, and that is a data breach.
• Deal with your customers’ requests about their data and with the replies you receive to reminders.
• Not use the service to chase debts owed to others, or debts assigned to or bought by you.
• Decide the recipients, content, tone and frequency of reminders, including the texts suggested by the AI and any automatic sending you switch on: these are your instructions, and the lawfulness of what is communicated to each person is your responsibility.

What is in place, with specific names instead of generic wording. The full description is on the security page.

• Isolation between customers. Each company is separated by row-level security in the database itself, not just by a filter in the software. Even if a query forgot to filter, the database would not return another company’s rows.
• Encryption. Traffic is always encrypted. Passwords are stored with argon2id and never in plain text. The credentials for your connections and your mail server are encrypted with AES-256-GCM.
• Access control. Sessions that expire, a limit on sign-in attempts, and role-based permissions within your company.
• Traceability. An audit log of who did what and when, and an exact copy of every reminder sent.
• Network and deployment. The database is only reachable from the hosting provider’s private network, over encrypted connections; the application uses a role without administrative privileges, and each company only sees its own data through row-level security policies.
• Recovery. The database is backed up continuously, encrypted, to a separate store in Amsterdam, so it can be restored to a specific point in time.

Engaging sub-processors requires them to be identified, authorised and bound by equivalent data protection obligations. This list does not authorise open-ended processing. Providers acting as independent controllers are not sub-processors for those operations.

By accepting this agreement you give us the general written authorisation provided for in Article 28.2 of the GDPR to use the sub-processors in this table. We impose on each of them, by contract, data protection obligations equivalent to those in this document and, if they fail to meet them, we remain liable to you for their actions, as Article 28.4 provides.

When you connect an account of your own (your Gmail, your Outlook or your Stripe account), that provider also processes the data under your own contract with it. Remitide only uses that connection for what you set up, and you can remove it at any time.

If we are going to add a new one, we will tell you at least thirty days in advance. During that period you can object; if you do and we can’t find an alternative, you can terminate the agreement without penalty and take your data with you.

Some providers are established in the United States or may process data there. Railway Corporation, Stripe, LLC, Plus Five Five, Inc. (Resend), Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework, and transfers to them rely on Commission Implementing Decision (EU) 2023/1795. Their data processing agreements also include the standard contractual clauses adopted by the European Commission in 2021. The AI provider is OpenAI Ireland Ltd., which transfers data to its US affiliates under the 2021 standard contractual clauses, as OpenAI is not certified under that Framework; Anthropic, an alternative provider not currently in use, would likewise rely on standard clauses. A copy of these safeguards is available on request from our privacy email address.

No data is transferred to a third country on any instruction other than yours unless EU or Member State law requires it; in that case we would inform you beforehand, unless the law prohibits it.

You can check that we comply. On reasonable request and with prior notice, we will provide the necessary information and, if needed, the opportunity for an audit (by you or by a third party you appoint who is bound by confidentiality), during business hours and without disrupting the service to other customers.

Unless required by an authority or following a breach affecting your data, on-site audits are limited to one a year, with at least thirty days’ notice, and each party bears its own costs. The documentation and written answers we provide will normally be enough. An audit does not give access to the data of other businesses using Remitide.

When you close your account, and as you choose, we return the data or delete it. You don’t need to wait for anyone to get it back: in Settings › Data and privacy you can download it at any time.

Copies are deleted too, except anything a legal obligation requires us to keep (mainly documents with accounting or tax effect), which is blocked: it is kept available to public authorities and the courts and not used for anything else, until the limitation period expires.

Commercial limits do not reduce the rights of data subjects, the powers of the authorities or the liability that applies under the GDPR. Remitide keeps its legal obligations in respect of its sub-processors. Penalties are not automatically passed on to the customer.

Each party is liable for its own obligations. We are liable for damage caused by processing where we have failed to meet the obligations the GDPR specifically places on processors or have acted outside your lawful instructions. You are responsible for the lawfulness of the instructions you give us and for meeting your obligations as controller.

For any question about this agreement, to request a signed copy or to tell us anything about your customers’ data, write to soporte@remitide.com.