Data Processing Agreement (B2B)
Version 1.0 · effective 2026-08-22
This agreement governs Clozo's processing of personal data on behalf of your organisation under Article 28 of the General Data Protection Regulation. Your organisation is the controller; Clozo is the processor. It is a business-to-business instrument and contains no consumer rights — the consumer documents on the freelancer site apply to freelancer accounts only.
Background
Clozo provides a headless invoicing and payment API. When an organisation (the Controller) uses the Clozo B2B API, Clozo processes personal data of the Controller's own customers (Payees) on the Controller's behalf. This DPA governs that relationship and forms part of the Clozo B2B Terms of Service.
1. Subject matter and nature of processing
Clozo processes Payee personal data in order to:
- create, number and store invoice documents (PDF and UBL/CII EN 16931 e-invoices) on the Controller's behalf
- process Payee online payments through the Controller's own Stripe Connect account
- deliver invoice documents to Payees by e-mail from the Controller's verified sending domain
- store payer-proof files (bank slips, receipts) uploaded by Payees as evidence of payment
- store Controller-owned attachments linked to invoices, optionally visible to Payees
- produce filtered exports of document and payment data for the Controller's finance function
- deliver event notifications to webhook endpoints the Controller registers
Storage of documents in an object store provided by the Controller is out of scope of this agreement and is not offered.
2. Purpose and legal basis
Processing is performed solely on the Controller's documented instructions, which consist of the B2B API specification, this DPA, and the API keys and scope grants the Controller issues. Clozo does not process Payee personal data for any other purpose unless required by Union or Member State law, in which case Clozo informs the Controller before processing unless that law prohibits it.
3. Categories of data subjects
Payees — natural or legal persons who are the Controller's customers and appear on the Controller's invoices.
4. Categories of personal data
| Data | Where it comes from |
|---|---|
| Payee legal name | Provided by the Controller through the API |
| Payee e-mail address | Provided by the Controller |
| Payee postal address | Provided by the Controller |
| Payee VAT number, Peppol participant ID, national company ID | Provided by the Controller |
| Invoice amounts and line items | Provided by the Controller |
| Payment confirmation data (method, amount, trust grade) | Produced by Clozo on payment |
| Payer-proof file content | Uploaded by the Payee |
| Attachment file content | Uploaded by the Controller |
| Webhook event payloads | Produced by Clozo, sent to the Controller's endpoint |
5. Duration
For as long as the Controller's B2B access is active, plus the 30-day window in which the Controller may collect its export. The ten-year retention that Article 244 of the VAT Directive and national law place on invoice records is the Controller's obligation, discharged with that export; it is not a reason for Clozo to keep a copy. See section 10.
6. Confidentiality (Art. 28(3)(b))
Everyone Clozo authorises to process Payee personal data is bound by an obligation of confidentiality. Access is limited to the staff and automated systems strictly necessary for the processing described above.
7. Security (Art. 28(3)(c), Art. 32)
Technical measures:
- TLS 1.3 in transit for every API endpoint and webhook delivery
- AES-256 at rest for object storage and the database
- field-level encryption of IBANs and webhook signing secrets
- HMAC-SHA256 signatures on every outbound webhook delivery
- organisation-scoped isolation enforced by the data layer, not by individual queries
- short-lived presigned URLs for uploads and downloads
- rate limiting and idempotency-key deduplication on every mutating endpoint
Organisational measures:
- role-based access control inside each organisation
- least privilege for API keys through scope grants
- live issuance gated on business verification
- a written breach-response procedure
8. Sub-processors (Art. 28(2), Art. 28(3)(d))
The Controller grants general authorisation for the sub-processors published in the Clozo sub-processor register. The register is the single list for the whole platform, and changes to it are announced through the same subscription mechanism used for freelancer accounts.
| Sub-processor | Role |
|---|---|
| Cloudflare, Inc. (R2) | Object storage for documents, payer-proofs and exports |
| Resend, Inc. | E-mail delivery from the Controller's verified domain |
| Stripe Payments Europe Ltd. and Stripe, Inc. | Payment processing in the Controller's connected account |
| Railway Corp. | Hosting of the application, workers and database |
Clozo gives at least 30 days' notice before adding or replacing a sub-processor. The Controller may object in writing; if Clozo proceeds regardless, the Controller may terminate this DPA.
Webhook endpoints the Controller registers are the Controller's own systems, not Clozo sub-processors. The Controller is responsible for their compliance.
9. Data subject requests and breaches (Art. 28(3)(e), (f))
Clozo informs the Controller of any Payee request relating to processing under this DPA within seven days of receiving it, and does not respond to the Payee directly — the Controller is the data subject's point of contact. The seven-day undertaking is backed by an automatic reminder to the organisation's administrators when a request arrives, showing the number of days remaining, so that the commitment does not depend on one person remembering.
Clozo notifies the Controller without undue delay, and within 24 hours where possible, after becoming aware of a personal data breach affecting Payee data processed under this DPA, with the information required by Article 33(3) to the extent available.
10. Return and deletion (Art. 28(3)(g))
On termination the Controller may export everything the organisation holds. The export is a single archive containing the organisation's records as structured data together with the original document files, produced by the organisation-export function of the product; its contents are those the product produces, which is why this clause names a mechanism rather than a file format nobody has checked. The archive remains available for 30 days from the termination date.
After the export window closes, or on earlier written instruction, Clozo deletes the organisation's data in full, including the invoicing audit trail. The statutory retention obligation on invoice records — ten years in the jurisdictions this product supports — falls on the Controller, not on Clozo as processor, and the Controller discharges it with the archive above. Article 28(3)(g) requires the processor to delete its own copies once the service ends, and Clozo is not subject to any law requiring it to keep another business's invoicing history. Retaining it would mean holding personal data with no controller and no lawful basis.
The one exception is a user account that also belongs to another organisation: that row survives, with its identifying fields replaced, because it is referenced by that other organisation's records. On written request Clozo confirms in writing that deletion has been carried out.
11. Audit (Art. 28(3)(h))
Clozo makes available the information necessary to demonstrate compliance with this DPA. The Controller, or an auditor it mandates, may carry out an on-site audit at most once per calendar year, on at least 30 days' written notice, during normal business hours, at the Controller's own cost, under a confidentiality agreement, and without access to any other client's data. A current third-party audit certificate, where one exists, satisfies the audit right for the year it covers.
12. Controller obligations
The Controller warrants that:
- it has a valid Article 6 legal basis for processing Payee personal data
- it has given Payees an Article 13 privacy notice covering the processing described here
- its instructions to Clozo comply with applicable data protection law
- webhook endpoints it registers meet the transfer requirements applicable to them
The Controller designates a data protection contact in its Clozo account and notifies Clozo within five days of any change.
13. Governing law
This DPA is governed by the law of the Republic of Cyprus, and the courts of Cyprus have jurisdiction, unless the Controller's national law mandates otherwise.
Where Clozo transmits Payee personal data to a sub-processor outside the European Economic Area, it relies on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by an adequacy or framework certification where one applies. The Controller may request a copy at any time.
14. Acceptance
This DPA is accepted explicitly during registration of the organisation. The version accepted is recorded against the accepting account. No separate signature is required.
Processor: Clozo. Contact for all matters under this agreement: legal@useclozo.com.