dislio complies with applicable local laws on our business related use of personal data. This ensures that we meet the applicable standards set out in such laws.

In addition, we apply our own Data Stewardship Principles. These are guided by the essential value that the data entrusted to us belongs to our customers and their end users. Our values and approach to privacy and data protection have enabled us to successfully serve SMEs nfor many years. And we believe our implementation of GDPR allows us to continue to earn our customers’ trust.

Every business is unique, and your GDPR compliance obligations will depend on many factors, including how you choose to collect, use, and share data about your employees and customers. You need to do an evaluation based upon your unique circumstances. To help you assess whether our Services are right for you, we recommend you review the following:

• Our Terms of Service and Privacy Policy sets out how we’ll handle any personal information you trust us with (these Terms will be updated soon as part of our GDPR Readiness program);
• Our technical and organizational security measures; and
• How you may take actions in our products to fulfill individual rights requests you may receive.

While we do not execute outside agreements, we do have specific terms that are reflective of the role that Intuit plays as either a controller or processor:

• If you are a dislio customer, our Terms of Service set out our commitments to protect personal data when we provide these services to you. For these services, by virtue of being a controller, we are also directly subject to compliance with data protection laws such as the GDPR.

Our main data storage locations are in the USA. However, as a global company, data are accessed from various locations by our global teams and our trusted partners.

We do not have a ‘data protection officer’, but we do have a dedicated team of privacy and security professionals who perform the duties that a Data Protection Officer would perform, if we were required to appoint one.

As a general rule of thumb, 7 years is the standard retention period for invoices and other documents retained for financial record keeping purposes. However, the legal requirements differ from country-to-country and may vary across different types of records. To determine your business’s retention obligations, you should consult a local expert or legal counsel.