Data processing addendum

1. Parties and roles

The customer is the controller or processor that decides why and how customer personal data is used. Ops Automators, operator of Billable8, is the processor or subprocessor for that data. Each party will meet the obligations that data-protection law assigns to its role.

2. Instructions and purpose

Billable8 will process customer personal data only on documented instructions from the customer: providing, securing, supporting, and improving the service; preventing abuse; and meeting the Terms. The customer’s configuration and ordinary use of Billable8 are documented instructions. If law requires different processing, we will notify the customer first unless the law prohibits notice.

The customer is responsible for having a lawful basis, giving required notices, and ensuring its instructions comply with law. We will tell the customer if we believe an instruction violates applicable data-protection law.

3. Confidentiality

People authorised to process customer personal data are bound by confidentiality obligations and receive access only where their work requires it. Access ends when that need ends.

4. Security measures

Billable8 maintains measures appropriate to the service and its risks, including:

• TLS in transit for application database connections and encryption of daily recovery archives before off-server storage;
• hashed passwords and API credentials, secure session cookies, rate limiting, and request-forgery protection;
• workspace and role scoping, least-privilege production database access, and automated isolation tests;
• deployment-managed secrets, append-only audit history for material changes, and tested backup and restore procedures;
• release checks for dependency, application, browser, and access-control regressions.

Encryption of the primary database disk has not been verified. The current control description and limitations are maintained on the security page.

5. Subprocessors

The customer gives general authorisation for the providers on the subprocessor list. We remain responsible for their processing under this DPA and impose data-protection terms appropriate to the services they provide. We will give reasonable advance notice of a material new subprocessor when required by law.

A customer may object during the notice period on reasonable data-protection grounds. We will work in good faith on a commercially reasonable alternative. If none is available, either party may end the affected service and we will refund prepaid fees for the unused period.

6. Assistance

Taking into account the nature of the processing and information available to us, we will reasonably assist with data-subject requests, security obligations, breach notifications, impact assessments, and regulator consultations. Self-service access, correction, and export should be used where available. We will not respond directly to a request about customer-controlled data unless the customer authorises it or law requires us to do so.

7. Personal data incidents

We will notify the customer without undue delay after confirming a personal data breach affecting customer personal data. Notice will include the information reasonably available about the nature, likely consequences, affected data, and remediation. Notice is not an admission of fault. We will take reasonable steps to contain and remedy the incident.

8. Return and deletion

Customers can export their data throughout the subscription and for 90 days after account closure. On the customer’s request or when that period ends, we will delete or return customer personal data unless law requires retention. Copies in rolling backups are isolated from ordinary use and expire under the backup retention cycle.

9. Information and audits

We will provide information reasonably necessary to demonstrate compliance with this DPA. If that is not enough, a customer may request one audit per year by an independent auditor bound to confidentiality, on reasonable notice and during normal business hours. The audit must avoid exposing other customers’ data or disrupting the service. The customer pays its audit costs unless the audit finds a material breach by us.

10. International transfers

Billable8 is operated in the United States and its current subprocessors may process data there. This public page does not itself execute Standard Contractual Clauses or a UK transfer addendum. A completed, countersigned transfer package is required before we represent that a transfer mechanism is in place for a customer.

11. Processing details

12. Order of precedence and contact

If this DPA conflicts with the Terms on personal-data processing, this DPA controls. The rest of the Terms, including liability and governing law, remains in effect. Contact zach@opsautomators.com for privacy requests, transfer documentation, or a signed copy.