Data Processing Agreement
Version 0.1-draft · Terms · Privacy · Data Processing Agreement
1. Scope and roles
1.1 This agreement forms part of the Tallyback Terms and Conditions between [Company name] Limited ("Processor", "we") and the Customer ("Controller"). It meets the requirements of Article 28 of the UK GDPR.
1.2 The Customer is the controller of personal data in the Customer Data. We process it only to provide the Service, on the Customer's documented instructions. The Terms, the Customer's settings and its use of the Service are those instructions.
1.3 If we think an instruction breaks data protection law, we will tell the Customer.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Collecting and reconciling supplier statements and invoices |
| Duration | The term of the subscription, plus the deletion period in section 6 |
| Nature and purpose | Storing daybooks and supplier lists; sending emails to suppliers; receiving and reading statements and invoices (including by AI); matching and reporting; forwarding copy invoices to the Customer's chosen inbox |
| Data subjects | Customer's suppliers' contact people (including sole traders); Customer's staff using the Service |
| Personal data | Names, business email addresses, phone numbers and addresses where included, references and amounts in transactions with identifiable sole traders, email contents |
| Special category data | None expected. The Customer should not upload it. |
3. Our obligations
We will:
- process personal data only on the Customer's documented instructions, unless the law requires otherwise (in which case we will tell the Customer first, unless the law forbids it);
- make sure anyone with access to the data is bound by confidentiality;
- keep the data secure using the measures in section 5;
- use sub-processors only as set out in section 4;
- help the Customer respond to requests from people exercising their data protection rights, for example by finding, exporting or deleting a supplier's details;
- help the Customer with security, breach notification, data protection impact assessments and consultation with the ICO, as far as the processing allows;
- delete or return the data at the end of the service, as set out in section 6; and
- give the Customer the information needed to show we meet these obligations, and allow audits as set out in section 6.
If a supplier or other person contacts us directly about their data, we will pass the request to the Customer without undue delay and not answer it ourselves unless the Customer asks us to.
4. Sub-processors
4.1 The Customer gives general authorisation for us to use the sub-processors below. We will give at least [30] days' notice by email before adding or replacing one. If the Customer objects on reasonable data protection grounds and we can't resolve it, the Customer may cancel without penalty.
4.2 We will have a written contract with each sub-processor giving the same level of protection as this agreement, and we remain responsible for them.
| Sub-processor | What it does | Where data is processed |
|---|---|---|
| Akamai Technologies (Linode) | Server hosting, storage and backups | London, UK |
| Postmark (ActiveCampaign, LLC) | Sending emails to suppliers and receiving replies | United States |
| Anthropic | AI reading of scanned or photographed statements and invoices | United States |
4.3 Anthropic does not train its models on content sent through its commercial service. Only the document being read is sent, and only when it can't be read without AI. Spreadsheets and text PDFs are read on our own server.
5. Security measures
| Area | What we do |
|---|---|
| Location | Live data and backups held on servers in London, UK |
| Encryption in transit | All web pages, uploads and webhooks over HTTPS |
| Encryption at rest | Statements, invoices and daybooks encrypted in the database; key held separately from the data |
| Separation | Each customer company's data is kept separate; every request checks the user's company |
| Access | Passwords stored as scrypt hashes; account locked after 5 failed logins; sessions expire after 14 days; one-time password reset links that expire after an hour |
| Supplier links | Upload links use long random tokens and expire after 60 days |
| Backups | Nightly encrypted backups kept 30 days, plus weekly server backups by the host |
| Server | Firewall allows web traffic only; admin access limited to named IP addresses; software kept updated |
| Staff | Access limited to the founder; anyone given access will sign a confidentiality agreement |
6. Breaches, audits and end of service
6.1 Personal data breaches. We will tell the Customer without undue delay, and in any case within [48] hours of becoming aware of a breach affecting its data. We will say what happened, what data and how many people are likely affected, what we are doing about it, and who to contact. This gives the Customer time to report to the ICO within 72 hours where required.
6.2 Audits. On reasonable request, we will provide information showing we comply with this agreement, such as our security measures and sub-processor contracts. The Customer may audit us on at least [30] days' notice, no more than once a year unless there has been a breach, at its own cost and under confidentiality.
6.3 End of service. When the subscription ends, the Customer can download its reports for [30] days. We then delete Customer Data from the live system, and from backups within a further [30] days, unless the law requires us to keep it. On request we will confirm deletion in writing.
6.4 Liability. Each party's liability under this agreement is subject to the limits in section 10 of the Terms, except where the law does not allow it.
6.5 Law. This agreement is governed by the law of England and Wales.