Privacy Policy

Last updated on Jun 21, 2026

 

Privacy Policy

Last updated: 21 June 2026

Data Controller: SMART DIGITAL SOLUTIONS LTD, 128 City Road, London, EC1V 2NX, United Kingdom
Company Registration: 17267458
Email: contact@we-bills.com

 


 1. Introduction

We-Bills ("we", "us", "our") is committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our invoicing and accounting platform.

 

2. Data We Collect

2.1 Account Data: Name, email address, company name, VAT number (if provided), phone number, billing address.

2.2 Financial Data: Invoice details, expense records, payment transactions, bank account information (if connected), tax identifiers.

2.3 Usage Data: IP address, browser type, device information, access logs, feature usage statistics, cookies and similar technologies.

2.4 Client Data: Names, emails, and addresses of your clients that you add to the platform (you are the data controller for this data).

 

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

  • Contractual necessity (Art. 6(1)(b)): To provide our invoicing and accounting services
  • Legal obligation (Art. 6(1)(c)): Tax reporting, fraud prevention, regulatory compliance
  • Legitimate interests (Art. 6(1)(f)): Platform security, service improvement, customer support
  • Consent (Art. 6(1)(a)): Marketing communications, non-essential cookies

4. How We Use Your Data

 

  • To provide and maintain the We-Bills platform
  • To process payments and manage subscriptions
  • To send service notifications and account updates
  • To provide customer support and respond to inquiries
  • To ensure platform security and prevent fraud
  • To comply with legal and tax obligations

  • To improve our services (anonymized data only)

     

5. Data Retention

Active accounts: Data retained for the duration of your subscription plus 7 years (tax record requirement).

Cancelled accounts: After account closure, personal data is deleted within 30 days, except for anonymized usage statistics and legally required financial records.

Backups: Daily automated backups retained for 30 days.

 

6. Your GDPR Rights

Under GDPR, you have the following rights:

  • Right to access (Art. 15): Request a copy of your personal data
  • Right to rectification (Art. 16): Correct inaccurate or incomplete data
  • Right to erasure ("Right to be forgotten") (Art. 17): Request deletion of your data
  • Right to restrict processing (Art. 18): Limit how we use your data
  • Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
  • Right to object (Art. 21): Object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7(3)): Withdraw consent at any time
  • Right to lodge a complaint (Art. 77): File a complaint with your supervisory authority

To exercise these rights: Email contact@we-bills.com with subject "GDPR Request". We respond within 30 days.

 

7. Data Transfers Outside the EEA

Your data is primarily stored in EU data centers. If any data transfer outside the EEA is necessary, we use Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions for recognized countries.

We never transfer personal data to countries without adequate protection.

 

8. Data Security

  • 256-bit AES encryption for data at rest
  • TLS 1.3 encryption for data in transit
  • Role-based access control (RBAC)
  • Multi-factor authentication (MFA) available
  • Daily automated backups with 30-day retention
  • Regular security audits and penetration testing
  • ISO 27001 certified hosting infrastructure

 

9. Cookies and Tracking Technologies

We use cookies for:

  • Essential cookies: Platform functionality, authentication, security (always active)
  • Analytics cookies: Google Analytics, Mixpanel (with IP anonymization) — requires consent
  • Marketing cookies: Conversion tracking — requires consent

You can manage cookie preferences via our cookie banner. Essential cookies cannot be disabled.

 

10. Third-Party Processors

We use the following data processors, all GDPR-compliant with Data Processing Agreements (DPAs):

  • Stripe: Payment processing
  • Google Analytics: Usage analytics (anonymized IP, data retention limited)

 

11. Data Breach Notification

In the event of a personal data breach, we will:

  • Notify the relevant supervisory authority within 72 hours
  • Notify affected users without undue delay if the breach poses a high risk
  • Document all breaches for regulatory compliance

 

12. Children Privacy

We-Bills is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe we have collected data from a minor, contact us immediately.

 

13. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email at least 30 days before taking effect. The "Last updated" date at the top indicates the current version.

 

14. Contact and Supervisory Authorities

 

Data Protection Officer (DPO):

Email: contact@we-bills.com
Address: 128 City Road, London, EC1V 2NX, United Kingdom

Supervisory Authorities:

  • EU: Your local data protection authority based on your country of residence
  • UK: Information Commissioner Office (ICO) — ico.org.uk