Data processing terms
Last updated 28 September 2026
Draft for review. This page hasn’t been checked by a solicitor yet, and doesn’t apply to anyone until OPRIQ launches. Anything marked to confirm or proposed is still to be decided.
The terms under which we handle the personal information in your business's records, as UK GDPR Article 28 requires. They're part of our terms of service.
1. Who's who
Your business is the controller of the personal information in the records it keeps in OPRIQ. We are its processor.
2. What we process
| What for | Running OPRIQ for your business: keeping its records, preparing and sending its documents, reading and filing its email, matching its bank statements, keeping its books, and the assistant's help with all of these. |
|---|---|
| For how long | While your account is open, and then for the time in our terms (section 5) before deleting it. |
| About whom | Your customers and their contacts, your staff and engineers, your suppliers' contacts, your accountant, and anyone else in your email and records. |
| What kind | Names, addresses, phone numbers and email addresses; sites and equipment; jobs, reports and certificates, with signatures; quotes, invoices and payments; email; bank transactions; and anything else your business puts in. OPRIQ isn't designed for special category information (health, for example), and the assistant is kept from writing it into its notes. |
3. What we promise
- Only on your instructions. We use the information only to run OPRIQ for you, as these terms and your use of OPRIQ set out, unless the law requires otherwise, in which case we'll tell you first if we're allowed to.
- Confidentiality. Everyone who can reach it is bound to keep it confidential.
- Security (Article 32), including:
- each business's records kept in a database of its own;
- encryption on the way (TLS) and where it's stored;
- people's access set by their role in your business, and every change recorded, by whom and when;
- the assistant able to act only through OPRIQ's own tools, for one business at a time, with anything leaving the business waiting for a person's approval;
- OPRIQ's servers accepting no connections from the internet;
- passwords and keys kept in a separate secret store, never in the records;
- daily backups, with copies that even we can't delete early, so records can't be wiped by mistake or on purpose.
- Other processors. We use the companies listed below. You agree to them now. We'll tell you at least 30 days proposed before adding or replacing one, so you can object; if we can't resolve your objection, you can end the agreement and have a refund for the time you've paid for and not had. Each is bound by terms that protect the information as well as these do, and we're responsible for them.
- Your people's rights. We'll help you answer requests from people using their data protection rights, and pass on any we receive directly.
- Breaches. We'll tell you without undue delay (within 48 hours) proposed of learning that information in your records has been lost, stolen or reached someone it shouldn't, with what we know, so you can meet your own duty to tell the ICO within 72 hours.
- Other help. We'll help with your security, your impact assessments and any consultation with the ICO, as far as it concerns OPRIQ.
- At the end. When the agreement ends, you can take a copy of your records, and we then delete them, except what the law says we must keep.
- Showing we keep these promises. We'll give you the information you need to check, and allow reasonable audits, with reasonable notice.
- Outside the UK. Where information goes outside the UK, it's protected as our privacy policy (section 6) describes.
4. The processors we use
| Company | What they do | Where | When |
|---|---|---|---|
| Google (Firebase and Google Cloud) | Each business's database, sign-in, backups, the secret store, and hosting this website | to confirm | Always |
| Anthropic | The assistant: Claude reads what a task needs and proposes what to do | United States | Always |
| Contabo | The servers that run OPRIQ's software. They hold no business data of their own | to confirm | Always |
| Intuit (QuickBooks Online) | A copy of the business's accounts, if it connects QuickBooks | to confirm | Only if your business connects it |
| The business's own email provider (Google Workspace, Microsoft 365 or another) | Reading and sending the business's email, if it connects a mailbox | to confirm | Only if your business connects it |
| Payment provider: to confirm | Taking payments for OPRIQ (your own details, not your records) | to confirm | When you pay |
Services your business connects, such as your mailbox or QuickBooks, are yours: they hold your records under your own agreement with them, and OPRIQ reaches them only as you allow.
5. Questions
info@invictus247.co.uk. If your business needs these terms signed as a separate document, ask us.