Legal
Data Processing Information
This page provides additional transparency about the processing activities behind this website.
Controller
Aisha, trading as InvoiceHarbour Cloud, 307 Plumstead High, SE18 1JX, United Kingdom. Contact: contact@invoiceharbour.co.uk.
Processing activities
- Enquiry handling: name, business, email, telephone, website, enquiry category and message. Retained up to twenty-four months.
- Order processing: package purchased, amount, payment status, session reference and checkout email. Retained six years for tax and accounting purposes.
- Support correspondence: emails you send and our replies. Retained for the life of the customer relationship plus two years.
- Abuse prevention: IP address and timestamp of enquiry and checkout attempts. Retained for a short period only.
Lawful bases
Performance of a contract for order processing and delivery; legitimate interests for enquiry handling and abuse prevention; legal obligation for financial record keeping; consent where you tick the privacy consent box on the enquiry form.
Sub-processors
- Stripe Payments Europe, Ltd. and affiliates - payment processing and fraud prevention.
- Hostinger International Ltd. - website hosting and email delivery infrastructure.
- Google LLC - web font delivery (no cookie set, IP address processed in transit).
Security measures
- HTTPS enforced across the whole website with HSTS.
- Secret keys held in a protected configuration file outside the public web directory, or in server environment variables.
- Server-side validation of every package, price and payment; the browser never determines an amount.
- Stripe webhook signatures verified before any event is processed.
- Rate limiting on public endpoints and honeypot protection on the enquiry form.
- Directory listing disabled, sensitive file types blocked and PHP errors never displayed.
Data subject requests
Requests can be made at any time by emailing contact@invoiceharbour.co.uk and are answered within one month.
Breach procedure
Any personal data breach is assessed immediately. Where it is likely to result in a risk to individuals it is reported to the Information Commissioner's Office within seventy-two hours and affected individuals are informed without undue delay.
Contact
Questions about this document can be sent to contact@invoiceharbour.co.uk or posted to 307 Plumstead High, SE18 1JX, United Kingdom.
InvoiceHarbour Cloud is independently owned and operated by Aisha as a sole trader in the United Kingdom. This document is provided for transparency and does not constitute legal advice. It has not been reviewed or approved by a solicitor. Nothing in this document removes or limits your statutory rights as a consumer in the United Kingdom.
Ready to bring more structure to your invoicing?
Compare the six InvoiceHarbour Cloud packages and choose the record capacity, workflow features and setup support that match how you invoice.