1. Roles of the parties
For the personal data you enter about your own customers (for example, a client's name, address, VAT number, and invoice details), you act as the controller and QuickieBill acts as your processor. QuickieBill processes that data only to provide the Service and on your documented instructions, which include these terms and your use of the product's features.
2. Details of the processing
- Subject matter: provision of invoicing and ZATCA e-invoicing software.
- Duration: for as long as you use the Service, plus any legally required retention period.
- Nature and purpose: storing, organising, rendering, transmitting, and (where you choose) reporting invoice documents.
- Categories of data subjects: your customers and contacts.
- Categories of personal data: identification and contact details, tax identifiers (VAT/CR), and transaction details you enter.
3. Our obligations as processor
- Process personal data only on your documented instructions, unless required otherwise by law.
- Ensure personnel authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Assist you, taking into account the nature of processing, in responding to data-subject requests and meeting your security and breach-notification obligations.
- Delete or return personal data at the end of the Service, subject to legal retention requirements.
4. Sub-processors
You authorise QuickieBill to engage sub-processors to provide the Service. Current sub-processors include:
- Amazon Web Services — cloud hosting and storage;
- Stripe — subscription billing and payments;
- Email and SMS providers — delivery of notifications and one-time passcodes.
We impose data-protection obligations on our sub-processors that are consistent with this DPA, and we remain responsible for their performance. We will give you a way to learn of changes to sub-processors and a reasonable opportunity to object.
5. Data-subject requests
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures — insofar as this is possible — in fulfilling your obligation to respond to requests from data subjects exercising their rights.
6. Security
We maintain measures designed to protect personal data, including encryption in transit, access controls, network protections, and audit logging, and we review these measures over time.
7. Personal-data breaches
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, and provide information reasonably available to us to help you meet your notification obligations.
8. International transfers
Where a sub-processor processes personal data outside the Kingdom of Saudi Arabia, we take steps intended to ensure an adequate level of protection consistent with the PDPL and to bind recipients to appropriate safeguards.
9. Deletion and return
On termination of the Service, and subject to legal retention requirements (including Saudi tax-record rules), we will delete or, on request, return the personal data we process on your behalf.
10. Audit
On reasonable written request, we will make available information necessary to demonstrate compliance with this DPA, subject to confidentiality and the security of other customers' data.
11. General
This DPA is governed by the laws of the Kingdom of Saudi Arabia and forms part of our Terms of Service. For DPA questions or to request a signed copy, email legal@quickiebill.com.