EU-GDPR

Introduction

The General Data Protection Regulation (GDPR) is a landmark personal data protection regulation for the European Union (EU) residents. It is centered around the consumer and formulated to ensure their data protection and privacy. The GDPR came into effect on the 25th of May 2018.

By replacing the previous Data Protection Directive, the GDPR raises the bar in personal data protection for EU individuals. It applies to any person/legal entity that handles the personal data of EU residents, even if the person/legal entity operates outside of the EU region. For companies handling such data, this could imply extensive changes in their systems and contracts to ensure compliance.

Chargebee complies with the Standard Contractual Clauses (SCCs) issued by the EU Commission in June 2021. Those clauses are part of the Data Processing Addendum (DPA).

How are we compliant?

GDPR clearly defines rights for data subjects around aspects such as access, portability, rectification, and erasure of their personal data. Gaining explicit consent from data subjects for processing their personal data is also a key provision of the regulation.

Following are ways in which Chargebee is meeting these requirements:

• Chargebee only collects the minimum information necessary for the provision of our service. Every data field processed by Chargebee (such as your name, email address, emergency contact details, billing address, and payment method) is strictly for the purpose of providing the service.
• We do not process special categories of personal data (Article 9 of the GDPR). We have signed contracts and a DPA with companies that store and process your personal data and your customers' personal data. See the sub-processor list.
• Chargebee only keeps the data of you and your customers for as long as needed for the provision of service.
  • Chargebee erases your personal information 120 days after your account has been canceled. Your Chargebee website along with all the information of your customers stored with us is also deleted. The only information retained is that which is necessary from a compliance or legal standpoint. This includes invoices, subscription information, and audit logs.
  • All TEST sites in Chargebee that have been inactive for six months are automatically deleted.
  • As a data processor, Chargebee gives you various in-app features to manage how the personal data of your customers are retained or purged.
• The Import and Export feature allows you the right to portability of all the information that we process on your behalf.
• Chargebee provides, via its app and API, ways of keeping all your personal data and that of your customers accurate.
• Chargebee includes features to grant and revoke consent for you and for your customers. Customers revoke consent in the Self-Serve Portal. You can update consent for existing customer records with the API or a bulk operation.
• Whenever we capture any form of consent from you or your customers, we log the IP address and the time and date of the action, thereby making granting or revocation of consent demonstrable. These logs are also available on request.
• Chargebee uses the SCCs to process personal data from Switzerland, the United Kingdom, and the European Economic Area (EEA) in a country the European Commission has not found to provide adequate protection. Contact support for a copy of the personal data that we, as data controllers, process.
• Each Chargebee account uses one hosting region. To use Chargebee in more than one region, create a separate account in each region. See Chargebee Billing Data Centers.

Our privacy policy has been updated to comply with the regulation.

Privacy Features for Data Processing

As a data processor, we give you the following features in Chargebee to help you ensure the privacy of your customers' personal data.

• Consent Management: This feature allows you to obtain and revoke explicit consent from your customers and manage it within Chargebee.
• Personal Data Management: Chargebee gives you full control over how personal data of your customers is retained on our systems or erased from it.

Our Security Standards

Certifications help ensure that companies have the right systems in place to demonstrate their abilities in data privacy and security. Here's how we have been audited by independent third-party auditors:

• Ensuring the security of payment card data through PCI DSS Level 1 compliance.
• Information security is compliant with the ISO/IEC 27001:2013 standard.
• SOC 1 Type II report for assessing our internal controls over financial reporting.
• SOC 2 Type II report that evaluates our controls relevant to security, availability, and confidentiality.

These reports/certifications are available for download through Chargebee's LIVE site (can be accessed by the owner and admin of the site).

Refer to our security page to understand the detailed Technical and Organizational Measures (TOMs) which are implemented by Chargebee.

The Data Processing Addendum (DPA)

As referenced in our Terms of Service or any service agreement between you and Chargebee, the DPA applies where the Group Companies process personal data on your behalf. Contact support for a signed copy of the DPA.