Información legal

Data Processing Addendum

Última actualización: 21 oct 2026

This addendum applies when you use Receivly to process personal data of your customers and contacts. You are the controller of that data; Rchid Salah Eddine Architecte is your processor. It forms part of the Terms of Service and is accepted with them.

1. Subject and duration

Processing: hosting and processing of your customers’ contact details, invoices, payments, promises, notes, portal submissions and message history, to provide the receivables follow-up service. Duration: for as long as your workspace exists, then deletion as described below.

2. Our commitments

We process the data only on your documented instructions (your use of the service and settings), unless the law requires otherwise, in which case we inform you unless prohibited.

Everyone with access to the data is bound by confidentiality.

We apply the security measures described on the Security page (encryption in transit, row-level isolation per company, access control, two-factor authentication, encrypted secrets, backups).

3. Sub-processors

You authorise the sub-processors listed on the Sub-processors page. We will announce new sub-processors in the app at least 30 days in advance; you may object by closing your workspace before the change. We impose on them data-protection obligations equivalent to this addendum.

4. International transfers

Data is stored in the European Union (Frankfurt, Germany), a destination recognised by Morocco’s CNDP as offering adequate protection. Some providers are US companies (for example Vercel, Resend) and may access data for support or operations; such transfers rely on their standard contractual clauses or equivalent safeguards. If you are established in Morocco, you remain responsible for the formalities of Law 09-08 for your own processing, including any CNDP declaration or transfer authorisation that applies to you.

5. Assistance

We help you, taking into account the nature of the processing, to answer data-subject requests (the export, edit and delete tools are built in), to ensure security, and with impact assessments and consultations where required.

6. Personal-data breaches

We notify you without undue delay, and where possible within 48 hours, after becoming aware of a breach affecting your data, with the information available to help you meet your own notification duties.

7. End of service

When you delete your workspace, its data is deleted from the live database immediately; backups expire within their normal retention period (up to 30 days). Export your data before deleting.

8. Audits

We make available the information needed to demonstrate compliance with this addendum (this document, the Security and Sub-processors pages, and written answers to reasonable questionnaires). On-site audits may be agreed in writing at your expense.