Privacy Notice

Effective date: not yet effective. The NetDue operator named in the customer's order form must be identified here, together with its registered address and privacy contact, before public onboarding.

1. Who is controller and processor

The business creditor normally decides why and how debtor, invoice and recovery data is used and is the controller for that workspace data. The NetDue operator acts as its processor when it stores that data and carries out configured workflows. The operator acts as a controller for account administration, subscription billing, security, abuse prevention, support and compliance records. The final customer data processing agreement must document instructions, confidentiality, security, subprocessor, assistance, deletion and audit terms.

2. Information and purposes

We process account identity and workspace membership; business verification and reviewer records; debtor business contacts; invoices, credits, balances and payment status; encrypted BACS instructions; accounting OAuth tokens and provider identifiers; email/SMS content, consent, suppression and delivery events; disputes, recovery decisions, draft legal documents and audit events; subscription and support records; and technical security logs.

We use this information to authenticate users, provide and secure the service, import and reconcile data reported by providers, carry out authorised credit control workflows, prevent repeat contact after an opt out or bounce, protect payment instructions, administer subscriptions, investigate incidents, support users and meet legal obligations. The customer must establish its lawful basis for processing debtor data. For the operator's controller activities, likely bases include contract, legal obligation and legitimate interests, subject to the final specialist assessment.

3. Recipients and subprocessors

Depending on the features enabled, data may be processed by Replit services for application hosting, databases and object storage; Clerk for authentication; Stripe for subscription billing; Resend for email; Twilio for SMS; Backblaze B2 for encrypted backups; and Xero, Intuit QuickBooks or Sage for accounting connections authorised by the customer. Professional advisers and authorities may receive limited data where necessary and lawful. Before launch, the production subprocessor register must name the contracting entities, locations, purpose and process for notifying customers of changes.

4. International transfers

Some suppliers may process data outside the UK. Before launch, the operator must document each transfer route and the relevant UK adequacy regulation, International Data Transfer Agreement, UK Addendum or other lawful safeguard, together with any required assessment of transfer risk. This draft does not claim that every transfer is already approved.

5. Retention, legal holds and backups

Live workspace data is retained while the account is active and until a verified erasure request is completed. Suppression records may need separate retention to honour opt outs and prevent repeat contact. Subscription, tax, security, dispute or legal records may be retained where the operator has a documented legal obligation or legal hold. The final schedule must assign an owner and period to every category; public onboarding is blocked until it is approved.

Encrypted database backups use a rolling 30 day expiry target. They cannot be selectively rewritten for one workspace. Data erased from the live service may therefore remain in encrypted backups until those backups expire, unless preservation is legally required. A restore must reapply completed erasure requests before restored data is used operationally.

6. Erasure requests

A signed integration deletion request creates a lasting record with a pending, completed or failed status. A failed request is not shown as complete. It must be retried or escalated to the operational owner. Deleting data from the live database and clearing private documents can fail independently, so evidence of completion and a review of any exceptions are required. Deleting NetDue data does not automatically delete records controlled by the customer, accounting provider, communications provider, identity provider or billing provider.

7. Security and incidents

Controls include workspace access checks, encryption for stored credentials and payment instructions, private document storage, audit records and signed webhooks. No system is guaranteed secure. The operator must maintain procedures for access reviews, vulnerability management, incident response and breach assessment, and notify affected controllers where required by the data processing agreement and law.

8. Rights and complaints

People may have rights to access, rectification, erasure, restriction, objection, portability and to complain to the UK Information Commissioner's Office, subject to legal conditions and exemptions. Debtors should usually contact the creditor that supplied their information; NetDue will support that controller. Account users may contact the privacy address identified in their order/onboarding notice. The operator must verify identity and route each request without exposing another workspace's data.

9. Automated processing

NetDue can schedule reminders and calculate risk or eligibility indicators, but the product is designed to keep formal recovery approval with an authorised human. Customers must not use indicators as the sole basis for a decision producing legal or similarly significant effects without an appropriate lawful process and review.

10. Changes

The final notice must state how material changes and subprocessor changes are communicated and keep a record of each version and its effective date. This draft is not approval to open public onboarding.