Data Processing Agreement

Last updated: 10 November 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between PingDue and the customer using PingDue ("you"). It applies when PingDue processes personal data about your clients on your behalf, including under the EU GDPR, the UK GDPR, and similar laws. It takes effect when you accept the Terms. If you need a signed copy, email support@pingdue.app.

1. Roles

You are the controller of your clients' personal data. PingDue is your processor.

2. Details of the processing

Subject matter and purpose	Storing invoice information and sending payment reminder emails to your clients on your behalf
Duration	For as long as you have a PingDue account, plus up to 30 days for backups to be overwritten
Types of personal data	Client contact names, email addresses, preferred language and time zone; invoice details (number, amount, currency, due date, payment link); reminder sending records
Data subjects	Your clients and their contact persons
Special category data	None. Please do not enter it.

3. PingDue's commitments

Instructions: we process the data only on your documented instructions, which are given by how you use the app, unless the law requires otherwise (in which case we will tell you, unless the law forbids it).
Confidentiality: anyone authorised to process the data is bound by confidentiality.
Security: we use appropriate technical and organisational measures, including encryption in transit (HTTPS), salted password hashing, separation of each customer's data, access limited to what's needed, and log-in and sending limits.
Sub-processors: you authorise the sub-processors listed below. We will give you at least 14 days' notice (by email or by updating this page) before adding or replacing one, so you can object. If you object on reasonable grounds and we can't resolve it, you may cancel your subscription. We impose data protection obligations on sub-processors that are at least as protective as this DPA.
Help with requests: we will help you respond to requests from your clients exercising their data rights, taking into account the nature of the processing.
Breaches: we will notify you without undue delay, and where possible within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you reasonably need.
Assistance: we will reasonably help you with data protection impact assessments and consultations with authorities relating to PingDue.
Deletion: when you delete your account, we delete your clients' data from the live system immediately. Backups are overwritten within 30 days. You can download your data before deleting.
Audits: we will make available the information reasonably necessary to show compliance with this DPA, usually through written answers to your questions. On-site audits require reasonable notice and are at your cost.

4. International transfers

Some sub-processors process data outside the EU/EEA and UK, including in the United States and India. Where required, transfers are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

5. Your commitments

You confirm that you have a lawful basis to use your clients' data for payment reminders, that you have given any notices required by law, and that your instructions to PingDue comply with data protection law.

6. Authorised sub-processors

Provider	What they do for PingDue	Location
Cloudflare, Inc.	Hosts the website and app, stores the app's database, protects against attacks	United States and global network
Resend (Plus Five Five, Inc.)	Sends reminder emails and account emails (confirmation, password reset)	United States
Lemon Squeezy (a Stripe company)	Reseller and merchant of record: checkout, payments, invoices, sales tax/VAT	United States
Web3Forms	Receives waitlist sign-ups from the website form	Global
Google LLC (Gmail)	Our support inbox	United States and global

7. Order of precedence

If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.