Privacy Notice (B2B cabinet users)
Version 2026-08-22 · effective 2026-08-22
This notice covers the personal data Clozo holds about you as a user of the B2B cabinet — your account, not your organisation's invoices. Personal data your organisation processes through Clozo about its own customers is covered by the Data Processing Agreement, where your organisation is the controller and Clozo is the processor.
1. Controller
Clozo is the controller for the processing described in this notice. Contact: privacy@useclozo.com.
2. What is held about you
| Data | Why |
|---|---|
| Name, e-mail address, optional phone number | Identifying you and contacting you about the account |
| Password (hashed) | Authentication |
| Role and organisation membership | Deciding what you may do in the cabinet |
| Language and time zone | Rendering the interface |
| Sign-in and administrative action records | Security, and evidencing who did what |
| Consent stamps and the versions of the documents accepted | Evidencing agreement |
3. Legal basis
Performance of the contract between Clozo and your organisation, under which you hold an account (Art. 6(1)(b)), and Clozo's legitimate interest in the security and integrity of the service (Art. 6(1)(f)).
4. Who it is shared with
The sub-processors published in the Clozo sub-processor register — hosting, object storage and e-mail delivery. Your account data is not sold, and is not used for advertising.
5. How long it is kept
For as long as your account exists. When your account is erased, the identifying fields are replaced with placeholders and the row survives only where it is referenced by a statutory record — an invoice, a journal entry or an audit entry that must remain attributable. Administrative records are kept for as long as the statutory obligation requires.
6. Your rights
- access to the personal data held about you
- correction of data that is wrong
- erasure of your account, subject to the statutory records exception above
- objection to processing based on legitimate interest
- data portability
- complaint to a supervisory authority
Erasure of your own account can be requested from the cabinet and is carried out after a grace period during which it can be cancelled. Requests about data your organisation controls go to your organisation, not to Clozo.
7. Transfers outside the EEA
Where a sub-processor is outside the European Economic Area, Clozo relies on the Standard Contractual Clauses, supplemented by an adequacy or framework certification where one applies.
8. Requests sent through the company website
This section applies to a person who sends a request through the contact form on the Clozo company website, whether or not they ever hold a cabinet account. Clozo is the controller. Contact: privacy@useclozo.com.
| Topic | What applies |
|---|---|
| Data collected | Work e-mail address, company name, country, role, invoice volume band, number of people, plan of interest, early-access interests, ERP name, your message, the page and language you sent it from, campaign parameters in the link you came from, your analytics visitor id when you have accepted analytics, and the time and version of the notice you consented to. Your IP address is not stored; only a hash that is salted per day is kept. |
| Purpose | Answering your request and counting how many requests the website produces. |
| Legal basis | Your consent (Art. 6(1)(a)), given by ticking the box on the form and withdrawable at any time; and steps taken at your request before a contract (Art. 6(1)(b)). |
| Recipients | Clozo sales staff, by e-mail, and the e-mail delivery and product-analytics sub-processors named in the sub-processor register. The analytics event records that a request was sent and its plan, country and volume band, not who sent it. |
| Retention | 24 months after the last contact with you, then the request is deleted automatically. |
| Providing the data | Voluntary. Without the e-mail address, company name and consent Clozo cannot answer the request. |
You may ask for access, correction, erasure, restriction or portability, withdraw your consent, or object, by writing to privacy@useclozo.com, and you may complain to a supervisory authority. Nobody is subject to a decision based solely on automated processing as a result of this form.