1. Who we are

BillPortal Technologies Inc. is the controller of personal data collected through our marketing website and, for account holders, the processor of data you upload as described in our Data Processing Agreement. Contact: info@billportal.io.

2. Data we collect

• Contact & lead data submitted via forms: full name, work email, company, phone, job title, segment, portfolio size, area of interest and message.
• Newsletter subscriptions: email address, chosen topic categories, and language preference.
• Usage & device data: IP address, browser type, pages visited and interactions, collected via cookies and similar technologies (see our Cookie Policy).
• Account & platform data (for customers): user profile, organisation details, and the utility/expense data you upload — handled under the DPA.

3. How we use data

• To respond to enquiries, schedule demos and provide the service you request.
• To send transactional communications (e.g., a confirmation when you submit a form).
• To send newsletters where you have opted in (you can unsubscribe at any time via a link in every email).
• To operate, secure, analyse and improve our website and platform.
• To comply with legal obligations and enforce our terms.

4. Lawful bases

Where applicable law requires a lawful basis (e.g., GDPR), we rely on: your consent (newsletters, non-essential cookies); performance of a contract or steps taken at your request (demos, service delivery); and our legitimate interests in operating and improving our business, balanced against your rights. You may withdraw consent at any time without affecting prior processing.

5. Automated processing

Within the platform, uploaded account and bill data is processed using AI-supported extraction and validation. This processing supports (but does not, by itself, finalise) payment decisions: our service is designed for human-in-the-loop review, and the Customer reviews and approves payment files before disbursement. We do not use this processing to make decisions producing legal or similarly significant effects about individuals without human involvement. Where GDPR Article 22 applies, you may request human intervention, express your point of view and contest a decision. This processing is governed by the DPA.

6. Sharing and sub-processors

We do not sell personal data. We share data with vetted service providers acting on our behalf (e.g., cloud hosting, email delivery via Amazon SES, analytics and operational tooling) under appropriate contractual protections. A current sub-processor list is maintained as described in, and available through, our Data Processing Agreement.

7. US state privacy rights (CCPA/CPRA and similar)

If you are a California resident (and to the extent similar US state laws apply), you have rights to know/access, correct, and delete personal information, to opt out of "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights.

We do not "sell" personal information for money. Some analytics or advertising cookies may constitute "sharing" or a "sale" under certain state laws; where that is the case, you can exercise a "Do Not Sell or Share My Personal Information" choice via our cookie preferences control or by contacting info@billportal.io. We disclose the categories of personal information described in Section 2 for the business purposes described in Section 3.

8. International data transfers

We are a US entity and may process personal data in the United States and other countries. Where personal data originating in the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on an appropriate transfer mechanism — typically the European Commission's Standard Contractual Clauses (and the UK Addendum/Swiss addendum where relevant) — even where a data-residency option has not been selected. Data-residency options may be available as described in your order form or the DPA.

9. Data residency

Where offered, we can store customer data on servers within your country or region to support local data-residency requirements. Details are set out in the applicable order form or DPA. Absent a residency selection, cross-border transfers are handled as described in Section 8.

10. Cookies

We use cookies and similar technologies as described in our Cookie Policy, which sets out the specific cookies we use, their providers, purposes and durations, and how to manage or withdraw consent. Non-essential cookies are set only with your consent where required.

11. Children

Our website and platform are business tools not directed to children. We do not knowingly collect personal data from children under 16 (or under 13 in the United States). If you believe a child has provided us personal data, contact info@billportal.io and we will delete it.

12. Retention

We keep personal data only as long as necessary for the purposes described here, to comply with legal obligations, resolve disputes and enforce agreements. Lead and subscriber records are retained while relevant to our relationship and then deleted or anonymised.

13. Your rights

• Access, correct, or delete your personal data.
• Object to or restrict certain processing, and withdraw consent.
• Data portability, where applicable.
• Opt out of "sale"/"sharing" of personal information (US state laws).
• Lodge a complaint with your local supervisory authority.

14. Security

We use technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, least-privilege access and audit trails. No method of transmission or storage is completely secure; we work to protect your data but cannot guarantee absolute security. In the event of a personal-data breach, we will notify affected customers and, where applicable, authorities in accordance with applicable law and the timeframes set out in the DPA.

15. Contact

To exercise your rights or ask questions about this policy, contact info@billportal.io. We will respond within the timeframes required by applicable law.