Terms

Terms of business and data processing agreement – version 3.6, 13 November 2026

This is a translation. If the versions differ, the Danish version applies.

Terms of business for Rishah

1. The parties and the agreement

The agreement is made between Rishah ApS, Danish company number (CVR) 36455071 («Rishah»), and the business that signs up («the customer»). The agreement consists of the power of attorney, these terms of business and the data processing agreement, which are accepted together when the customer verifies the business. Rishah is for businesses only – not for private individuals.

The terms apply to the Rishah platform, where the customer makes, sends and receives their own documents. Customers for whom Rishah already handles and sends invoices today continue on their existing terms and prices.

2. The service

Rishah makes it possible to create, send and receive electronic invoices, credit notes and other business documents through Peppol and NemHandel. The service is delivered as described on Rishah’s website at any time. Rishah may improve and change the service, but if an essential function is removed, the customer may terminate the agreement at once and get a refund for the paid period that has not been used.

Upload PDF: the customer can let Rishah read an invoice that the customer has as a PDF, Word, Excel or image file and fill in the form with it. The reading is done automatically by a sub-processor (see the data processing agreement) and only when the customer uploads a file. The customer must check the filled-in invoice before it is sent – Rishah is not liable for errors in what was read that the customer could have seen. The customer may only upload their own invoices.

3. Users and login

The agreement is made with the business, not with the person who creates the account. The account must therefore be linked to an e-mail address that the business itself controls. If the person with the login leaves the business, the business’s management can take over the account after Rishah has checked that the request comes from the business. The customer creates users for its own staff or, for example, its accountant or bookkeeper. Each user is personal and logs in with a password and a code from an authenticator app. The customer is responsible for everything done by the customer’s users and must tell Rishah at once if a login may have been misused.

4. Prices and payment

The prices are shown in the current price list on rishah.dk and exclude VAT. The price list also shows what is included in each package and when paying per invoice. A received invoice counts as one invoice in the package, just like a sent one. An invoice the customer adds themselves from a PDF or an image does not count in the package, as it does not come through the network. The rules for what happens when the package is used up therefore apply to sent and received invoices together. Receiving is never closed, however. If the customer sends for other businesses, or is a system with many businesses under it, one of the two agreements below applies instead. When signing up, the customer chooses one of two ways to pay:

Invoice every month: the customer chooses a package with a number of invoices per month or payment per sent invoice. A package follows the calendar month: it continues every month until the customer cancels it and starts again on the 1st of each month; unused invoices are not carried over. If the package starts in the middle of a month, the full price is paid for the first month, as all the package’s invoices can be used. If the customer upgrades to a larger package, it applies at once for the whole month: the invoices already sent in the month count towards it, and the month costs the larger package’s price. A change to a smaller package, from a package to payment per invoice, and from invoice every month to «Pay now» applies from the 1st of the next month, so nothing overlaps. The subscription can be cancelled at the end of a month. When the package’s number is reached, what the price list says about the package applies: either more can only be sent once the customer has chosen to upgrade for the rest of the month or permanently, or each invoice above the package’s number costs the price in the price list. At the end of the month the customer receives an invoice from Rishah’s bookkeeping, which is paid on the payment terms stated on the invoice.
Pay now: the customer buys a package with a number of invoices or pays an amount into a balance (at least the price of one invoice), from which the price of each sent invoice is deducted. The customer immediately receives an order confirmation with an order number. The amount is paid at once by bank transfer, and the order number must be stated on the transfer. Once the customer has confirmed the transfer, the package or balance can be used at once, even before the money has been received. A package applies for 1 month from the transfer; after that it is used up, and unused invoices are not carried over. A smaller package can only be bought when the current one expires, so they do not overlap. The balance does not expire. If the customer switches to invoice every month, what is left of the balance and the unused part of the package’s month are credited, and the amount is deducted from the customer’s next invoice. If the customer upgrades to a larger package before the period has ended, the customer pays the difference in price between the two packages, and the larger package applies for the rest of the paid period; the invoices already sent in the period count towards it. This is the same rule as for invoice every month. If the amount has not been received 8 days after the purchase, Rishah closes sending until it has been paid.

When a package or balance has been used up, no more documents can be sent until the customer has bought a new package or paid into the balance. No invoice fee is charged on the platform. Receiving documents is never closed because of missing payment. Unused invoices in a package and an unused balance are not refunded, but are kept for as long as the agreement runs.

Reminders: Rishah does not charge interest. If an invoice from Rishah is not paid on time, this is what we do:

Day 10 and day 21 after the due date: a reminder with a reminder fee.
Day 24 after the due date: we close sending until it has been paid. Receiving is never closed.
Day 32 after the due date: final reminder with a debt collection warning and a reminder fee. If the bill has not been paid 10 days later, it is sent for debt collection.

The reminders are sent by e-mail to the address the customer has given for our invoices. The reminder fee is the amount the Danish Interest Act allows, and at most three reminder fees are charged per bill.

Rishah may change the prices with 1 month’s notice by e-mail. The customer may terminate the agreement before a price increase takes effect. Packages already bought and balances already paid are not affected.

Main account for bookkeepers and accountants: a customer who sends for other companies from one account with sub-accounts can have a main-account agreement instead of the packages. The customer states how many documents (sent and received together) are expected a month and is placed on a level according to the price list for main accounts. The customer pays a fixed amount each month – the expected number times the level’s price – also in months with fewer documents.

If the customer sends and receives more documents in a month than the fixed number, the customer is told at once: each document above the fixed number costs the price for extra documents in the price list, unless the customer upgrades its fixed number. An upgrade counts for the whole month in which it is made. If the customer says no, or does not answer before the month ends, the price for extra documents is charged for each document above the fixed number. Sending is not closed for that reason, and receiving is never closed.
If the use is below the level 3 months in a row, Rishah offers a lower level with the average of the three months as the new fixed number from the next month. It only changes if the customer accepts it.
Rishah keeps statistics of the use. After a year of use, Rishah and the customer look at the whole year to see if the level fits.

Enterprise for systems: a system with many companies under it that sends and receives through Rishah’s API can have an Enterprise agreement. The customer pays for the number of documents actually sent and received in the month – not for an estimate – and the price is worked out step by step according to the price list for Enterprise. Set-up is paid once according to the price list.

5. The customer’s responsibility

The customer is responsible for the content of the documents the customer sends, for the information about the business being correct and up to date, and for complying with the law that applies to the customer’s invoicing and bookkeeping. The customer may only use the service for its own business and never for fraud, spam or other illegal activity.

6. Storage

How far back sent and received documents can be seen and fetched in Rishah depends on the customer’s package, as stated in the price list. Rishah keeps the documents for 5 years while the account is open – with Enterprise, as long as the agreement runs. Documents older than the package shows appear as grey lines in the overview and can be seen again if the customer chooses a larger package. After 5 years a document is deleted – with Enterprise only when the agreement ends.

If the account is closed, the customer can fetch all its documents for 30 days after the closing with “Fetch all documents” under Settings. Rishah then deletes the account’s documents, drafts, customers and products.

The customer itself is obliged to keep its accounting records under the bookkeeping rules and must therefore save or fetch its documents into its own bookkeeping system.

7. Operation and errors

The service may be unavailable for periods, for example during maintenance or because of errors at subcontractors or in the networks. Rishah does not guarantee a particular uptime. Errors in the service that Rishah can reproduce are corrected by Rishah without undue delay and free of charge.

8. Liability and limitation of liability

Rishah is not liable for indirect loss, for example lost turnover, lost profit or loss of data, nor for matters outside Rishah’s control (force majeure). Rishah’s total liability can at most amount to what the customer has paid for the service in the last 6 months. The limitations do not apply in case of gross negligence or intent.

9. Confidentiality

Both parties keep the other party’s confidential information secret, also after the agreement has ended. Rishah does not sell or hand over the customer’s data unless the law requires it, for example under a court order.

10. Termination and suspension

The customer can close the whole account under Settings. The account runs until what has been paid has been used: for invoice every month until the end of the month, for «Pay now» until the current package expires. An unused balance (pay per invoice) is paid back to the account it was paid from when the account has been closed; unused invoices in a package are not paid back. The customer may terminate the agreement at the end of a month. Rishah may terminate the agreement with 3 months’ notice. If the customer materially breaches the agreement, or if there is reasonable suspicion of misuse, Rishah may block access at once and terminate the agreement. When the agreement ends, Rishah deregisters the customer’s registrations in the networks – or moves them to a new provider if the customer wishes.

11. Changes to the terms

Rishah may change the terms and the data processing agreement with at least 1 month’s notice by e-mail to the customer’s contact address. The new version can be read and approved when the customer logs in. From the day it applies, it must be approved before the customer can send documents; receiving is never closed. The customer may object or terminate the agreement before the change takes effect. Changes of sub-processors are, however, announced under section 4 of the data processing agreement.

12. Governing law and disputes

The agreement is governed by Danish law. Disagreements are sought to be resolved by negotiation. If this does not succeed, the matter is decided by the City Court of Copenhagen.

Data processing agreement

Appendix to the terms of business

1. Roles

The customer is the data controller, and Rishah is the data processor for the personal data Rishah processes for the customer when the customer uses the service. The agreement follows the General Data Protection Regulation (GDPR) and the Danish Data Protection Act and applies for as long as Rishah processes personal data for the customer.

2. What is processed

Purpose: to send, receive and show the customer’s electronic invoices and other business documents, to read the files the customer uploads with «Upload PDF», and to register the customer in Peppol and NemHandel.
Whom the data is about: the customer’s users and contact persons and contact persons at the customer’s customers and suppliers.
Which data: ordinary contact details such as name, e-mail, phone, address, job title and the information in the invoices. The customer may not put sensitive personal data in the documents, for example about health.

3. Rishah’s obligations

Rishah only processes the personal data on the customer’s instructions, which are this agreement and the customer’s use of the service. If Rishah believes an instruction is against the law, the customer is told.
Everyone who works for Rishah and has access to the data is bound by confidentiality.
Rishah protects the data with appropriate security, including an encrypted connection, personal login with two-step verification, access only for those who need it, and regular backups.
Rishah helps the customer answer requests from data subjects – for example about access, correction or deletion – and with the customer’s other obligations under the rules, to the extent that is reasonable.
If a data subject asks Rishah directly for access to their personal data, or an authority asks for information, the customer is told unless the law forbids it. Rishah does not answer the data subject itself without the customer’s instruction and only hands over information to an authority when the law requires it.
If Rishah discovers a security breach, the customer is told without undue delay and no later than 48 hours afterwards, so the customer can report it within the legal deadline.

4. Sub-processors

The customer allows Rishah to use the sub-processors listed in appendix 1 below. The appendix shows what each of them does and where the data is processed. Rishah makes sure they have the same obligations as Rishah. If Rishah replaces a sub-processor or takes a new one into use, the customer is told by e-mail before it happens and may object or close the account. The data is processed in the EU/EEA; if it has to leave the EU/EEA, this only happens with a lawful transfer basis, for example the European Commission’s standard contractual clauses. The only sub-processor outside the EU/EEA is the one that reads the files the customer uploads («Upload PDF» and «Add an invoice you have received»). It only receives the file when the customer uploads one, deletes it within 30 days at the latest, and may not use the data for anything other than reading the file for Rishah – not to train its models either.

5. Audit

Once a year the customer may ask for documentation that Rishah complies with the agreement. Rishah sends it in writing. If the customer wishes to check more, this is done as a remote review of the documentation and information Rishah makes available; time and scope are agreed in advance, and the customer pays its own and Rishah’s costs for it. The data is held by the sub-processors listed in appendix 1, and they are checked under their own agreements and statements. If a supervisory authority requires an inspection, Rishah takes part in it.

6. When the agreement ends

Rishah deletes the account’s documents, drafts, customers and products 30 days after the account has closed – until then the customer can fetch them. Documents are also deleted when they are 5 years old – with Enterprise only when the agreement ends. The access point that sends and receives the documents may keep a copy for up to 5 years for documentation and logging, unless the law requires otherwise.

When the agreement ends, Rishah deletes the customer’s personal data or returns it, as the customer chooses, unless the law requires it to be kept longer. Liability under this agreement follows the terms of business.

7. Changes to the agreement

If Rishah changes the data processing agreement, the customer is told by e-mail at least 1 month before the change takes effect. The customer may object before the change takes effect and may terminate the agreement if the objection cannot be met. The new version must be approved before the customer can send documents after the change; receiving is never closed. If only the list of sub-processors in appendix 1 changes, section 4 applies: the customer is told by e-mail before the new sub-processor is taken into use and does not have to approve a new version.

Appendix 1: Sub-processors

Sub-processor	Task	Where
Digisense A/S	Access point to Peppol and NemHandel – sends and receives the documents	EU
Rackhosting ApS	Running Rishah’s server	Denmark
Anthropic PBC	Reads the files the customer uploads with «Upload PDF» or «Add an invoice you have received» – only when the customer uses the function. Deletes them within 30 days and does not use them to train its models	USA (the European Commission’s standard contractual clauses)