Data Processing Agreement (Summary)

Version 1.0 · This summary describes the processing terms under which Techneek Global Ltd processes personal data on behalf of a client business. The full DPA is available on request.

1. Parties & roles

The client business is the data controller; Techneek is the data processor / data intermediary for invoice content. This Summary applies to personal data contained in e-invoices and transmission records.

2. Scope & purpose

Techneek processes personal data only to provide the InvoiceNow e-invoicing service: transmitting invoices and credit/debit notes to the Peppol network, retrieving delivery receipts, operating the portals, and supporting the client. Techneek does not sell personal data.

3. Instructions

Techneek processes personal data on the client's documented instructions, which include the ordinary operation of the service and any support instructions given through the portal or support channel.

4. Confidentiality

Personnel authorised to process personal data are bound by confidentiality obligations and, for admin access, authenticated with role-based access control and optional multi-factor authentication.

5. Security

Techneek implements appropriate technical and organisational measures, including: encrypted storage of portal credentials used to authenticate transmissions; HTTPS transport; access control; append-only audit logging; durable outbox with retry; and offsite backups.

6. Sub-processors

The client authorises the engagement of the following sub-processors, and Techneek will give notice of changes:

• Billbay Pte. Ltd. — the Peppol Access Point used to transmit and receive documents.
• Cloud hosting provider — infrastructure hosting the middleware, portals and database.

7. Data subject requests

Techneek will assist the client, taking into account the nature of processing, in responding to data subject requests (access, correction, deletion) to the extent required.

8. Breach notification

Techneek will notify the client without undue delay after becoming aware of a personal data breach affecting the client's data, and will provide information reasonably required by the client to meet its own notification obligations.

9. Retention & deletion

Personal data is retained for the periods set out in our Data Retention Policy. On termination, personal data is deleted or returned in accordance with that policy and applicable law.

10. Contact

To request the full DPA or raise a data-protection matter, contact support@techneekglobal.com.