Data processing agreement (DPA)

Last updated: November 4, 2026. Version 1 of this document.

This agreement governs how we process, on behalf of each customer company, the personal data it stores in billquill, in accordance with Article 28 GDPR.

1. Parties and acceptance

Controller: the customer company that creates an account in billquill (the «Customer»). Processor: Human Talent & Me, a Bulgarian company operating the billquill brand, with registered address at Str. Stefan Verkovich 10, 4000 Plovdiv (Bulgaria) and VAT number BG205568902. Its business address is European Trade Center, Building D, 1F, 115 M Tsarigradsko Shose Blvd., Sofia 1784 (Bulgaria) («we»).

The person who signs the company up accepts this agreement on its behalf when creating the account; we record the date, the accepted version, the language, the IP address and the browser. It forms part of the terms of use and, in case of conflict regarding personal data, this agreement prevails.

2. Subject matter, duration, nature and purpose

Subject matter: hosting, storing, organizing, consulting, sending, reading with AI when the Customer asks for it, and erasing the data the Customer stores in billquill or receives through it.
Purpose: providing the billquill service and the features the Customer enables.
Duration: while the Customer has an account, plus the deletion period set out in «End of processing».

3. Data and data subjects

Data subjects: the Customer's clients, suppliers, sales agents and their contact people; users of its customer portal; people who accept its quotes or pay its invoices; and its own users.
Data: identification, contact and tax data, addresses, bank details (such as IBANs), invoices, quotes, expenses, bank transactions and statements, payments, commissions, documents and attachments, emails, tickets and portal messages, and any other data the Customer chooses to store.
The Customer must not store special categories of data (Art. 9 GDPR) unless it has a legal basis to do so and does it with appropriate safeguards.

4. Customer's instructions

We process the data only on the Customer's documented instructions, which are this agreement and the Customer's configuration and use of billquill. We do not use it for our own purposes. If an instruction seems to infringe the law, we will say so. If the law requires us to process data otherwise, we will inform the Customer beforehand, unless the law prohibits it.

5. Confidentiality

People authorized to process the data are bound by confidentiality. Our staff only access a company's account when one of its administrators authorizes support access, in read-only mode and for the authorized time, and every access is recorded; or when necessary to resolve a technical incident.

6. Security measures (Art. 32 GDPR)

Encryption in transit (HTTPS), and payment provider keys encrypted at rest.
Isolation of each company's data in every query, and role-based access control within it.
Passwords hashed with bcrypt, API keys stored only as a hash, attempt limits and sessions ended when users are deactivated.
Private files served through links that expire.
Verified signatures on the notices we receive from Stripe and PayPal.
Database backups.

7. Sub-processors

The Customer gives us general authorization to engage the sub-processors listed in the privacy policy. We bind them by contract to data protection obligations equivalent to those in this agreement and remain liable for their compliance.

We will give 30 days' notice of any new or replaced sub-processor in the application or by email. If the Customer objects on reasonable data protection grounds and no solution is found, it may close its account without penalty.

Services the Customer connects on its own (its Stripe and PayPal accounts, and the addresses of its webhooks or tools that use its API keys) are not our sub-processors: the Customer chooses and contracts them.

8. Assistance to the Customer

billquill lets the Customer view, correct, export and delete data to handle data subjects' rights, within the limits of its billing mode. If a request reaches us directly, we will forward it to the Customer without answering it ourselves.
We will help the Customer, with the information available to us, with its impact assessments and consultations with the supervisory authority.

9. Security breaches

We will notify the Customer of any security breach affecting its data without undue delay and, where possible, within 48 hours of becoming aware of it, with the information available so it can meet its own notification obligations.

10. International transfers

Transfers made by our sub-processors outside the EEA rely on an adequacy decision (including the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

11. End of processing

While the agreement is in force, the Customer can download its issued invoices, received invoices and expenses as CSV files, and its documents. When the Customer closes its account, it has 30 days to download its data or cancel the closure; then we delete it, and backups are overwritten within 12 months at most. We will only keep what the law requires us to keep.

12. Information and audits

We will make available to the Customer the information needed to demonstrate compliance with this agreement. The Customer can request it at privacy@talent360hub.com and, if it is not enough, carry out an audit once a year, with 30 days' notice, at its own cost and without access to other customers' data.