GDPR Compliance at eInvoicePro.ai

Legal Basis for Processing

We process your data under the following legal bases:

• Contract Performance: To provide invoicing services you signed up for
• Consent: For optional features like analytics (you can withdraw at any time)
• Legal Obligation: To comply with tax laws and regulations (GSTN, ZATCA, etc.)
• Legitimate Interests: To prevent fraud, ensure security, and improve services

Data Minimization

We collect only the data necessary to provide e-invoicing services and ensure compliance. We do not collect excessive or irrelevant personal information.

Data Security

We implement technical and organizational measures to protect your data:

• 256-bit AES encryption for data at rest
• TLS 1.3 encryption for data in transit
• SOC2 Type II certified infrastructure
• Regular security audits and penetration testing
• Role-based access controls and audit logging
• Multi-factor authentication for all accounts

International Data Transfers

When we transfer data outside the EU/EEA, we use:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all third-party providers
• Adequacy decisions where available (e.g., UK, Switzerland)

Data Retention

We retain your data only as long as necessary:

• Account data: While your account is active
• Invoice data: 7 years (required by tax regulations)
• Marketing data: Until you opt out
• Analytics data: 2 years (anonymized)

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours
• Notify affected users without undue delay
• Describe the nature of the breach and measures taken
• Provide recommendations to mitigate potential harm