APPENDIX 117 to the Data Protection Policy at organization level

Privacy Policy

INVOICIT APP

This privacy policy (Privacy Policy) applies to the website www.invoicit.app, hereinafter referred to as the Website.

The Website belongs to Looplink SRL, a limited liability company organized and functioning under the laws of Romania, having its registered office in Constanta City, 142 Mamaia Blvd., 2nd floor, Constanța County, Romania, registered with the Constanta Trade Registry under no. J13/3372/2020, European Unique Identifier (EUID): ROONRC.J13/3372/2020, VAT number: 43485767, represented by George Zacusai, in his capacity as Director, e-mail address: office@looplink.ro, hereinafter referred to as We or Invoicit or the Company or the Controller.

Invoicit is the Controller (as defined below) of your Personal Data (as defined below), according to the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). This Privacy Policy informs you on the Personal Data we collect and process, the purposes and the legal basis of the Processing (as defined below), and any other relevant information as per the GDPR.

The Company has designated a Data Protection Officer (DPO), as follows:

Name: ABSOLUTE PRO SERVICES SRL

Address: 136 Calea Plevnei, Bucharest, Romania

E-mail address: info@ergpd.net

Phone number: +40737036491

For the purpose of providing you our Services (as defined below) or based on your consent, we process Personal Data jointly with our Joint Controllers (as defined below).

Joint Controllers are:

  1. Paddle.com Market Ltd - our online reseller and Merchant of Record for all our orders, who also ensures payment services and handles order inquiries and returns;
  2. Facebook Ireland Ltd - the operator of the social network Facebook (Invoicit becomes joint controller, as we operate the Invoicit Facebook business page).

We have entered into a:

  1. joint controller agreement with Paddle.com Market Ltd, and
  2. controller addendum with Facebook Ireland Ltd, to determine the respective responsibilities for compliance with the obligations under the GDPR with regard to the joint Processing. Relevant aspects of this joint Processing are illustrated in this Privacy Policy below.

We have also agreed with our Joint Controllers the following:

  1. that Invoicit is responsible for providing Data Subjects with the information on joint Processing of Personal Data, as mentioned herein below;
  2. after the joint Processing, Facebook Ireland Ltd, respectively Paddle.com Market Ltd is responsible for the exercise of your rights provided herein below.

You may contact and exercise your rights provided herein against each of the Joint Controllers. However, the contact point for you regarding the processing of Personal Data related to this Privacy Policy shall be: Invoicit by its DPO. For any matters related to Personal Data Processing, including joint Processing, please contact our DPO to the following contact details:

ABSOLUTE PRO SERVICES SRL

Address: 136 Calea Plevnei, Bucharest, Romania

E-mail address: info@ergpd.net

Phone number: +40737036491

Please read this Privacy Policy and the Cookies Policy carefully. If you do not agree with these documents, we might not be able to respond to your inquiries, but in any case, you will not incur any negative consequences.

By ticking the boxes related to this Privacy Policy before using the Website, you agree that you have read, understood, and agree that your Personal Data will be processed in accordance with this Privacy Policy. Cookies Policy is separately provided to you and you will be able to separately consent. Nevertheless, there are certain Processing operations requiring your explicit consent, such as for marketing purposes, and you will be duly informed in this respect before giving your consent.

Article 1 - DEFINITIONS

Services
means the services consisting in the billing solution provided by Invoicit under the Terms of Service published on the Website, which represent your services/ subscription contract with us;
Account
means the user account you can create on the Website, in order to benefit from our Services;
Personal Data
means any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Special Categories of Personal Data
means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation;
Processing
means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Controller
means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
Joint Controllers
means controllers who jointly determine the purposes and means of Processing;
Processor
means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
Sub-processor
means the processor engaged by the Processor for carrying out specific Processing activities on behalf of the Controller;
Recipient
means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
Third Party
means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
Consent of the data subject
means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Profiling
means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
Pseudonymisation
means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Third Country
means any country located outside of the European Economic Area.

Article 2 - PERSONAL DATA PROCESSING PRINCIPLES

Invoicit follows several rules, including the following:

  1. Personal Data must be processed in a lawful and transparent manner, guaranteeing loyalty to the persons whose Personal Data are processed (“lawfulness, loyalty and transparency”);
  2. there must be specific purposes for Processing the data and the Controller must indicate these purposes to the Data Subjects when collecting their Personal Data (“purpose limitation”);
  3. the Company can only collect and process Personal Data that is necessary to achieve these purposes (“data minimization”);
  4. the Company must ensure that Personal Data are accurate and kept up to date with regard to the purposes for which they are processed, and correct them where necessary (“accuracy”);
  5. the Company can no longer use Personal Data for other purposes which are not compatible with the purpose for which they were initially collected;
  6. the Company must ensure that Personal Data is not kept longer than necessary to achieve the purposes for which they were collected (“limitation of conservation”);
  7. the Company must put in place technical measures and appropriate organizational structures that ensure the security of Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using technology appropriate (“integrity and confidentiality”).

Article 3 - WHAT PERSONAL DATA DO WE COLLECT, FOR WHAT PURPOSE AND HOW DO WE USE THEM

In the table below, you will find details concerning the use of your Personal Data that we collect through this Website, including information regarding our Joint Controllers.

In what context do we collect your Personal Data What type of Personal Data do we collect For what purpose do we use the Personal Data What is the legal basis of the Personal Data processing (according to GDPR)
When you create an Account on our Website Last name, first name, telephone number, e-mail address, password In order to create your Account

Processing is necessary in order to take steps at the request of the Data Subject prior to entering into a contract – Article 6 (1) (b) of the GDPR.

You are not obliged to provide these data, but if you do not provide these data Invoicit will not be able to carry out necessary steps for the execution and performance of the contract with you.

The Website may also be used if you decide not to create an Account by providing Personal Data, but certain data may be collected through cookies – please see Cookies Policy in this respect.
For Services provision, including invoicing Last name, first name, e-mail. These Personal Data are jointly processed by Invoicit together with our Joint Controller, Paddle.com Market Ltd.

Data regarding conducted transactions (payment details, credit/ debit card details) are processed by our Joint Controller, Paddle. Please carefully read the privacy policy of Paddle: https://paddle.com/privacy/

 In order to be able to provide the Services

Processing is necessary for the performance of a contract to which the Data Subject is party – Article 6 (1) (b) of the GDPR.

For the avoidance of any doubt, your consent to the conclusion of the services/ subscription contract with us is different from the consent given for Personal Data Processing, where applicable.

You are not obliged to provide these data, but if you do not provide these data Invoicit will not be able to carry out necessary steps for the execution and performance of the contract with you.
For fraud prevention and security related reasons as required by law Last name, first name, telephone number, e-mail In order to be able to prevent frauds and security issues Our legitimate interest - Article 6 (1) (f) of the GDPR
For the offering of assistance to the Website users Last name, first name, telephone number, e-mail address, and any other data you directly provide us with. For the offering of technical assistance to the users, communicating with you and solving your requests/ complaints

Our legitimate interest – Article 6 (1) (f) of the GDPR

Invoicit legitimate interest in processing these data arises from the interest in resolving your requests/ complaints and thus in ensuring and increasing client satisfaction; or processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract – Article 6 (1) (b) of the GDPR.

You are not obliged to provide these data, but if you do not provide these data Invoicit will not be able to offer you assistance or solve your requests/ complaints or execute/ perform the contract.
For compliance with applicable laws Last name, first name, telephone number, e-mail address To comply with our legal obligations, for example for information archiving, reporting towards public authorities/ institutions Processing is necessary for compliance with a legal obligation to which the Controller is subject – Article 6 (1) (c) of the GDPR
On-line browsing (information collected with the help of cookies or similar technologies), for analytics purposes

Please see our Cookies Policy for further information.

We use tools provided by Plausible and Facebook to receive anonymous, aggregated statistics about our visitors to our Website and Facebook business page (through Facebook Insights).

We use Plausible for Website traffic analysis.

Please carefully read the privacy policy of Plausible: https://plausible.io/data-policy

For information on the security measures taken by Plausible, please refer to the data processing agreement between us and Plausible: https://plausible.io/dpa

We use the Invoicit Facebook business page, and we jointly process Personal Data with Facebook Ireland when you visit our Facebook business page. We have entered into agreements with Facebook that define the terms for use of the Facebook business page.

Facebook Ireland is a Joint Controller of the joint Processing and the information required by Article 13(1)(a) and (b) of the GDPR can be found in Facebook Ireland’s data policy at https://www.facebook.com/about/privacy.

Further information on how Facebook Ireland processes Personal Data, including the legal basis Facebook Ireland relies on and the ways to exercise Data Subject rights against Facebook Ireland, can be found in Facebook Ireland’s Data Policy at https://www.facebook.com/about/privacy.

For more relevant information, please study:

 To create statistics regarding the traffic on our Website and on our Facebook business page. This helps us to understand how visitors are engaging with our content.

Your consent - Article 6 (1) (a) of the GDPR, for the purpose of analytics

Depending on the types of cookies, your consent may or may not be required - please carefully read the Cookies Policy. For the use of cookies that require your consent, if you do not express your consent, those cookies will not be used, without negative consequences for you. You may express your consent by ticking the boxes on the Website for each type of cookie and data as you will be informed upon and only the cookies you expressed your consent for will be placed on your computer/ device.

Invoicit ensures that you are well informed at all times, thus at intervals of 6 months we will again request your consent.

Invoicit shall not process Personal Data for automated individual decision-making, direct marketing and advertising profiling without your express prior consent for such purposes.

Invoicit shall not process Special Categories of Personal Data.

If you want additional information regarding the use of your Personal Data, please contact the Data Protection Officer who is available for any question related to the protection of your Personal Data: ABSOLUTE PRO SERVICES SRL, Calea Plevnei 136, Bucuresti, Romania, e-mail: info@ergpd.net

Article 4 - TO WHOM IS YOUR PERSONAL DATA DISCLOSED

Invoicit preserves data confidentiality at all times. However, there are circumstances when we will disclose Personal Data, as applicable, to certain Recipients as follows:

Within the European Economic Area:

  1. if we have legal obligations in this respect – for example, we can disclose Personal Data to National Agency for Tax Administration and other authorities/ institutions requiring them;
  2. for the purpose of exercising or defending our legitimate rights and interests - for example, to enforce these Terms (for instance, to lawyers, accountants etc.);
  3. you have given your consent for this purpose, if applicable;
  4. for the purpose of providing you our services, your Personal Data will be transferred as follows:
    1. to the developer of the Website / the cloud service provider (located on the European Union territory), which is Microsoft and it has the capacity of Processor;
    2. to the data analytics service provider (located on the European Union territory), which is Plausible and it has the capacity of Processor.

Outside the European Economic Area/ Third Countries:

As applicable, when we, our Joint Controllers, Processors and Sub-processors engage in such transfers, a variety of legal mechanisms are used, including contracts such as the standard contractual clauses published by the European Commission. To learn more about the European Commission’s decisions on the adequacy of the protection of personal data in the countries where Invoicit or its Joint Controllers, Processors/Sub-processors process Personal Data, please see this article on the European Commission website: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

  1. for the purpose of providing you our services, your Personal Data will be shared with our Joint Controller, Paddle.com Market Ltd , and transferred as provided within their privacy policy: https://paddle.com/privacy/
  2. based on your consent, your Personal Data will be shared with our Joint Controller, Facebook Ireland Ltd – for information on how Facebook transfers your Personal Data, please refer to their privacy policy: https://www.facebook.com/about/privacy
  3. Invoicit will exceptionally transfer Personal Data to Third Countries in the following circumstances:
    1. If required to do so by law, comply with legal process or to comply with a governmental or regulatory request, subject to requirements provided under Article 49 (1) d) of the GDPR;
    2. To protect and defend the rights or property of Invoicit, as part of a transaction where they merge with another organization, files for bankruptcy, or sells its assets or capital stock, where the transfer is necessary for the establishment, exercise or defense of the legal claim in question, under Article 49 (1) e) of the GDPR.

Article 5 – THE PERIOD FOR WHICH PERSONAL DATA WILL BE PROCESSED AND STORED AND THE CONDITIONS THEREOF

Invoicit will process your Personal Data for as long as is necessary to fulfil the Processing purposes, as follows:

  1. in case of performance of the contract with you or arrangements for the conclusion of such a contract - the duration of processing and storage is that required by law for that contract. After the termination of the contract, there may be legal obligations for Invoicit to keep records, in which case your Personal Data will be stored for the period provided by law, which will vary, and can be between 1 day and 10 years – under the legal basis provided at Article 6 (1) (c) of the GDPR;
  2. based on your consent - the Personal Data are retained until the consent is withdrawn, unless there are legitimate reasons justifying further processing by Invoicit (including a legal obligation to do so) and prevailing over the interests, rights and your freedoms or if we are necessary in order to establish, exercise or defend a right in court, but not later than 3 years from the date when such right could have been exercised.
  3. based on the requirement to fulfil our legal obligations - the Personal Data are processed and stored during the existence of that legal obligation. Depending on the particular situation, this period will vary, and can be between 1 day and 10 years;
  4. under the legitimate interest of Invoicit - during the existence of the legitimate interest, but not more than 3 years from the date when such legitimate interest could have been exercised.

Article 6 - YOUR RIGHTS AND HOW CAN YOU EXERT THEM

The right Explanations How can you exert it
The right to access You can request information related to the Personal Data that we process. Send an e-mail in this regard to the address contact@invoicit.app
The right to rectification You can request the rectification of the data if the information is inaccurate. Send an e-mail in this regard to the address contact@invoicit.app
The right to the erasure of the data (‘right to be forgotten’)

You can request the erasure of the data, in certain conditions (specified in GDPR), namely:

  • if personal data are no longer necessary for the purposes for which they were collected or processed;
  • if you withdraw your consent and there is no other legal ground for the processing;
  • if you object to the processing and there are no legitimate reasons to prevail;
  • if the personal data have been unlawfully processed;
  • if personal data must be deleted in order to comply with a legal obligation.
 Send an e-mail in this regard to the address contact@invoicit.app
The right to the restriction of the processing

You can request the restriction of your personal data processing, when one of the following applies:

  • the accuracy of the Personal Data is contested by you, for a period enabling us to verify the accuracy of the Personal Data;
  • the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of their use instead;
  • we no longer need the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
  • you have objected to processing pending the verification whether our legitimate grounds override yours.
 Send an e-mail in this regard to the address contact@invoicit.app
The right to oppose You can oppose to the Processing, in certain conditions (specified in GDPR), namely and where applicable, when we process Personal Data based on our legitimate interest or for direct marketing purposes, including profiling, to the extent that it is related to such direct marketing. Send an e-mail in this regard to the address contact@invoicit.app
The right to the portability of your Personal Data

You can request a copy of your data in a structured, commonly used and easy-to-read format, and you can receive it in an electronic format, respectively the right for these data to be transmitted by us to another data controller, insofar as the conditions provided by law are met.

The data to which the right to portability applies are either those obtained by your consent or by a contract with us.

 Send an e-mail in this regard to the address contact@invoicit.app
The right to oppose to an automatic individual decisional process, including profiles creation You can oppose to any automatic individual decisional process including profiles creation Send an e-mail in this regard to the address contact@invoicit.app
The right to withdraw consent Where applicable, namely where Data Processing is based on the legal basis of consent provided at Article 6 (1) (a) of the GDPR, you have the right to withdraw consent at any time, as easy as you originally gave it, without prejudice to the lawfulness of the processing carried out on the basis of the consent before its withdrawal. Send an e-mail in this regard to the address contact@invoicit.app
The right to file a complaint at the Supervisory Authority You can file a complaint at the Supervisory Authority for Personal Data Processing

Also, you can contact our data protection officer info@ergpd.net, who is available for any questions related to the protection of your Personal Data.

Your answer will be transmitted in accordance with the GDPR provisions, in not more than a month since the receiving of the request. This period of a month can be prolonged with two months if the complexity of the request and/or if the number of requests are imposing it.

Article 7 - HOW CAN YOU CONTACT US

For any questions, information about our Services or about the Website, you can send us an e-mail at the following address: contact@invoicit.app.

Article 8 - CHANGES TO THIS PRIVACY POLICY

Invoicit may change this Privacy Policy by notifying you in this respect at least 30 days before the change takes effect via e-mail and/or through a notice/pop-up on the Website home page or via the Account. We will publish a new version on the Website. You will have the opportunity to accept or refuse the revised Privacy Policy.

Last updated on:

Storing the patient name raises a privacy concern and you are using it at your own risk. Invoicit assumes no responsibility on the resulting privacy breach.