Why you received a message about an unpaid invoice

In short

A firm you or your employer works with has an invoice that has not been paid. That firm uses THEA, a software product, to send the reminder. THEA sent the email. The firm decided to chase, and the firm is owed the money.

If you do not want to be contacted again, say so and we will stop. There is no form to fill in and you do not need to give a reason. How to do it is in the section headed How to stop being contacted.

Who is responsible for your information

Two organisations are responsible together. In data protection law they are called joint controllers.

The firm. The business that issued the invoice. Its name is in the message you received. The firm decided that the invoice should be chased, chose to contact you, and provided your contact details.

THEA. THEA-AI LTD, a company registered in England and Wales under number 17068364, with its registered office at Flat 3604 Icon Tower, 8 Portal Way, London, England, W3 6EF. THEA built the reminder service, decides what the messages say, and how long they are kept.

You can contact either of us. You do not have to go to both.

• The firm: use the reply address in the message.
• THEA: privacy@heythea.ai.

Where we got your details

From the firm. The firm gave us your name and your business contact details because you are recorded as the person to speak to about payment. We did not buy your details, and we did not find them anywhere else.

If we have reached the wrong person, please tell us. We will remove you and let the firm know.

What we hold

• Your name, and your job title or role if the firm recorded one.
• Your business email address.
• The reminder emails we sent you.
• Whether you said you would pay, and by when, if the firm told us.

We do not capture your replies. If you reply to a reminder, it goes to the reply address shown on that email, so that a person reads it. We do not store your reply as part of the record we keep about you. If you need a copy of something you sent, ask the firm.

We do not ask for and do not want any sensitive information about you, such as health, religion, or anything about a criminal matter.

What we use it for, and why we are allowed to

We use it for one purpose only: to ask for payment of an invoice that is past its due date.

Our lawful basis is legitimate interests, under Article 6(1)(f) of the UK GDPR. The interest is the firm's interest in being paid for work it has already done. We think this is fair because the invoice is a business matter between the firm and its client, we contact you at your work address about that business, and we stop as soon as you tell us to.

We are not asking for your consent, and nothing here depends on you agreeing to it. Instead, you have a right to object, which is explained below.

We have written down our assessment of whether this is fair. You can ask us for a copy.

Who else sees your information

• The firm that is owed the money.
• Our email delivery provider, which carries the message.
• Our hosting provider, which stores the data.

For the current list of our providers, email privacy@heythea.ai and we will send it to you.

Some of these providers are outside the United Kingdom. You can ask us which provider holds what, and what protections apply when your details go abroad. We will tell you what is in place. Email privacy@heythea.ai.

We do not sell your information. We do not share it for advertising.

What we will never do with it

We will not use your emails, or anything you write to us, to train artificial intelligence models. Not ours, and not our providers'. Our contracts with our providers forbid it.

We do keep a record of whether a payment was promised, whether payment followed, and at which attempt. That record does not contain your name or your words.

How long we keep it

• The reminder emails we sent you: 12 months.

This is the longest we keep anything, not a promise to keep it that long. If the firm stops using THEA, everything above is erased 90 days after its subscription ends, even where the 12 months had not run out.

If you asked us to stop contacting you, we keep a note of that request for as long as the firm uses THEA. We have to. Without it we would have no way of knowing not to contact you again. That note holds only your email address, the date you asked, and how you asked. It does not hold anything you said.

The firm keeps its own record of the invoice and of you as a contact. That is the firm's record, not ours, and the firm decides how long to keep it.

How to stop being contacted

You have a right to object under Article 21 of the UK GDPR. You do not have to give a reason, and there is nothing to fill in.

Either of these works:

• Email privacy@heythea.ai and say stop. You do not need to say anything else.
• Tell the firm, using the reply address in the message you received.

We act on it as soon as we see it, and in any case within one month, which is the longest the law allows us to take. It covers everything: all reminder emails from that firm, about every invoice, not only the one we contacted you about.

Once it is recorded, nobody at the firm can undo it quietly. Undoing it takes a deliberate step, the person taking that step is told that you asked us yourself, and we keep the record of your request either way.

Stopping reminders does not stop the invoice. You will still receive the invoice itself, and any updated copy of it, because withholding the bill would leave you unable to pay it even if you wanted to. What stops is the chasing. The firm may also still contact you itself in the ordinary way.

Your other rights

You can ask us to:

• Show you what we hold, including the reminder emails we sent you. For a reply you sent, ask the firm, because the firm is who received it.
• Correct anything that is wrong.
• Delete what we hold, in the circumstances the law allows.
• Pause our use of it while a question is being sorted out.
• Stop contacting you, as described above.

These are your rights under Articles 15 to 21 of the UK GDPR. There is no charge and we will answer within one month.

The quickest route is usually the firm, because the firm holds the underlying record. But you can come to either of us and neither of us will send you away.

If you are unhappy

Tell us first, if you are willing to. You have a right to complain directly to us and we would rather put something right than have you go elsewhere first. Email privacy@heythea.ai. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You can also complain to the regulator at any time. You do not need to come to us first. In the United Kingdom this is the Information Commissioner's Office.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

If you are in the European Union you may complain to the supervisory authority in your own country instead.

Automated decisions

No decision that has a legal effect on you, or a similarly significant effect, is made about you automatically. A person reads your reply, and a person at the firm decides what happens next.

The arrangement between the firm and THEA

Article 26(2) of the UK GDPR says we must publish the essence of the arrangement between the two joint controllers. This is it.

Who is responsible for what

Your single point of contact

Start with the firm. Its details are in the message you received.

You are entitled to go to either of us, and if you contact THEA directly we will deal with you. We will not tell you to go elsewhere.

If you send a request to stop to THEA, we act on it ourselves. We do not wait for the firm to agree, and the firm cannot reverse it without being told, in terms, that the request was yours.

Liability

Both of us can be held responsible for the whole of any harm caused by this processing. Which of us you approach is your choice, and the arrangement between us does not limit that.

Contact

THEA-AI LTD
Registered in England and Wales, company number 17068364
Flat 3604 Icon Tower, 8 Portal Way, London, England, W3 6EF
privacy@heythea.ai