Trust centre
Documents for your vendor review.
The DPA, the sub-processor list, security testing details and the privacy position, public or under NDA. How the system is built is on the security page.
Documents
Available documents
Public documents open here. The rest is sent on request or under NDA.
Sent to you
The DPA and the sub-processor list come from privacy@smartbills.ca. Questionnaires and testing details come from security@smartbills.ca.
- Data processing agreementOn requestRequest
The standard Smartbills DPA, or a review of yours.
- Sub-processor listWith the DPARequest
Every company that handles customer data, and how changes are notified.
- Security questionnaireOn requestRequest
Yours, answered question by question.
- Security testing detailsUnder NDARequest
What testing is run and what it found.
Open here
Published pages, open to anyone.
- Security overviewPublicOpen
Encryption, access, isolation and disclosure.
- Privacy policyPublicOpen
What is collected and people's rights over it.
- Terms and conditionsPublicOpen
The agreement that governs the service.
- Status pagePublicOpen
Live availability and incident history.
Certifications
Certifications appear once the audit report exists.
A certification appears here with its scope, period and auditor once the report exists. Tell us what your review requires and you get a direct answer on what is available.
Privacy law
Laws that apply to receipt data
A receipt linked to a person is personal information under each of these. Our position under each law is available in writing on request.
European Union and United Kingdom
GDPR
Personal data of people in the European Union, and in the United Kingdom under its own version. Legal basis for processing, people's rights, transfers and breach notice.
Quebec
Quebec Law 25
Anyone handling personal information about people in Quebec, wherever the company is based. Privacy impact assessments, a person in charge of privacy, an incident register and express consent for sensitive information.
Canada
PIPEDA
Canada's federal law for personal information in commercial activity, alongside provincial laws where they apply.
United States
HIPAA
Protected health information held by health plans, providers and the companies that work for them. A receipt from a pharmacy or a clinic can carry it. Covers safeguards, limits on use and breach notice.
FAQ
Frequently asked questions
Get started
Tell us what your review needs.
Questionnaires, DPAs, sub-processor lists and architecture questions go to one address, with no sales call in between.