Last updated: 01.04.2024

INTRODUCTION

Bill.me LTD and its group companies and affiliates (hereinafter – Bill.me or we) understand that You are aware of and care about Your personal data protection, and we take that seriously, ensuring that our personal data processing practices are in compliance with the requirements of the General Data Protection Regulation (EU) 2016/679, as well as the UK GDPR. This Privacy Policy describes policies and practices regarding our collection and use of Your personal data offering our services and solutions at the website www.bill.me (hereinafter referred to as the Website), as well as sets forth Your privacy rights. We recognise that personal data protection is an ongoing responsibility, and we may from time to time update this Privacy Policy, as we undertake new personal data processing practices.

This Privacy Policy applies to You as:

an employee or representative of our cooperation partner (hereinafter - Cooperation partner); or
clients of our Cooperation partners (property management service providers, utility service providers, telecommunication service providers, municipality services providers, educational services providers or any other service provider with whom You have a contract and who uses Bill.me invoice delivery solutions) (hereinafter - the Client);
Persons engaged by the Client to receive, pay invoices (hereinafter - Delegated user).

INFORMATION ABOUT CONTROLLERS

Bill.me, within the framework of cooperation with the aim of providing Clients with an electronic invoice receipt and payment solution, processes personal data in the status of joint controller with Cooperation partners who provide You with services and who are indicated in Your Bill.me profile.
On the other hand, with regard to any processing of personal data that Bill.me and the Cooperation partners carry out for individually determined purposes, Bill.me and the Cooperation partners are considered separate controllers.
In addition to that, Bill.me provides the possibility for Clients to receive invoices in Bill.me's personal profile from the Client's service providers who are not direct Cooperation partners of Bill.me (via sending invoices by the Client himself to the unique Client Bill.me e-mail address or by authorizing Bill.me to receive these invoices directly from a specific service provider). In such a case, the specific Client’s service provider and Bill.me are considered as separate controllers.

WHAT PERSONAL DATA WE MAY COLLECT AND FOR WHAT PURPOSES IT IS USED

Provision of services and provision of Website tools

We process personal data to provide You with the Website tools and to provide the requested services (allow to get acquainted with the invoices sent by the Cooperation partners, as well as the Client’s service providers (who are not direct Cooperation partners of Bill.me), pay the invoices, pay for the services, submit the meter readings, participate in polls organized by Cooperation partners on the Website).

Data subject categories	Client, Delegated user
Data categories	Contact information (first name, last name, e-mail address, address, phone number); Information related to the invoice issued and/or service provided by the Cooperation partner/Client’s service provider, who is not a direct Cooperation partner of Bill.me (customer number, name of the service, invoice number, date, meter data, amount); Payment method information (if You use the invoice payment option enabled on the Website); Information about the enabled autopayment; Payment status; Payment history; Personal code or identification number; Submitted meter readings; Information related to the Client's authorisation for Bill.me to receive invoices from the Client’s specific service provider.
Legal basis of processing	Depending on the specific situation, the legal basis for processing may be: Fulfillment of agreement obligations; Fulfillment of statutory obligations; Bill.me legitimate interest in ensuring the provisions of services.
Duration of processing	During the entire registration and use of the Website tools and 5 years after the end of the cooperation.

Administration of Cooperation partners/Clients service providers

We process the data of employees and signatories of our Cooperation partners/Clients service providers in order to conclude and also to fulfill the agreements concluded during cooperation and to ensure the provision of quality services.

Data subject categories	Employees, contacts, signatories of Cooperation partners/Clients service providers
Data categories	Contact information (first name, last name, address, phone number, e-mail address); Information related to the workplace (about representation rights, workplace address, current position); Information related to cooperation within the framework of specific concluded agreement; Information related to questions, claims, reviews; Information on cooperation within the framework of a specific agreement concluded or to be concluded.
Legal basis of processing	Depending on the specific situation, the legal basis for processing may be: Fulfillment of agreement obligations; Bill.me legitimate interest in ensuring the provision of quality services – to ensure or initiate cooperation, to provide an appropriate service.
Duration of processing	Throughout the term of the agreement and 5 years after the end of the agreement.

Processing of feedback, questions, and complaints

We process personal data in order to answer Your questions, complaints and feedback.

Data subject categories	Client, Delegated user and Cooperation partner/Client service provider
Data categories	Contact information (first name, last name, e-mail address, telephone number); Information provided by a person in writing, electronically or by phone when contacting us with a feedback, question or complaint; Information provided by a person when participating in customer surveys, including customer satisfaction surveys; Information related to the resolution of a person's feedback, question or complaint, or examination of a survey.
Legal basis of processing	Depending on the specific situation, the legal basis for processing may be: Your consent; Fulfillment of agreement obligations; Fulfillment of statutory obligations; Bill.me legitimate interest in providing quality services and solving problem situations.
Duration of processing	Throughout the term of the agreement and 5 years after the end of the agreement. If the legal basis for the processing is Your consent - until the withdrawal of consent.

Marketing activities implementation

If You have given Your consent, we can use Your contact information to send You offers, news, and other information that may be relevant and interesting to You. You have the right to opt out of receiving these offers at any time.

Data subject categories	Client, Delegated user
Data categories	Contact information (first name, last name, address, e-mail address, phone number).
Legal basis of processing	Your consent.
Duration of processing	Until withdrawal of consent.

Ensuring and improving the security of the Website

We use the data collected automatically when You visit the Website to improve and customize the Website, identify and resolve technical and security issues, generate usage statistics and for other purposes related to improving of our operations.

Data subject categories	Visitors of the Website (Clients, Delegated users and Cooperation partners/Client service provider)
Data categories	Data related to visiting the Website (IP address, MAC address, date and duration of visit, devices or apps used, navigation on the Website, location data, web log entries (weblogs), other communication data and resources You access).
Legal basis of processing	Depending on the specific situation, the legal basis for processing may be: Legitimate interest; Your consent.
Duration of processing	If the legal basis for the processing is Your consent - until the withdrawal of consent. If the basis of processing is legitimate interest - 1 year.

Fulfillment of Bill.me statutory obligations

Under the certain situations Bill.me may be required to transfer personal data to state authorities, such as law enforcement or other authorities.

Data subject categories	Client, Delegated user
Data categories	Contact information (first name, last name, e-mail address, phone number); Any other information that the responsible state authorities are entitled to request under applicable law.
Legal basis of processing	Fulfillment of statutory obligations.
Duration of processing	Until the purpose of processing is achieved.

Personnel selection/recruitment

Bill.me processes Your personal data if You have applied for one of the published vacancies or sent Your CV outside the recruitment process.

Data subject categories	Candidates
Data categories	Contact information (first name, last name, address, e-mail address, phone number); Information included in the CV (education, work experience, skills); The information contained in the motivation letter; Information provided during the interview.
Legal basis of processing	Legitimate interest in recruiting; Your consent.
Duration of processing	The data of the successful candidates will be stored in accordance with the terms of the internal employee privacy policy.The data of the other candidates will be stored for 1 year in case of consent of the candidates.

HOW WE COLLECT PERSONAL DATA

Bill.me collects the personal data that You provide to us when registering at the Website as a Client or Delegated user, by sending us invoices issued by your service provider (who is not a direct Cooperation partner of Bill.me), cooperating with us as a Cooperation partner, applying for a job vacancy or communicating and interacting with Bill.me in any other way.

In addition, Bill.me may collect Your personal data from third parties, for example:

from the specific Cooperation partner that provides services to You as a Client within the framework of the agreement concluded between both of You;
from a specific Client service provider in cases where you as a Client have authorized us to receive invoices from this specific service provider;
from Bill.me payment service providers.

HOW LONG WE WILL KEEP YOUR PERSONAL DATA

We will keep personal data necessary for the fulfillment of Bill.me legal or contractual obligations during Your cooperation with Bill.me, as well as for 5 years after the end of cooperation. This means that if You stop using our Website or Website Tools, we will continue to maintain certain personal data to comply with our legal obligations. Data, the processing of which is based on the legitimate interest of Bill.me, will be stored according to the specific legitimate interest for certain periods. Personal data processed on the basis of Your consent will be stored until the consent is withdrawn.

USE OF THE WEBSITE BY MINORS

The Website and Website Tools are not intended for persons under the age of sixteen and we kindly ask such persons to not disclose their personal data to us.

HOW WE DISCLOSE PERSONAL DATA

In certain circumstances we may disclose the personal data we have collected about You to the following categories of recipients:

Delegated user. At the Client’s request, by enabling such an option, we transfer the information related to the invoice issued by the specific Cooperation partner to the Client’s selected Delegated user in order to enable this Delegated user to receive, pay the invoice at the Website jointly with the Client;
Cooperation partner. We transfer the payer's data to the specific Cooperation partner whose services You as a Client receive in order to fulfill contractual obligations between the Cooperation partner and You as his client. In the case of polls held on the Website by the Cooperation Partner, we transfer data to the Cooperation Partner if you decide to participate in the respective poll. Please note that Your personal data is processed simultaneously in accordance with the privacy policy of Your specific Cooperation partner;
Client service provider. In cases where the Client sends us or has authorized us to receive invoices from the Client's service provider, who is not our direct Cooperation partner, we transfer the Client's data to the specific Client's service provider in connection with the payment of the invoice. Please note that your personal data is simultaneously processed in accordance with the privacy policy of your specific service provider;
Our group companies. In order to provide our services to You (as a Cooperation partner) and the Website Tools to You (as a Cooperation partner or Client), we provide personal data to the specific Bill.me group company in the respective country where You receive our service. Personal data is not disclosed to other Bill.me group companies located in other countries where You do not receive Bill.me services;
Service providers. We disclose personal data to our service providers only when it is necessary to ensure the provision of our services to You (as a Cooperation partner) and the Website Tools to You (as a Cooperation partner or Client), including, but not limited to processing of payments/transactions engaging a payment service provider. Our payment service provider processes data related to Your payment only if You use the invoice payment option provided on the Website;
Third parties - financial institutions. This may include credit/financial institutions;
Third parties - in relation to a legal obligation or if we are permitted to do so by law. In certain circumstances we may be under an obligation to disclose or share Your personal data with auditors, regulatory authorities or law enforcement institutions in order to comply with a legal obligation. We may also disclose personal data, if it is permitted by law, in order to enforce or apply the Terms and Conditions or other agreements or to protect our rights, property, etc.

Your personal data will primarily be processed by Bill.me and by the Bill.me structural unit in the specific country where You as a Cooperation partner provide services to Your Clients or where the specific Cooperation partner from which You as a Client receive services is located. We would like to inform You that although Bill.me is registered in the United Kingdom, which is outside the European Economic Area (EEA), on June 28, 2021, the European Commission adopted a decision on the adequacy of the level of protection for the transfer of personal data to the United Kingdom.

In certain situations, Your data may be processed in countries outside the EEA. In such cases, we enter into European Commission Standard Contractual Clauses with the relevant service providers to ensure secure data processing.

YOUR RIGHTS

You have certain rights in respect to the way we may process Your personal data:

You are entitled to access Your personal data and receive information regarding Your personal data that we process;
You are entitled to rectify the information we have about You if it is inaccurate;
You are entitled to object to the processing of Your personal data;
You have the right to revoke Your consent for processing of Your personal data in situations, where such processing is based on Your consent;
You may also request us to erase Your personal data or cease the processing of Your personal data;
You may also request us to provide Your personal data to You or transmit it directly to another controller;
You have the right to lodge a complaint to the Information Commissioners’ Office or Data State Inspectorate (in respect to Republic of Latvia).

The right to be informed:

In this Privacy Policy, we try to provide You with essential information about the processing of Your personal data as simply and comprehensively as possible. The most important information for You can be found in the Privacy Policy section "WHAT PERSONAL DATA WE COLLECT AND FOR WHAT PURPOSES THEY ARE USED", which specifies the purposes of personal data processing, categories of data, legal basis for processing and storage conditions.

The right to access data:

You can obtain a copy of your personal data by sending us a request to dpo@bill.me.

The right to correct personal data:

If the personal data You have provided has changed (surname, e-mail address, telephone, etc.) or You believe that the information we have processed about You is inaccurate, You have the right to request that the information be changed, clarified or corrected. You can request the necessary corrections by sending us a request to dpo@bill.me.

The right to object to the processing of personal data:

If we process Your personal data on the basis of legitimate interests, we have assessed the competing interests and decided that, taking into account the purpose and means of processing the personal data, our (or the relevant third party's) interests in processing Your personal data do not exceed Your interests or fundamental rights and freedoms. However, if You believe that our data processing violates Your fundamental rights and freedoms, You can exercise Your data subject rights to object to this processing and we will re-evaluate our legitimate interests in the context of Your interests and fundamental rights. To exercise this right, send us a request to dpo@bill.me.

The right to withdraw your consent:

In cases where we process personal data based on Your consent, you have the right to withdraw Your consent at any time and such data processing will cease. For example, You can withdraw your consent to receive marketing offers at any time. Withdrawal of consent does not affect the lawfulness of data processing until the withdrawal of consent.
To exercise this right, You can do so conveniently in the following ways:

you can opt out of receiving newsletters at any time by clicking the "Unsubscribe" link in the e-mail;
in the account settings page (by disabling necessary feature);
by sending us a request to dpo@bill.me.

The right to restrict data processing:

You have the right to limit our ability to process Your personal data. After the restriction of processing, we will no longer carry out any active actions with Your personal data, except for the storage of personal data. However, restricting the processing of personal data may mean that we will not be able to provide You with services during the restriction period.

You can restrict the processing of personal data in the following cases:

Your personal data is inaccurate (in this case, the processing of personal data will be limited until the accuracy of the personal data is verified);
Your personal data is processed illegally, but You do not agree to its deletion;
We no longer need Your personal data for the specified purposes, but You need them to establish, fulfill or defend legal claims;
Your personal data is processed based on legitimate interests and You object to such processing of personal data. In this case, data processing will be restricted until we carry out an evaluation.

To exercise this right, send us a request to dpo@bill.me.

Right to delete data (right to be forgotten):

You have the right to request that we no longer process your personal data and delete it in the following cases:

personal data are no longer necessary to achieve the purposes for which they were collected or otherwise processed;
You withdraw the consent that was the basis of the data processing and there is no other legal basis for the processing;
Your personal data is processed illegally;
You have objected to the processing of personal data based on our legitimate interests and it has been determined that Your interests are more important in the particular case.

To exercise this right, send us a request to dpo@bill.me.

The right to data portability:

If data processing is based on Your consent (GDPR Article 6(1)(a)) or contract (GDPR Article 6(1)(b) and is carried out by automated means, You have the right to receive the data You have provided to us in a structured, in a widely used and computer-readable format, and if it is technically possible at Your request, Your data may be directly transferred to another data controller indicated by You.
To exercise this right, send us a request to dpo@bill.me.

The right to file a complaint:

If You believe that we are processing Your data in breach of the requirements of personal data protection legislation, please contact us directly in the first instance. We believe that with good faith and effort, we will be able to clear all Your doubts, answer Your questions, satisfy Your requests and correct the mistakes made.
If you are not satisfied with our proposed solution to the problem, you have the right to file a complaint with the Information Commissioners’ Office (Wycliffe House Water Lane, Wilmslow, Cheshire, SK9 5AF, UK, e-mail: casework@ico.org.uk, phone: +44 0303 123 1113), in respect to Republic of Latvia - State Data Inspectorate (Elijas iela 17, Riga, LV-1050, e-mail: pasts@dvi.gov.lv, phone +371 67223131).

COOKIES

The Website uses cookies to distinguish You from other visitors of the Website. This helps to provide You with a good experience while browsing the Website, and also allows us to improve the Website.

A cookie is a small text file saved by a website to Your computer or mobile device when You open/use the Website. We use third-party cookies, such as Google Analytics.

You have the right to decline the collecting and use of specific information about You through our use of cookies when You visit the Website. Your browser may communicate a refusal to receive certain kinds of cookies. Please note that You may be unable to use all the advantages of the Website without cookies.

SECURITY

All information provided by You to us is stored on secure servers and we use appropriate organisational, technical and administrative measures to protect Your personal data. Once Your information is received, we use strict procedures and security features to prevent any unauthorised access. However, please note that no transmission of information via the internet is completely secure and no storage system is guaranteed to be entirely secure. If You have any reason to believe that Your interaction with us is no longer secure, please contact us immediately.

CHANGES TO THE PRIVACY POLICY

We may change or update this Privacy Policy. Any changes we may make to this Privacy Policy in the future will be posted on the Website and any such changes will be effective starting from the date when we post the revised Privacy Policy.

We may provide You with notifications regarding the changes in the Privacy Policy by posting them on our Website.

DATA PROTECTION OFFICER

We have appointed a data protection officer, whom You may contact, should You have any questions or concerns regarding our personal data processing practices. Our data protection officer’s contact information is as follows: dpo@bill.me.

CONTACT

If You wish to contact us regarding this Privacy Policy, please use the e-mail address dpo@bill.me or the following address:

Bill.me LTD

85 Great Portland Street
London, England
W1W 7LT