Data Processing Addendum

This Addendum forms part of the Terms of Service between you ("Controller") and Quathos LLC ("Processor") and applies whenever we process personal data on your behalf through Quathos Invoice. Where it conflicts with the Terms, this Addendum prevails on data protection matters.

1. Roles

You are the controller of the personal data in your organisation (your clients, their contacts, your staff) and you decide its purposes and means. We are the processor (operator, under the LGPD) and act only on your documented instructions. Using the product is how you instruct us: registering a client, confirming an invoice, uploading a spreadsheet, configuring a recurrence and requesting a cancellation are all instructions. We will tell you if an instruction appears to breach applicable data protection law, and we may pause that instruction until it is resolved.

2. Our obligations

• Process personal data only to provide the Service, and never for our own purposes, for advertising, or to train models.
• Bind everyone with access to a duty of confidentiality, and limit access to those who need it to do their job.
• Keep the technical and organisational measures described in Annex II, and not weaken them during the term.
• Assist you with data subject requests, with data protection impact assessments and with consultations with the ANPD or other authorities, taking into account the nature of the processing and what we actually hold.
• Forward to you, without answering it ourselves, any data subject request we receive that concerns your organisation, including one from a client named in your invoices.
• Notify you without undue delay, and in any case within 48 hours of becoming aware, of any security incident affecting your personal data, with what we know and what we are doing about it, so that you can meet your own duty to notify the ANPD and the data subjects (LGPD art. 48).

3. Subprocessors

You give general authorisation for the subprocessors listed on our Subprocessors page. We impose on each of them, by written contract, obligations no weaker than these, and we remain fully responsible to you for what they do. We announce a new or replacement subprocessor at least 30 days before it starts processing; if you reasonably object on data protection grounds within that window, you may terminate the affected part of the Service and receive a pro-rata refund of the unused prepaid period.

4. Transmission to the tax authority

The signed invoice is transmitted to the Brazilian national NFS-e system (Sefin Nacional / ADN) or to the municipal system that applies to the issuer, such as ISS Fortaleza. That transmission is required by law for the invoice to exist and is made on your instruction each time you confirm an invoice or a cancellation. The public body receiving it is an independent controller, not our subprocessor, and what it does with the data is governed by the law that obliges you to send it.

5. International transfers

The data is stored in the European Union (Germany (Falkenstein and Nuremberg)), which the ANPD recognises as providing an adequate level of protection (Resolution CD/ANPD No. 32/2026; LGPD art. 33, I). The Processor is established in the United States, which has no adequacy decision; for access from there, the parties adopt the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024; LGPD art. 33, II, b). Where a transfer is subject to the GDPR or the UK GDPR, the parties adopt the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), with the UK International Data Transfer Addendum where it applies. Those clauses are incorporated here by reference, with this Addendum and its annexes supplying the information they require.

6. United States privacy laws

For personal information subject to California law, we act as a "service provider", and in equivalent roles under other state laws. We do not sell or share it, we do not retain, use or disclose it outside the direct business relationship or for any purpose other than performing the Service, and we do not combine it with personal information from other sources except as those laws permit. We certify that we understand and will comply with these restrictions.

7. Audits

On request, we provide the information reasonably necessary to demonstrate compliance with this Addendum. Where that is not enough for your regulator or your own obligations, you may audit us, or appoint an independent auditor who is not our competitor, once per year, on 30 days’ notice, during business hours, without disrupting the Service and without accessing other customers’ data. Each invoice carries its own append-only, hash-chained event trail, visible in the panel, which answers most of what an audit asks about a document.

8. Return and deletion

You can download the signed XML and the DANFSe of any invoice at any time. When the agreement ends, they remain downloadable until the end of the notice period. We then delete the organisation’s data, including every certificate, except the fiscal documents and their event trail, which the issuer is obliged to keep for the legal period (LGPD art. 16, I): we keep them for six years from issue, use them for nothing else, and delete them afterwards. Deleted data leaves the backups as they rotate, and we do not restore a backup to recover data you asked us to delete.

Annex I: details of processing

Annex II: technical and organisational measures

• Tenant isolation enforced by row-level security in the database, with the application connecting through a role that cannot bypass it; the server refuses to start otherwise. The organisation is derived from the session and is never accepted from the client request.
• The A1 certificate is encrypted with AES-256-GCM under a per-certificate key, wrapped by a master key kept outside the database and rotatable without re-uploading certificates. Its password is never stored in readable form; the decrypted material exists only while signing or opening the TLS session with the government.
• An authorized invoice is immutable; a change is a signed cancellation event. Every status change is recorded in an append-only, hash-chained event trail, and organisation acts (invitations, role changes) in a second one; database triggers refuse updates and deletes on both.
• No duplicate issuing: the invoice number is reserved under a row lock, invoice creation accepts an idempotency key, and before any retry the system asks the government whether the document already exists; when the answer is unknown, nothing is resent.
• Session cookies marked HttpOnly and never exposed to page scripts; the browser never calls the API directly; state-changing requests protected by a double-submit CSRF token; session tokens stored only as hashes; repeated failed sign-ins are throttled.
• Encryption in transit; private storage buckets without public access; file access through signed links valid for five minutes.
• Role-based access within each organisation: an accountant reads and downloads; a member issues; an administrator manages issuers, certificates, services, recurrences and cancellations.
• Spreadsheet uploads are size-limited and checked against oversized archives; text from a spreadsheet written back into a report is neutralised so that it cannot run as a formula.
• Separation of environments: production transmission is switched off by default and can only be enabled in the production environment; simulated providers and self-signed certificates are refused outside the sandbox; daily database backups.