InvoiceBot Data Processing Agreement

Terms · Privacy · Data processing

Version of 9 September 2026.

An agreement between KidmaTech (ח.פ 328628482), Sd. Yerushalayim 3a/3, Kiryat Bialik, Israel, and the business that has connected InvoiceBot (the "Business").

The agreement is accepted by the business owner personally, by ticking the box in the connection form; an accountant cannot do it for them. The date, the version of the text, the language and the address used to connect are recorded in the system.

This document exists because Israel's 2017 Data Security Regulations require it directly: whoever holds someone else's database of personal data must have a written agreement about it with the database's owner.

1. Roles

The law calls these roles "database owner" and "database holder". Here, for simplicity: the Business and KidmaTech.

The Business is the owner of the database of its clients. It decides what data to collect and why, and answers to its own clients for the lawfulness of that collection — including notifying them about the processing and obtaining the necessary consent.

KidmaTech is the holder of the database: it stores and processes this data on the Business's instruction and only to the extent needed for the service to work.

2. What data and what operations

KidmaTech processes: the name of the Business's client, phone, email address, tax ID or ח.פ, the Business's internal note, details of documents issued (service, amount, date, payment method, last four digits of the card, document number and link), and payment details.

Operations: receiving and storing, displaying to the Business, transmitting to the Business's accounting system (FinBot or Rivhit) and to the payment system (CardCom) in order to issue a document and take payment, anonymising, and deleting on request.

There is a single purpose: running the document-issuing service. Using this data for KidmaTech's own purposes — advertising, resale, profiling, training models — is prohibited, and KidmaTech does not do it.

3. Term

For as long as the InvoiceBot connection is active. After it ends — see section 8.

4. Where the data is stored

On a server in Germany (Frankfurt, Oracle Cloud), that is, within the European Union. In accepting this agreement, the Business knows and accepts this. KidmaTech gives advance notice of any change to the country of storage.

5. Security measures

KidmaTech undertakes to:

store access keys to the Business's accounting system, bot tokens and card tokens encrypted, keeping the key material apart from the database;
grant access to the data only to those of its people who need it for their work, and only to the extent needed;
ensure that such people are bound by a duty of confidentiality and know the rules for handling the data;
separate the data of different businesses so that one cannot see another's;
keep backups and protect them no less strongly than the database itself;
transmit data only over secure connections.

6. Engaging third parties

KidmaTech engages only those without whom the service does not work: the Business's accounting system (FinBot or Rivhit — as the Business itself chooses), the CardCom payment system, Telegram as the environment the bot runs in, Google for the accountant's sign-in to the console, and Oracle Cloud as the hosting provider. KidmaTech gives the Business advance notice before engaging a new contractor that would gain access to the data; the Business may object and, in that case, terminate this agreement.

7. Incidents

If an event occurs in which the Business's data may have reached outsiders, been altered or lost, KidmaTech informs the Business without delay and passes on everything it knows: what happened, which data is affected, and what has already been done. KidmaTech notifies the Israeli Privacy Protection Authority in those cases where the law requires KidmaTech itself to do so, and helps the Business fulfil its own duty to notify.

8. Return and destruction

Once the connection ends — at the Business's request and no later than 30 days — KidmaTech:

provides the Business's data in machine-readable form (an export without keys and tokens), and
deletes it from the working database and from backups, within the normal cycle in which those backups are rotated.

The access key to the Business's accounting system is erased immediately on disconnection.

The exception is information KidmaTech is required by law to keep. Such records remain, but the personal data inside them is anonymised: name, phone, email and tax ID are erased, while the amount, date and document number stay.

9. Verification

The Business may ask KidmaTech for information on how this agreement is being performed: which protective measures are applied, who has access, and whether there have been incidents. KidmaTech replies within a reasonable time.

10. Rights of the Business's clients

A request from the Business's client — to see their data, correct it or delete it — is addressed to the Business: the database is theirs. KidmaTech provides the means to carry that out (export, anonymisation, deletion) and assists if the Business asks.

11. Miscellaneous

This agreement is an annex to the Terms of Use and applies together with them. The law of the State of Israel applies.

KidmaTech · Sd. Yerushalayim 3a/3, Kiryat Bialik, Israel · invoice_bot@kidmatech.com