GDPR and Your Data Rights

This page explains how ChalkBill approaches the EU General Data Protection Regulation (GDPR) and the UK GDPR. It supplements our Privacy Policy and is written for users in the EEA and UK, and for anyone curious about our data-protection practices more generally.

Our roles: controller and processor

ChalkBill plays two different roles depending on the data in question:

• Controller — for your own account data, business profile, and subscription/billing data, we decide how and why that data is processed, so we act as the data controller.
• Processor — for the client contact details and invoice data you enter about your own clients, you are the data controller (it’s your customer relationship), and ChalkBill acts as your processor, handling that data only on your instructions to provide the Service.

Legal bases for processing

We rely on performance of a contract (running the Service you signed up for), our legitimate interests (security, fraud prevention, keeping the Service reliable), consent (where we ask for it, such as replying to a support email), and legal obligation (such as billing records) as our legal bases for processing. See our Privacy Policy for more detail on each use of data.

Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data (“right to be forgotten”);
• Restriction of processing in certain circumstances;
• Portability — receiving your data in a structured, commonly used format;
• Objection to processing based on legitimate interests;
• Withdrawal of consent at any time, where we rely on consent; and
• The right to lodge a complaint with your local data protection supervisory authority.

How to exercise your rights

Email support@chalkbill.com describing what you’d like to do. We will respond within one month, as required by GDPR, and may ask you to verify your identity before acting on the request.

Exporting or deleting your data

ChalkBill does not currently have a self-serve “export my data” or “delete my account” button in the product. To request an export or deletion, email support@chalkbill.com and we will process the request manually, including deleting the client and invoice data you’ve entered where you ask us to and where we’re not required to keep it for a legal reason (such as billing records).

Sub-processors

We use a small number of service providers to run ChalkBill. The full list, with what each one does and what data it touches, is in the sharing table in our Privacy Policy.

International transfers

ChalkBill and its sub-processors may process data outside the EEA or UK, including in the United States. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards, such as standard contractual clauses, to protect it.

Data Processing Agreement

If you need a signed Data Processing Agreement (DPA) covering ChalkBill’s processing of your clients’ data on your behalf, email support@chalkbill.com and we’ll provide one on request.

Breach notification

If we become aware of a personal data breach that affects you, we will notify affected users without undue delay, and will notify the relevant supervisory authority where required by law.

Contact us

ChalkBill
[Mailing address to be added]
support@chalkbill.com