Data Processing Addendum

As between the parties, you are the Controller of Personal Data and Automate Accounting is the Processor, except where you act as a Processor on behalf of a third-party Controller (Section 2.2), in which case Automate Accounting acts as your Subprocessor.

Where you are an accounting, bookkeeping or advisory firm keeping books in the Application on behalf of your own clients, you are a Processor for those clients and Automate Accounting is your Subprocessor. You warrant that your agreements with those clients permit you to engage Automate Accounting on the terms of this DPA and that your instructions under this DPA are consistent with your obligations to them.

Accounting Advisor is a separate legal entity under shared ownership with Automate Accounting. It is not a party to this DPA and does not process Customer Data under it. If you engage Accounting Advisor for advisory or controller services, it processes Customer Data under its own agreement with you, and you grant it access to your books yourself, through the Application’s own access controls.

You are responsible for:

• the lawfulness of the Personal Data you make available to the Application and of your instructions;
• providing any notices to, and obtaining any consents from, Data Subjects;
• the accuracy and content of Customer Data; and
• configuring the Application’s access controls — user accounts, roles, per-company permissions, multi-factor authentication and external sharing — for your circumstances.

Automate Accounting will process Personal Data only on your documented instructions, which are: the Agreement, this DPA, and your and your users’ use of the Application’s features (including the connections you authorise and the sharing you configure). Automate Accounting will not process Personal Data for any other purpose.

If Automate Accounting is required by law to process Personal Data other than on your instructions, it will inform you before doing so unless the law prohibits that on important grounds of public interest.

Automate Accounting will inform you if, in its opinion, an instruction infringes Data Protection Laws. It is not obliged to perform a legal review of your instructions.

Where the CCPA applies, Automate Accounting is a Service Provider and:

• will not Sell or Share Personal Data;
• will not retain, use or disclose Personal Data for any purpose other than the business purposes specified in this DPA and the Agreement, or outside the direct business relationship between the parties;
• will not combine Personal Data with personal information it receives from other sources, except as the CCPA permits;
• will notify you if it determines it can no longer meet its obligations under the CCPA; and
• grants you the right to take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Data.

Automate Accounting certifies that it understands these restrictions and will comply with them.

You give Automate Accounting general authorisation to engage Subprocessors to provide the Application. The Subprocessors engaged at the date of this DPA are set out in Annex III.

Automate Accounting will notify you by email, to the administrative contact on your account, at least thirty (30) days before authorising a new Subprocessor to process Personal Data, or replacing one. You may object in writing within that period on reasonable, documented data-protection grounds. The parties will discuss the objection in good faith; if it cannot be resolved, you may terminate the affected part of the Application, or the Agreement, on written notice without penalty, and Automate Accounting will refund any prepaid fees for the period after termination.

Automate Accounting will impose on each Subprocessor, by written contract, data-protection obligations no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides, and remains responsible to you for the Subprocessor’s performance of them.

The Application is the first means of responding to Data Subject requests: you can access, correct, export and delete Personal Data in your books directly, and the audit trail records who did so.

Taking into account the nature of the processing, Automate Accounting will assist you, by appropriate technical and organisational measures and insofar as possible, in fulfilling your obligation to respond to requests from Data Subjects to exercise their rights.

If Automate Accounting receives a request from a Data Subject relating to Personal Data it processes for you, it will, to the extent legally permitted, promptly forward the request to you and will not respond to it except on your instructions or where required by law. If the request concerns a user’s own account, Automate Accounting may direct the user to you and to the Application’s account features.

Automate Accounting will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting your Personal Data. Notification is sent to the administrative contact on your account.

The notification will describe, to the extent then known, the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point. Information not available at the time of the first notification is provided in phases as it becomes available.

Automate Accounting will take reasonable steps to contain and remediate the incident and will cooperate with you in your own notification obligations. A notification under this Section is not an acknowledgement of fault or liability.

On request, Automate Accounting will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to a reasonable security questionnaire.

Automate Accounting does not currently hold a third-party audit report or certification, such as a SOC 2 report, and does not represent otherwise in this Addendum or elsewhere. If and when such a report is obtained, providing it will satisfy an audit request under Section 10.3 to the extent of its scope.

Not more than once in any twelve-month period, on at least thirty (30) days’ written notice, you (or an independent auditor you appoint who is reasonably acceptable to Automate Accounting and bound by confidentiality) may audit Automate Accounting’s compliance with this DPA. Audits are conducted during business hours, are limited to what is reasonably necessary, may not access other customers’ data, and are at your cost unless they reveal a material breach of this DPA. An audit is also permitted, without the frequency limit, where required by a Supervisory Authority or following a Security Incident.

The Application is hosted on infrastructure in the United States (currently in the US-West region, Oregon). Customer Data is stored and processed there, and may be accessed from the locations where Automate Accounting’s personnel and Subprocessors operate.

To the extent Automate Accounting processes Personal Data subject to the GDPR that is transferred to a country not recognised by the European Commission as providing adequate protection, the parties enter into the SCCs, which are incorporated into this DPA by reference, on the following basis:

• Module Two (controller to processor) applies where you are a Controller, and Module Three (processor to processor) where you are a Processor;
• Clause 7 (docking clause) is included;
• under Clause 9, Option 2 (general written authorisation) applies, with the notice period in Section 6.2;
• the optional language in Clause 11 is not included;
• under Clause 13, the competent Supervisory Authority is that of the EU Member State in which the data exporter is established, or otherwise the authority determined under Annex I.C;
• under Clause 17 (Option 1), the SCCs are governed by the law of the EU Member State in which the data exporter is established or, where that law does not allow for third-party beneficiary rights, the law of Ireland; under Clause 18, disputes are resolved by the courts of that Member State; and
• Annexes I and II to the SCCs are completed by Annexes I and II to this DPA, and Annex III to the SCCs by Annex III to this DPA.

For Personal Data subject to the UK GDPR, the SCCs as completed above apply as modified by the UK Addendum, which is incorporated by reference. Tables 1 to 3 of the UK Addendum are completed by the information in this DPA and its Annexes, and for Table 4 either party may end the UK Addendum as set out in its Section 19.

For Personal Data subject to the FADP, the SCCs apply with the adaptations the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the FADP, “Member State” includes Switzerland so that Swiss Data Subjects may bring claims in Switzerland, and the competent Supervisory Authority is the Federal Data Protection and Information Commissioner.

If a mechanism relied on above is invalidated or replaced, the parties will cooperate in good faith to put an alternative lawful transfer mechanism in place, and Automate Accounting may update this Section accordingly on notice to you.

You can export Customer Data at any time through the Application — statements, ledgers, the trial balance, journal detail and the documents attached to them — including as a complete due-diligence package. There is no export tier and no charge to leave.

On termination or expiry of the Agreement, Automate Accounting will, at your choice, return Customer Data by the same exports or delete it. Absent an instruction, Automate Accounting will delete Customer Data within thirty (30) days after termination, and from backup copies in the ordinary course of the backup cycle thereafter, except where retention is required by applicable law, in which case the retained data remains subject to this DPA and is deleted when that requirement ends.

The audit trail — the record of who did what in the Application, and the tamper-evident chain over it — is designed so that it cannot be edited or deleted, which is what makes it evidence. Entries in it that identify your users are retained on that basis and under the record-keeping obligations that apply to books of account; they are not used for any other purpose, and access to them is restricted as described in Annex II.

This DPA forms part of the Agreement and takes effect when you accept the Agreement, including by accepting it at sign-up. It continues for as long as Automate Accounting processes Personal Data for you, including the return-and-deletion period in Section 12. No separate signature is required for it to apply.

In the event of conflict, the following order of precedence applies: the SCCs (where they apply), then this DPA, then the Agreement.

Automate Accounting may update this DPA to reflect changes in Data Protection Laws, in the Application, or in its Subprocessors, by publishing the revised version at this address and, for material changes, notifying the administrative contact on your account at least thirty (30) days before they take effect. A change that materially reduces the protections in this DPA gives you the termination right in Section 6.2.

• Data exporter: Customer, as identified in the Agreement, acting as Controller or Processor as set out in Section 2.
• Data importer: Automate Accounting, acting as Processor (or Subprocessor).
• Contact points: the administrative contact on the Customer’s account, and contact@automate-accounting.com for Automate Accounting.

• Subject matter: provision of the Application — multi-entity accounting software — under the Agreement.
• Duration: the term of the Agreement plus the return-and-deletion period in Section 12.
• Nature and purpose: hosting, storage, transmission, retrieval and display of Customer Data; posting and reporting on accounting records; importing bank transactions, payroll data and documents; extracting data from uploaded documents where you enable that feature; transmitting electronic invoices where you enable that feature; sending the notifications and emails you configure; providing support; and securing and operating the Application, including its audit trail.
• Categories of Data Subjects: your users and personnel; your customers, vendors and their contacts; your employees and contractors, where you process payroll or expenses; the recipients you share documents or reports with (lenders, investors, auditors); and, where you are a firm, the equivalent categories for each client whose books you keep.
• Categories of Personal Data: identification and contact details (names, email addresses, postal addresses, phone numbers, job titles); account and authentication data (credentials stored as one-way hashes, multi-factor enrolments, session and login records); financial and transaction data (invoices, bills, payments, journal entries, bank transactions and the descriptions they carry, bank account identifiers); payroll and expense data (compensation, deductions, reimbursements and the tax identifiers those records require); the content of documents you upload as evidence, which may contain any of the above; and usage data (IP address, browser information, timestamps and the actions recorded in the audit trail).
• Special categories of data: the Application is not designed for, and Automate Accounting does not require, special categories of Personal Data. Such data may be present incidentally in documents or payroll records you choose to upload; you are responsible for limiting it to what you need and for any additional safeguards it requires.
• Frequency: continuous, for the term.
• Retention: as set out in Section 12.
• Transfers to Subprocessors: to the Subprocessors in Annex III, for the purposes and duration stated there.

Determined in accordance with Clause 13 of the SCCs, as set out in Section 11.2.