Privacy policy
1. Who we are
Grissla ("the service") helps companies send invoices digitally, collect payment from the customer's bank, handle reminders and book payments back into the company's accounting system. The service is operated by[company details to be completed: registered name, business ID, address] in Åland. Contact:andreas@pdc.ax.
2. What data we process
- User accounts: email address and login credentials for those who use the admin service (handled by Supabase Auth).
- Invoice data: details fetched from the invoicing company's accounting system: the invoice recipient's name, email address, language and any e-invoicing address, plus the invoice amount, dates, references and payment status.
- Delivery data: technical information about dispatches and payments (for example that an email bounced or that a payment completed) needed for the service to work.
3. Roles under the GDPR
For the invoice recipients' personal data, the invoicing company is the controller and Grissla is the processor: we process the data solely on the company's instructions, in order to send, remind about and reconcile the company's invoices. A data processing agreement is entered into with each company. For user accounts in the admin service we are the controller.
4. Purposes and legal basis
The data is processed in order to deliver the service under the agreement with the company: sending invoices and reminders, mediating payment, sending receipts and reporting back to the accounting system. Processing of invoice recipients' contact details takes place on the invoicing company's instructions and legal basis (performance of a contract and legitimate interest in invoicing).
5. Sub-processors
We use the following sub-processors to deliver the service:
- Supabase (database and login, EU region)
- Resend (email delivery)
- FLIQ Payments (payment mediation)
- the company's own accounting system (for example Briox,Netvisor, Procountor), which the company has its own agreement with
6. Storage and erasure
All data is stored within the EU. Invoice data is kept for as long as the company uses the service, and is deleted or handed over at the company's request when the agreement ends. The company always owns its own data. Data required under accounting legislation may need to be kept longer by the invoicing company in its own systems.
7. Your rights
You have the right to request access to, rectification of and erasure of your personal data, and to object to processing. If you are an invoice recipient, please contact the company that invoiced you (the controller) in the first instance. You may also lodge a complaint with the supervisory authority: the Data Inspection Authority of Åland or the Office of the Data Protection Ombudsman in Finland.
8. Contact
Questions about the processing of personal data:andreas@pdc.ax.