Customer - any individual or legal entity that uses, has used or expressed a desire to engage in any services provided by InvoiceBox or those connected to them.
Customer data - any information that InvoiceBox holds regarding the Customer or its representatives.
Personal data -any information directly or indirectly related to the Customer as an individual.
Processing - is any action performed using theCustomer’s Data (including collecting, recording, storing, modifying, granting access, making requests, transferring, etc.).

1.1. These Rules describe how InvoiceBox handles the processing of Customer Data. More information about Customer Data Processing can also be found on the Invoicebox website: www.invoicebox.ee .
1.2. As part of the applicable normative acts, InvoiceBox ensures the confidentiality of its Customer Data and applies the appropriate technical and organizational measures to protect its Customer Data from unauthorized access, illegal processing or disclosure, accidental loss, alteration or destruction.
1.3. In order to process Customer data, InvoiceBox is permitted to use authorized data operators. In these cases, InvoiceBox takes all necessary measures to ensure that the processing of Customer data by such operators remains in accordance with the guidelines of InvoiceBox and the applicable normative acts. InvoiceBox also requires that operators apply the appropriate security measures to their endeavours.

If you live in the Russian Federation, your data controller is: USC LLC
If you live in the European Union, your data controller is: InvoiceBox OU
As a rule, Customer Data is processed in the European Union, but in some cases, it can be processed in non-EU countries. In such cases, a sufficient level of data protection is ensured in accordance with the regulatory requirements of the EU Commission.

InvoiceBox OU
Name: InvoiceBox OU
Taxpayer reference: EE101948799
Registration number: 12855913
Address: Luise tn 4-46, Tallinn, 10142, Estonia
Data Protection Officer (DPO): The user can contact this individual via the following email address: privacy@invoicebox.ee. Alternatively, one may write to InvoiceBox via the address marked "For the Data Protection Officer".

USC LLC
Name: USC LLC
Taxpayer reference: 7810532221
Registration number: 1089847384362
Address: 196105, Russian Federation, St. Petersburg, 1 Yuri Gagarin Ave.
Data Protection Officer (DPO): The user can contact this individual via the following email address: privacy@invoicebox.ee. Alternatively, one may write to USC LLC via the address marked "For the Data Protection Officer".

Customer Data is collected from the User due to the use of the services by the Customer and via third-party sources, for example, public and private registers. InvoiceBox collects information, including but not limited to:

• Identification data, for example, name, surname, personal code, date of birth;
• Contact information, such as a correspondence address, phone numbers, emails, IP addresses;
• Information about relations with legal entities, including data provided by the Customer, data obtained from public registers or that obtained from third parties regarding transactions taking place on behalf of the respective legal entities;
• Financial data, such as bills;
• Data obtained and/or compiled as a result of compliance with the laws of the relevant legislative body. ;
• Data obtained through communication, for example, by telephone, as well as data obtained by email, from messages and other means of communication such as social media channels;
• Service-related data, for example, submitted applications, requests and complaints, payments for services, data relating to tickets purchased and airlines used, booking and flight details etc.

InvoiceBox collects and processes information for the following purposes:

5.1. For general customer relationship management, ensuring and administering access to its products and services.
InvoiceBox uses the information collected to provide and personalize support while improving the quality of its services. This includes using the information for the following purposes: to conclude and execute contracts (for example, to provide airport transfer services) to authorize capital transfers, pay for purchased services, and to carry out the internal transactions required to provide our services(for example, correcting software errors and problems with transactions, analyzing, testing and researching data).

5.2. To protect the interests of the customer and/or InvoiceBox
InvoiceBox uses the collected data to ensure the security, protection and integrity of services in addition to the provision of support services. The data is also used to provide evidence of business transactions and other commercial communications based on the performance of the contract or the execution of pre-contractual measures at the request of the Customer. InvoiceBox may also collect data to fulfill a legal obligation, or on the basis of the legal interest of InvoiceBox to prevent, restrict and investigate the unfair or illegal use of its services.

5.3. To perform legal obligations
InvoiceBox must comply with the applicable laws and international agreements, for example, in order to fulfill market transparency requirements and provide information about them to competent institutions. It is the responsibility of InvoiceBox to prevent, detect, investigate and report possible money laundering and terrorist financing if the Customer is subject to financial sanctions or is a politically exposed person. It must verify identity based on: the execution of the contract or the fulfillment of pre-contractual measures at the request of the Customer, for the fulfillment of a specific legal obligation, or on the basis of the legitimate interest of InvoiceBox.

5.4. To prove the implementation and enforcement of legal requirements
InvoiceBox is obliged to prove the implementation and enforcement of legal requirements. This may relate to the performance of the contract, the execution of pre-contractual measures at the request of the Customer, may be required to fulfill a specific legal obligation, or may be required on the basis of the legal interest of InvoiceBox for the implementation of legal requirements.

5.5. To carry out settlement transactions
To fulfill obligations to execute international transactions through credit organizations and local payments through the intermediaries of domestic, European and international payment systems and to comply with the rules and obligations stipulated, for example, by European and international standards and certification systems related to payment cards and security based on: execution of the contract or performance of pre-contractual measures at the request of the Customer, or to perform certain legal obligations.

5.6. To prevent the fraudulent use of services and provide adequate services
To improve technical systems, IT infrastructure, adapt the image of services for a range of devices and develop InvoiceBox’s services through testing and improvement based on the legitimate interest of InvoiceBox.

In certain cases, InvoiceBox may provide the collected data to other individuals and organizations.
Upon prior notice and with your consent, InvoiceBox may also transfer information to third parties not specified in this Policy.

The collected data is stored no longer than is necessary to fulfill the purpose of collecting the processed data in accordance with these customer data processing rules. InvoiceBox can keep the collected data longer, if it is necessary to fulfill the requirements arising from legislation, legal duties or the legitimate interests of InvoiceBox. InvoiceBox stores the collected customer data for a maximum of 24 months, starting from the last transaction performed through the services or tools of InvoiceBox.

The Customer, being an individual, has the following rights regarding the processing of his or her data:

These rules are available to customers via the company's website: www.invoicebox.ee

• Users and organizations as per your request.
• Individuals, organizations and government bodies (to resolve legal issues and settlement of disputes). InvoiceBox has the right to provide your data if it believes that this is required by law, normative acts, contracts in force, legal process, a request from a government agency or if it is necessary for security purposes, etc.
• Affiliates and subsidiaries of InvoiceBox. We transfer information to our affiliates and subsidiaries when that information assists in the provision of services and when these subsidiaries process data on our behalf.
• Company Partners
• operators for accepting and handling payments;
• cloud storage providers;
• partners ensuring safety and security of applications;
• consultants, lawyers, accountants and other professional services providers;
• partners providing transfer services and airports;
• We may transfer data to other parties or individuals with your permission
• To request correction of their Personal data in case of inconsistency, incompleteness or incorrectness;
• To object to the processing of their personal data if the use of their personal data requires their consent;
• To request erasure of their Personal Data, for example, if Personal Data is processed on the basis of Customer consent. This right does not apply if the Personal data that the Customer wishes to erase is also being processed on the basis of a legal requirement, for example, because of a contract or obligations arising from the relevant regulatory acts;
• To restrict the processing of their personal data in accordance with applicable normative acts;
• To receive information about whether InvoiceBox processes their Personal Data and, if it does, access that data;
• To receive their personal data provided by themselves and processed on the basis of their consent and performance of the contract in writing or in any of the most commonly used electronic formats and, if technically possible, transfer that data to other service providers (data portability);
• To withdraw their consent to the processing of their personal data;
• To submit claims about the use of Personal Data to the Data Protection Inspectorate of the Republic of Estonia (webpage: www.aki.ee) if the Customer considers that the processing of his Personal data violates his rights and interests in accordance with the applicable normative acts.