Source: https://billingmart.com/dpa [Legal](https://billingmart.com/legal) Data Processing Addendum # Data Processing Addendum This Data Processing Addendum (DPA) supplements our Terms of Service and sets out our contractual commitments under GDPR Article 28, UK GDPR, and international data protection laws. Last revised: October 2026 • Version: 1.0 ## Contents 1. Scope and Pre-Signed Status2. Definitions3. Scope and Nature of Processing4. Customer and Processor Obligations5. Technical and Organizational Measures6. Subprocessors and Prior Notice7. Assistance with Data Subject Requests8. Personal Data Breach Notification9. International Data Transfers and SCCs10. Termination, Return, and 30-Day Purge11. Audits and Compliance Records12. Disclaimers, Limitation of Liability and Indemnification [← All legal agreements](https://billingmart.com/legal) ## 1. Scope and Pre-Signed Status This Data Processing Addendum ("DPA") is between you ("Customer") and BillingMart.com LLC, a New Mexico limited liability company ("BillingMart"). This DPA enters into force automatically upon your creation of a BillingMart workspace or execution of a Master Services Agreement. It applies to the extent that BillingMart processes Customer Personal Data subject to Applicable Data Protection Laws on your behalf. ## Pre-Signed and In Force To simplify vendor onboarding for our business customers, this DPA is pre-signed by BillingMart and binds both parties upon account creation. A countersigned PDF copy for your compliance files can be requested at any time by emailing [legal@billingmart.com](mailto:legal@billingmart.com) . ## 2. Definitions - **"Applicable Data Protection Laws"** means all global privacy laws applicable to the processing of personal data, including the EU GDPR, UK GDPR, Swiss FADP, and US state privacy laws (such as the California CCPA/CPRA). - **"Customer Personal Data"** means any personal data processed by BillingMart on behalf of Customer in the provision of the platform services. - **"Controller" and "Processor"** have the meanings given under the GDPR. Customer acts as Controller; BillingMart acts as Processor. - **"Standard Contractual Clauses" (SCCs)** means the standard contractual clauses approved by the European Commission for the transfer of personal data to third countries. ## 3. Scope and Nature of Processing The subject matter, nature, duration, and purpose of data processing are defined as follows: - **Subject Matter:** The provision of cloud-based invoicing, estimates, payment link delivery, and account ledger management. - **Duration:** The duration of your active subscription, plus the 30-day workspace deactivation and purge window. - **Categories of Data Subjects:** Customer’s employees, contractors, clients, debtors, and billing contacts. - **Types of Personal Data:** Names, business addresses, verified contact email addresses, telephone numbers, invoice line item descriptions, and transaction timestamps. ## 4. Customer and Processor Obligations Customer warrants that it has established a lawful basis under Applicable Data Protection Laws for providing Customer Personal Data to BillingMart. BillingMart shall process Customer Personal Data exclusively in accordance with Customer’s documented lawful instructions, as set forth in the Terms of Service and this DPA, and shall not sell, retain, or disclose Customer Personal Data for any other purpose. ## 5. Technical and Organizational Measures BillingMart implements and maintains rigorous technical, physical, and administrative safeguards designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure: - **Encryption:** Data in transit is encrypted using modern TLS 1.3 protocols. Database records and sensitive merchant gateway credentials are encrypted at rest using AES-256-GCM. - **Zero Cardholder Invariant:** Raw full card numbers and security codes are not stored by BillingMart on disk or in databases; they exist only in memory while a charge is made, and are entered only on an isolated payment page. - **Cross-Tenant Leak Protection:** Multi-tenant isolation is enforced at the database rules layer, verified continuously by automated cross-tenant security test suites. - **Access Governance:** Least-privilege role-based access controls (RBAC), mandatory two-factor authentication for administrative functions, and immutable audit logging. ## 6. Subprocessors and Prior Notice Customer grants general authorization for BillingMart to engage subprocessors to support the delivery of the service. Our current authorized subprocessors are published on our [Subprocessors Page](https://billingmart.com/subprocessors) . We obligate each subprocessor by written agreement to data protection standards no less stringent than those set out in this DPA. BillingMart will give notice of a new or replacing subprocessor by updating its Subprocessors page before the change takes effect, and Customer may object on documented data protection grounds within 30 days of that update. ## 7. Assistance with Data Subject Requests Taking into account the nature of the processing, BillingMart provides Customer with self-service tools in the console and client portal to fulfill data subject requests (such as data export, profile rectification, and account closure). If a data subject submits a request directly to BillingMart, we will promptly notify Customer without responding directly, unless legally required to do so. ## 8. Personal Data Breach Notification BillingMart will notify Customer without undue delay, and where feasible within 72 hours, after confirming any actual Personal Data Breach affecting Customer Personal Data. The notification shall describe the nature of the incident, the categories and approximate number of data subjects affected, the likely consequences, and the mitigation measures taken or proposed. ## 9. International Data Transfers and SCCs Where the transfer of Customer Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to a third country requires an adequacy mechanism, the parties hereby incorporate the European Commission’s Standard Contractual Clauses (Module Two: Controller-to-Processor) by reference. ## 10. Termination, Return, and 30-Day Purge Upon termination of the service, Customer may export all Customer Personal Data using our standard REST v1 API or console export tools. Following workspace termination, all Customer Personal Data enters a 30-day deactivation cycle, after which it is permanently purged from production databases, save for historical invoices and ledger records required to be retained under statutory financial laws. ## 11. Audits and Compliance Records BillingMart makes available all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and allows for and contributes to audits conducted by Customer or an independent auditor agreed upon by the parties. ## 12. Disclaimers, Limitation of Liability and Indemnification This section restates, and this page incorporates by reference, Sections 10 (Warranties and Disclaimers), 11 (Limitation of Liability) and 11A (Indemnification) of the [Terms of Service](https://billingmart.com/terms#disclaimers) . They apply to everything this page describes, to the fullest extent the law allows, and the Terms of Service control if the two differ. Where applicable law does not permit a disclaimer, limitation or exclusion below, it applies to the extent the law permits. THE PLATFORM, CONSOLE, REST APIS, PAY PAGES AND EVERY SERVICE, FEATURE, PAGE, NOTICE AND PROCESS DESCRIBED HERE ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, BILLINGMART.COM LLC AND ITS AFFILIATES EXPRESSLY DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE. IN NO EVENT SHALL BILLINGMART, ITS OFFICERS, DIRECTORS, MEMBERS, MANAGERS, EMPLOYEES, AGENTS OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF REVENUE, PROFIT, GOODWILL, OR TRANSACTIONAL DATA, ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE PLATFORM OR ANYTHING DESCRIBED ON THIS PAGE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER THE TERMS OF SERVICE OR THIS PAGE SHALL BE STRICTLY LIMITED TO THE TOTAL FEES PAID BY YOU TO BILLINGMART IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, WHICH MAY BE ZERO. **Indemnification.** The indemnity in [Section 11A of the Terms of Service](https://billingmart.com/terms#indemnification) — your defense and indemnification of the BillingMart Parties against claims arising from your use of the Services, the content you send, your dealings with your customers and the consents and notices the law requires of you — applies to the activities this page describes as if set out here in full. **For this Addendum.** BillingMart's liability to Customer for Customer Personal Data, including as between the parties under Article 82 of the GDPR, is subject to the limitations in Section 11 of the Terms of Service as a whole, not in addition to them. Customer is responsible for the lawfulness of the Personal Data it provides, the instructions it gives and the notices and consents it owes to data subjects, and will indemnify BillingMart against claims arising from them under Section 11A. Nothing on this page creates a warranty, a service level, a guarantee or a duty of care beyond those stated in the Terms of Service, and every exemption, safe harbor, limitation and defense available to BillingMart under applicable law is preserved. ### Legal and compliance questions If you have questions regarding this agreement, or need a countersigned copy of our Data Processing Addendum, contact us at [legal@billingmart.com](mailto:legal@billingmart.com) or write to our privacy officer at [privacy@billingmart.com](mailto:privacy@billingmart.com) . ## Related legal documents [Terms of Service Read document →](https://billingmart.com/terms) [Privacy Policy Read document →](https://billingmart.com/privacy) [Acceptable Use Policy Read document →](https://billingmart.com/aup) [Service Level Agreement Read document →](https://billingmart.com/sla) [Cookie Policy Read document →](https://billingmart.com/cookies) [Subprocessors Read document →](https://billingmart.com/subprocessors) [E-Sign Consent Read document →](https://billingmart.com/e-sign) [Accessibility Statement Read document →](https://billingmart.com/accessibility) [Text Message Terms Read document →](https://billingmart.com/sms-terms) [US State Privacy Rights Read document →](https://billingmart.com/privacy/states) [Data Removal Request Read document →](https://billingmart.com/privacy-request) [Partner Program Agreement Read document →](https://billingmart.com/legal/partner-agreement) --- This is the Markdown copy of https://billingmart.com/dpa. Live plans, prices and limits are published as JSON at https://billingmart.com/plans.json and https://billingmart.com/agent-info.json.