Privacy policy

Who is responsible?

The company below is the controller for personal data used to administer our website, customer relationships, accounts and support. For personal data in your company's receipts, invoices and connected systems, your company is normally the controller and we act as a processor under the relevant data processing agreement.

Data we process and its sources

We process information you provide, such as your name, work email, company details, enquiries and order information, as well as account identifiers, organisation membership, subscription status and technical activity or security records generated when you use the service. Required account and contact information is needed to provide access and respond to your requests.

Depending on the features and integrations you enable, business data may include receipts, invoice details, transaction records, relevant email content and attachments, and accounting information. This data comes from uploads and systems your organisation authorises. Processing on your organisation's instructions is covered by the data processing agreement.

Purposes and legal basis

Accounts, agreements and support: we use relevant data to set up and deliver the service and respond to enquiries. The basis is GDPR Article 6(1)(b) where you are personally a party to the contract; for a company's contact persons, it is our legitimate interest in administering the customer relationship under Article 6(1)(f).

Legal obligations: relevant transaction and accounting information is processed to meet applicable bookkeeping and other statutory requirements under GDPR Article 6(1)(c).

Operation and security: technical records and relevant usage information help us keep the service working, troubleshoot faults, prevent abuse and protect accounts. The basis is our legitimate interest in reliable and secure operation under GDPR Article 6(1)(f), balanced against your rights.

Optional website analytics: if enabled, PostHog analytics runs only after you opt in. The basis is consent under GDPR Article 6(1)(a). You can withdraw consent at any time without affecting the lawfulness of processing that already took place.

Recipients and transfers

Relevant data may be processed by suppliers for hosting, authentication, document storage and analysis, communications, technical operation and support, and by the integrations your organisation enables. Optional analytics data is sent to PostHog only with consent. Authorities or professional advisers may receive information when required by law or necessary to handle a legal claim. Suppliers acting as processors must operate under data processing agreements.

The recipients and processing locations depend on the services and integrations used. Any transfer outside the EU/EEA must have a valid legal basis, such as an adequacy decision or the European Commission's standard contractual clauses with the necessary supplementary safeguards. Contact us for information about the suppliers, locations and safeguards relevant to your agreement, including how to obtain a copy.

How long we keep data

We retain personal data for as long as needed for the purpose: account information during the customer relationship, enquiries while handling and documenting the matter, and technical records while needed for operation or security. Statutory retention duties and the need to establish, exercise or defend legal claims can require longer retention. Data no longer needed is deleted or anonymised.

Closing an account does not necessarily delete all business records immediately. Accounting obligations, third-party systems and the agreed handling of customer data must be assessed first. You can request access, export or deletion through BillPusher's privacy settings or by contacting us. We explain any restrictions when handling the request.

Your rights

Subject to the conditions in data protection law, you may request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. We may need to verify your identity. If your request concerns data controlled by your employer or another customer, we will direct it to that controller or assist on its instructions.

To exercise your rights or ask about our handling of your data, contact support@billpusher.com.

You may complain to the Danish Data Protection Agency: Datatilsynet.

Automation and AI-assisted features

Selected features can use automated matching and AI-assisted document analysis on the data your organisation submits. Your organisation controls which features and integrations it enables and is responsible for reviewing results and approving relevant business actions. Contact us for details about the processing involved in your selected features.

Cookies and local storage

Read about the language preference, optional analytics and how to change your choices in Cookies & browser storage.