GDPR and UK GDPR

In most standard service scenarios, the customer acts as the controller for personal data included in URLs, HTML, templates, payloads, billing data, invoice data, generated documents, or other Customer Data submitted through the service.

In those scenarios, Saliox.com acts as a processor, processing personal data solely on the documented instructions of the customer as set out in the Terms, DPA, and customer configuration choices.

For account registration, billing, fraud prevention, support, website analytics, and legal compliance, Saliox.com may act as a controller for that personal data in its own right.

Customers choose what data to send to the service, how templates are configured, which outputs are generated, and how output files are delivered.

Available delivery models may include direct response delivery, time-limited platform storage, content delivery links, or delivery to the customer’s own configured storage destination such as an S3-compatible bucket. These options are intended to support different retention and architecture requirements.

Depending on how the service is used, the personal data processed may include names, business contact details, postal addresses, billing details, invoice line items, transaction references, customer identifiers, content rendered into documents, and any other personal data included by the customer in source files, templates, URLs, HTML, or API payloads.

The service is not intended for special category data unless the customer has independently determined that such use is lawful and appropriate and has implemented appropriate safeguards.

We maintain technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures may include access controls, authentication safeguards, role-based restrictions, logging, monitoring, infrastructure security controls, encryption in transit where supported, and operational procedures for incident response and service resilience.

No system can guarantee absolute security, and customers remain responsible for securing their own accounts, integration points, storage destinations, and downstream systems.

We may use carefully selected subprocessors and infrastructure providers to deliver the service, including providers of hosting, storage, networking, logging, customer support, monitoring, payment processing, and email delivery.

We remain responsible for the acts and omissions of our subprocessors to the extent required by applicable data protection law and our DPA.

You should publish and maintain a dedicated subprocessors page identifying the categories of providers you use and, where appropriate, the provider names, locations, and functions.

Personal data may be processed in the United Kingdom, the European Economic Area, and other jurisdictions where our subprocessors or infrastructure providers operate.

Where personal data is transferred outside the United Kingdom or EEA and an adequacy regulation or adequacy decision does not apply, we intend to rely on appropriate safeguards such as the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, the European Commission’s Standard Contractual Clauses, or equivalent lawful transfer mechanisms.

Where the customer is the controller, the customer is responsible for responding to data subject requests, including requests for access, rectification, erasure, restriction, objection, or portability.

Where we act as a processor, we will provide reasonable assistance to the customer, taking into account the nature of the processing and the information available to us, to help the customer fulfil its obligations under applicable data protection laws.

If we become aware of a confirmed personal data breach affecting personal data processed on behalf of a customer, we will notify the customer without undue delay after becoming aware of the breach, to the extent required by applicable law.

Such notification may be delayed where necessary to comply with legal obligations, preserve evidence, prevent further harm, or follow the instructions of law enforcement or regulators.

Personal data processed through the service is retained only for as long as needed to provide the service, comply with customer configuration choices, maintain security and abuse controls, meet legal obligations, resolve disputes, and enforce agreements.

Because retention can vary by feature, delivery mode, logs, backups, and customer configuration, you should publish a separate retention page or table describing the current retention periods for account data, generated files, temporary files, logs, templates, and support records.

Where customers use the service to generate invoices, PDF/A-3 files, embedded XML, Factur-X, ZUGFeRD, EN16931, or similar outputs, the customer remains responsible for determining what personal data is included in those outputs and whether that processing is lawful for the relevant invoicing, accounting, tax, procurement, or archival purpose.

Compliance-related features do not change the customer’s role as controller for the underlying invoice data unless expressly agreed otherwise in writing.