Data Processing Addendum

DRAFT - to be reviewed by our lawyer before launch.

This Data Processing Addendum ("DPA") is part of the Terms of Service between ForestBill and the agency. It explains how ForestBill handles the personal data that the agency puts into ForestBill about its own clients and contacts.

1. The parties

In this DPA, "we" means ForestBill (the processor) and "you" means the agency (the controller).

This DPA applies from the day you start using ForestBill. It ends when we have deleted your personal data as described in section 10.

2. What we process, and why

3. Our duties as processor

We will:

1. Follow your instructions. We process your data only to provide ForestBill, as set out in the Terms and this DPA, and as you instruct through the app (for example when you send an invoice or delete a client). If we think an instruction breaks the law, we will tell you.
2. Not use your data for ourselves. We do not sell it, use it for advertising, or use it for any purpose of our own.
3. Keep it confidential. Everyone at ForestBill who can access your data is bound to keep it confidential and gets access only when needed.
4. Keep it secure with the measures in section 6.
5. Help you answer requests from your clients who want to see, correct or delete their data (section 8).
6. Help you with your own legal duties, such as data protection impact assessments or questions from authorities, where reasonable and as far as the information is available to us.
7. Tell you about breaches (section 7).
8. Delete or return your data at the end (section 10).
9. Give you the information you reasonably need to show that this DPA is followed (section 9).

If the law forces us to give your data to an authority, we will tell you first, unless the law forbids that.

4. Your duties as controller

You confirm that:

• you have a valid legal reason to put your clients' data into ForestBill and to use it for billing;
• you give your clients the privacy information the law requires, including that you use ForestBill;
• your instructions to us follow the law.

5. Sub-processors

You allow us to use the following sub-processors. They are bound by written terms that protect your data at least as well as this DPA.

The current list is also in our Privacy Policy.

Not our sub-processors: the payment accounts (for example your Stripe or PayPal account) and email mailboxes you connect. You choose them and have your own agreements with them. ForestBill sends data to them on your instruction.

Changes: we will tell you by email at least 30 days before we add or replace a sub-processor. If you have a reasonable data-protection objection, tell us within that time. If we cannot solve it, you may end your subscription and we will not charge you for the time after the change.

6. Security measures

We protect your data with measures such as:

• No card data. Card numbers go straight from your client's browser to your payment provider. ForestBill never receives them.
• Encryption. All traffic uses HTTPS. Secrets (payment keys, mailbox passwords, signing and payment link tokens, email contents) are encrypted with AES-256 and a separate key for each agency. Backups are encrypted before they leave our server.
• Separation between agencies. Each agency's data is kept apart by rules in the database itself, not only in the app. These rules are tested automatically.
• Access control. Roles and permissions per person, per brand and per client. Two-step sign-in (2FA) for our own staff, and you can require it for your whole team. A fresh security check before sensitive actions such as exports and connecting payment accounts.
• Limited ForestBill staff access. Our staff open your workspace only in a support session: with a reason, a fresh 2FA check, for at most 60 minutes, with an email to your Owners and every action recorded in your audit log. Staff cannot see your secrets, manage your team or export your data in a support session.
• Tamper-evident audit log. Changes are recorded in a sealed chain; the seal is checked every night.
• Signed contracts carry a signing record and a document fingerprint (SHA-256) so changes can be detected.
• Backups every hour, night and month, stored off the main server, with a restore tested every week.
• Monitoring of errors, uptime and security events, with alerts to our team. Error reports are cleaned of secrets and personal data before they are stored.
• Secure development: automatic security checks of our code and the libraries we use before every release.

We may improve these measures over time, but we will not lower the overall level of protection.

7. Data breaches

If we become aware of a breach of security that affects your personal data, we will:

• tell you without undue delay, and within 72 hours of becoming aware of it, by email to your Owners;
• tell you what happened, what data and people are likely affected, what we are doing about it, and who you can contact;
• send more information as we learn it;
• help you meet your own duties to inform authorities and the people affected.

Telling you about a breach does not mean we accept fault.

8. Requests from your clients

• Your clients should send their requests (to see, correct or delete their data) to you.
• You can handle most of them yourself in ForestBill: edit a client, export data, or use Delete this client's personal data, which erases the client's personal details and keeps the financial records in anonymised form.
• If a client writes to us, we will pass the request to you and not answer it ourselves, unless you ask us to.

9. Audits

• We will give you the information you reasonably need to check that we follow this DPA, for example answers to a security questionnaire and a summary of our security measures.
• If that is not enough, you may ask for an audit on reasonable request: with at least 30 days' written notice, at most once a year (unless a breach or an authority requires more), during business hours, at your own cost, by an auditor bound to confidentiality, and in a way that does not put other agencies' data or our security at risk.

10. Deleting or returning data at the end

• Return: an Owner can export all your data at any time, including when the account is closing (a ZIP file with CSV files and PDF documents).
• Grace period: when your account is closed, there is a 30-day grace period in which you can still export your data or cancel the closure.
• Deletion: after the 30 days, we delete the personal data: client details, team logins, signatures, files, sign-in data and email contents. The encryption key of your agency is destroyed, so encrypted values can never be read again.
• Kept financial records: invoices, payments, refunds, credit notes, subscriptions, contracts and the audit log are kept in anonymised form (no names or contact details) for 5 years from the closure date, then deleted for good.
• Backups: deleted data stays in our encrypted backups until those backups expire (at most 12 months). If we ever restore a backup, we repeat the deletions.

11. International transfers

ForestBill is run from Pakistan, and our sub-processors may process data in other countries (see section 5). Where the law that applies to you requires extra protection for transfers (for example standard contractual clauses), we will put it in place with you and with our sub-processors.

12. Liability and order of documents

• The limits of liability in the Terms of Service apply to this DPA.
• If this DPA and the Terms of Service disagree about personal data, this DPA wins.

13. Signatures

If no signed copy is made, this DPA applies as part of the Terms of Service when the agency accepts them.

Questions about this page? Write to hello@forestbill.com.

ForestBill is a product of Genyune SMC-Private Limited, Karachi, Pakistan.