Version 1.0 · Effective date: 31 October 2026

At a glance

• Who we are: UK eInvoice is a service of Rishvi Ltd. We are not HMRC or a Government body.
• Two roles: we are controller for website visitors, enquiries and our client relationships, and processor for the invoice and business data we handle on our clients’ behalf.
• We do not sell personal data, and we do not use invoice or business data for marketing or to train general-purpose AI models.
• Your clients’ and suppliers’ data in invoices is used only to deliver the e-invoicing service you have asked for.
• Calls may be recorded or transcribed, including by AI note-takers, and we tell you at the start.
• You have rights to access, correct, delete and object. Email info@rishvi.co.uk.

1. Who we are

UK eInvoice (ukeinvoice.co.uk) is a service operated by Rishvi Ltd (“Rishvi”, “we”, “us”, “our”), a company registered in England and Wales, company number 08347225. Our registered and operational address is Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom. We operate an information security management system certified to ISO/IEC 27001:2022.

Rishvi Ltd is an independent technology provider. We are not HMRC, the UK Government or a regulatory authority, and we do not collect information on HMRC’s behalf.

2. Scope of this policy

This policy explains how we handle personal data in connection with the UK eInvoice website and our e-invoicing technology, integration, readiness and consultancy services. It explains our current practices for personal data we continue to hold or process, including information relating to past, current and future work. It does not retrospectively change any contract, give us any new right to use client information, or replace a client’s documented instructions or any data processing agreement.

This policy is the UK eInvoice version of the Rishvi Privacy, Data Processing and Artificial Intelligence Policy, which covers all Rishvi brands. If anything here is unclear, the Rishvi policy gives more detail. Where we process data for a client under a signed contract, proposal, statement of work, our Standard Commercial Terms and Conditions or a Data Processing Agreement, those documents also apply and prevail for that processing.

3. Our role: controller or processor

Situation	Our role	Who to contact first
Website visitors, enquiries, readiness assessment requests, quotations, marketing, client contacts, billing, recruitment	Controller – we decide how and why the data is used	UK eInvoice / Rishvi
Invoice data, supplier and customer records, tax identifiers and accounting data we process to deliver e-invoicing services for a client	Processor – we act only on the client’s documented instructions	The client (the business that issued or received the invoice)
Data inside a client’s ERP, accounting, Linnworks, Odoo or other connected systems	Processor	The client

If you are a supplier or customer of one of our clients and your details appear on an invoice, our client is responsible for that data and your questions should normally go to them first. We will help them respond.

4. Laws we follow

We process personal data under UK data protection law, including the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations (PECR). Where we serve clients or individuals in the EU, we also take account of the EU GDPR where it applies.

5. Personal data we collect

• Identity and contact data: name, job title, company, business email, phone number, business address, website.
• Enquiry and readiness data: details you give us about your invoicing volumes, systems, software, current processes, requirements and readiness for e-invoicing.
• Client account data: user names, roles, permissions and access details for any portal, connection or service we provide.
• Invoice data (as processor): invoice numbers, dates, line items, amounts, VAT and tax details, payment terms, and payment details shown on invoices, such as bank account details.
• Trading partner data (as processor): names, addresses, contact details, VAT registration numbers, company numbers and e-invoicing identifiers of our clients’ suppliers and customers.
• Accounting and system data (as processor): records from connected ERP, accounting, Linnworks, Odoo and invoicing systems needed for the integration.
• Financial data: our own billing details, invoices and payment status. We do not store full payment card details.
• Technical data: IP address, browser, device, pages visited, referral source, timestamps, and security and system logs.
• Communications: forms, emails, support tickets, calls and video meetings, including recordings, transcripts and AI-generated meeting notes.
• Access credentials: API keys, tokens and service-account details you give us to connect systems. We treat these as highly confidential.
• Marketing and preference data: your marketing and cookie choices.
• Recruitment data: CVs, applications and interview notes, if you apply to work with us.

We do not intentionally collect special-category data (such as health, ethnicity or religion) or criminal-offence data. If it is sent to us unprompted, we limit its use and delete it where appropriate.

6. How we collect it

• Directly from you: website forms, emails, WhatsApp messages, calls, video meetings, readiness assessments, proposals and support requests.
• From your organisation, when it engages us or adds you as a user.
• Through authorised connections to your ERP, accounting, invoicing, Linnworks, Odoo and other systems, using APIs and integration tools.
• From e-invoicing networks, access points or service providers when invoices are sent or received for our clients.
• Through cookies and similar technologies on our website (see section 17).
• From public sources, such as Companies House or published VAT registration details, where needed to validate invoice data.
• From partners and referrers, events and webinars.

7. Why we use it and our lawful basis

Purpose	Lawful basis
Responding to enquiries, consultations, readiness assessments and quotation requests	Legitimate interests; steps before a contract
Delivering e-invoicing, integration, hosting, support and consultancy services	Contract
Creating, validating, converting, sending, receiving and storing invoices for clients	Client’s documented instructions (we are processor)
Service messages (delivery notices, acceptance deadlines, security alerts, changes to terms)	Contract; legitimate interests
Recording, transcribing and summarising calls and meetings	Legitimate interests (accurate records of requirements and decisions)
Marketing and updates about e-invoicing requirements and our services	Consent, or legitimate interests for existing business clients where PECR allows
Website analytics cookies	Consent
Improving our website and services (website and account usage only, not invoice data)	Legitimate interests
Billing, accounting and tax	Legal obligation; contract
Security, fraud and abuse prevention, audit logs	Legitimate interests; legal obligation
Recruitment	Steps before a contract; legitimate interests
Legal claims and disputes, including debt recovery	Legitimate interests; legal obligation

Where we rely on legitimate interests, we have considered your interests and rights and concluded that they do not override ours. You can ask for more detail and you have the right to object (see section 19).

8. How we handle invoice data

• We process invoice and trading partner data only to deliver the e-invoicing service the client has asked for, such as creating, validating, converting, sending, receiving, matching or storing invoices.
• We access only the systems and data the client has authorised, and only for the agreed work or a reported issue.
• We may validate data, for example checking formats, VAT numbers or required fields, but the client remains responsible for the accuracy of invoice content and its tax treatment.
• Where invoices are exchanged through e-invoicing networks, access points or other providers, those providers process the data either as our sub-processors or as independent controllers under their own terms, as set out in the client’s agreement.
• We do not use invoice data for marketing, product development or AI training, and we do not share it with partners.
• We use test or anonymised data for development and testing where practical, and delete working copies when they are no longer needed.
• Clients remain responsible for keeping their own VAT and accounting records for the periods the law requires, unless we have expressly agreed to store them as part of the service.

9. Connected systems

Our services may connect to ERP systems, accounting software, invoicing platforms, Linnworks, Odoo, marketplaces and other systems. These are independent providers with their own privacy policies and are not part of Rishvi. When you authorise a connection, we access only what your permissions and tokens allow. You control which users have access and which systems are connected.

10. Artificial intelligence

Our team may use approved AI tools, such as coding assistants, documentation, support and meeting note-taking tools, to deliver services efficiently. We use only tools and settings approved internally, never put client credentials into AI tools, and use client data in them only where the work needs it and our arrangements with the client allow. We do not use invoice data, client operational data or client personal data to train general-purpose AI models. Any exception would need to be permitted by law, agreed in writing by the client and allowed by the relevant platform rules. AI-generated output can be wrong, so it should be checked before it is relied on for significant decisions. More detail is in section 12 of the Rishvi Privacy Policy.

11. Who we share data with

We do not sell personal data.

• Across Rishvi brands: contact and account data may be shared between UK eInvoice, Rishvi, Linnworks Custom and HyperStock where needed to serve you. You can object at any time. Invoice and client operational data is not shared across brands for any other purpose.
• WhatsApp (Meta): if you contact us through our “WhatsApp us” button, your messages and phone number are also processed by WhatsApp under its own privacy policy. Please do not share credentials, invoices or bank details through WhatsApp.
• E-invoicing networks and service providers: where needed to send or receive invoices for a client.
• Platform and integration partners: technical or account information shared with ERP, accounting or other platforms where needed to deliver an integration you’ve asked for.
• Service providers (sub-processors): website hosting (Hostinger), cloud and database hosting, email, analytics, monitoring, backups, support tools, accounting software, meeting and note-taking tools, and AI providers. They act on our instructions under contract.
• Contractors: approved contractors working on client projects, under confidentiality and data protection obligations.
• Professional advisers: lawyers, accountants, auditors (including ISO certification auditors) and insurers, under confidentiality.
• Debt recovery: where invoices to us are unpaid, necessary details may be shared with debt-recovery agents or legal advisers.
• Legal requirements: courts, regulators, law enforcement or HMRC where the law requires.
• Business changes: a buyer or successor in a merger, acquisition, restructuring or sale of assets, under confidentiality.

12. Website tools

Tool	Provider	Purpose
Website hosting	Hostinger	Hosting the UK eInvoice website
Google Analytics and Google Tag Manager (via Google Site Kit)	Google	Website statistics and managing website tags
Google reCAPTCHA	Google	Protecting our forms from spam and bots
Google Fonts	Google	Displaying the website’s fonts
Click to Chat / WhatsApp	Meta (WhatsApp)	Our “WhatsApp us” button; WhatsApp receives data only if you click it and message us

A full list of sub-processors used for client services is available on request from info@rishvi.co.uk. Where a client contract requires advance notice of new sub-processors, we will give it.

13. International transfers

Personal data may be accessed or processed outside the UK, including by authorised Rishvi Ltd staff based in India, who work under our security controls and confidentiality obligations, and by providers such as cloud, analytics and AI providers, which may process data in the EU or US. We apply the safeguards the law requires. Where a restricted transfer takes place, we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. Clients with data-location requirements should agree them with us in writing. We do not claim that all data is hosted in the UK.

14. How long we keep data

Data	Retention period
Enquiries and readiness assessment requests	2 years from last contact
Contracts, proposals, correspondence and project records	Length of engagement + 6 years
Call recordings, transcripts and AI meeting notes	In line with the related enquiry or project records
Client invoice and trading partner data	As set out in the client’s agreement; otherwise only as long as needed to deliver the service, then deleted or returned
Client credentials and tokens	Removed or disabled when no longer needed, subject to agreed operational needs
Our own accounting and financial records	7 years
Marketing data	Until consent is withdrawn, or 3 years from last engagement
Website analytics	26 months
Recruitment data	6 months after the role is filled, unless you agree to longer
Backups	Access-restricted and overwritten in line with documented backup cycles; not restored for ordinary use

We may keep data longer where needed for legal claims, disputes or debt recovery, or where the law requires it.

15. Security

We use risk-based technical and organisational security measures suited to the information and services involved. We operate an information security management system certified to ISO/IEC 27001:2022. Our measures include HTTPS/TLS encryption in transit, role-based and least-privilege access, secure API authentication and secret management, separation of production and test environments, logging and monitoring, vulnerability management, regular security reviews, backups, staff confidentiality and training, and secure deletion. Credentials must be shared only through the secure method we agree, never by ordinary email, chat or AI tools. No system can guarantee absolute security, so we also encourage clients to protect their own accounts, devices and credentials. To report a security vulnerability, email info@rishvi.co.uk.

16. Data breaches

If a personal data breach occurs, we will act to contain it and assess the risk. We will notify the regulator and affected individuals where the law requires. Where we are processor, we will notify the affected client without undue delay, as our agreement with them requires.

17. Cookies

We use essential cookies and services to run and secure our website. We use analytics cookies only with your consent. Full details, and how to change your choices, are in our Cookie Policy.

18. Marketing

We may send you updates about UK e-invoicing requirements, our services and events. You can unsubscribe at any time using the link in our emails or by emailing info@rishvi.co.uk. Service messages, such as delivery notices, invoices and security alerts, will still be sent.

19. Your rights

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data where we no longer have a lawful reason to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Portability: receive data you gave us in a structured, machine-readable format.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Automated decisions: not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.

20. Making a request

To make a request, email info@rishvi.co.uk. We will respond within one month, which may be extended where the law allows. Requests are normally free. We may need to verify your identity. If your request concerns invoice data we process for one of our clients, we will pass it to that client, who is the controller, and help them respond.

21. Client responsibilities

Clients who use our services are responsible for: having authority to connect their systems and share the data; telling their own customers, suppliers and staff how their data is used; the accuracy of invoice data and its VAT and tax treatment; keeping their own legally required records; managing user access; protecting credentials; not sending unnecessary sensitive data; and meeting their own controller obligations.

22. Children

Our services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it promptly.

23. Third-party websites

Our website may link to third-party websites, including GOV.UK and HMRC guidance, software providers and e-invoicing networks. We are not responsible for their privacy practices; please read their policies.

24. Complaints

Please contact us first at info@rishvi.co.uk so we can try to resolve your concern. We will look into your complaint and tell you the outcome. You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner’s Office): ico.org.uk, 0303 123 1113.

25. Changes to this policy

We update this policy as our services, technology and the law change, including changes to UK e-invoicing requirements. The version and effective date are shown at the top. Earlier versions are available on request. Where a change requires us to notify you directly or take another step under the law or a contract, we will do so.

26. Contact us

UK eInvoice – Rishvi Ltd
Company number: 08347225
Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom
Email: info@rishvi.co.uk
Phone: +44 20 8050 3432
Websites: ukeinvoice.co.uk · rishvi.co.uk