Data Processing Agreement (DPA)

1.Definitions

Capitalised terms not defined in this DPA have the meaning given in the Principal Agreement or in applicable Data Protection Law. The following definitions apply:

“Account Information”

means Personal Data that relates to the Processor’s relationship with the Controller, including the names or contact information of individuals, sign-in details of individuals authorised to use the Services, and information used to handle administrative matters including billing and technical or product support. For the sake of clarity, Account Information does not include Customer Data or Content.

“Data Protection Law”

means all laws and regulations applicable to the Processing of Personal Data under this DPA, including, where applicable, the UK GDPR and the Data Protection Act 2018 (together, the “UK GDPR”); the EU General Data Protection Regulation 2016/679 (“EU GDPR”); the Swiss Federal Act on Data Protection; the US State Privacy Laws; and any successor or equivalent legislation.

“US State Privacy Laws”

means US state data-protection laws applicable to the Processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”) and comparable comprehensive state privacy statutes (such as those of Virginia, Colorado, Connecticut, Utah and Texas), in each case to the extent applicable.

“Personal Data”

, “Controller”, “Processor”, “Data Subject”, “Processing” and “Supervisory Authority” have the meanings given in applicable Data Protection Law. Where US State Privacy Laws apply, equivalent terms (including “Business”, “Service Provider” or “Processor”, “Consumer”, “Sell”, “Share” and “Business Purpose”) carry the meanings given in those laws.

“Customer Personal Data”

means Customer Data or the Controller’s Content that is provided through the Services and that is Personal Data, Processed by the Processor on behalf of the Controller under the Principal Agreement, as further described in Annex 1.

“Sub-processor”

means any third party engaged by the Processor to Process Customer Personal Data.

“Personal Data Breach”

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

“Restricted Transfer”

means a transfer of Customer Personal Data to, or access from, a country or recipient not recognised under Data Protection Law as providing an adequate level of protection, where such transfer requires a lawful transfer mechanism.

“Standard Contractual Clauses”

(“SCCs”) means (a) for the EU GDPR, the clauses annexed to European Commission Implementing Decision (EU) 2021/914; and (b) for the UK GDPR, the UK International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”), in each case as applicable and as amended or replaced from time to time.

“Usage Personal Data”

means Personal Data included in data collected automatically about the use of the Services, such as log data, device and browser information and feature usage.

2.Roles of the parties

As between the parties, the Controller is the controller and the Processor is the processor of Customer Personal Data. Where US State Privacy Laws apply, the Controller is the “business” and the Processor acts as a “service provider” or “processor”. The Processor Processes Customer Personal Data only to provide the Services and for no independent purpose of its own. Where the Controller is an audit firm, it is an independent controller of the Personal Data contained in its audit clients’ records, and the Processor Processes that data as the Controller’s processor under this DPA. As between the parties, Customer Personal Data is owned by the Controller, and the Processor acquires no right in it other than to Process it in order to provide the Services.

To the extent the Processor Processes Personal Data, the parties Process it according to the following roles:

• Customer Personal Data: as between the Controller and the Processor, the Controller is the Data Controller and the Processor is the Data Processor, Processing Customer Personal Data on the Controller’s behalf.
• Account Information and Usage Personal Data: the Processor acts as independent Data Controller, as set out in Section 14.

The subject matter, duration, nature and purpose of the Processing, and the categories of Data Subjects and Personal Data, are described in Annex 1.

Each party complies with its obligations under Data Protection Law. The Controller is responsible for the lawfulness of the Customer Personal Data it provides and of the instructions it gives the Processor, including for establishing a lawful basis for Processing, providing required notices to Data Subjects, and obtaining any necessary consents.

3.Processing instructions

The Processor Processes Customer Personal Data only on the documented instructions of the Controller, including as set out in this DPA, the Principal Agreement, and the Controller’s configured and permitted use of the Services, unless required to do otherwise by a law that applies to the Processor. In that case, the Processor informs the Controller of the legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

Together, this DPA and the Principal Agreement constitute the Controller’s complete and final documented instructions to the Processor. The Processor does not Process, retain, use, or disclose Customer Personal Data for any purpose other than performing the Services, except as permitted or required by Data Protection Law. The Processor informs the Controller if, in its opinion, an instruction infringes Data Protection Law.

4.Confidentiality

The Processor ensures that persons authorised to Process Customer Personal Data are bound by an appropriate duty of confidentiality (whether contractual or statutory) and Process the data only as instructed. Access to Customer Personal Data is limited, on a least-privilege basis, to those personnel who require it to provide the Services. The Processor maintains security-awareness and data-protection training for such personnel.

5.Security of Processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk to Data Subjects, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. These measures are described in Annex 2 and include, as applicable:

• encryption of Customer Personal Data in transit, and encryption of credential-bearing data at rest, in addition to infrastructure-level storage encryption;
• measures to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems, including multi-tenant isolation enforced at the data-access layer;
• role-based access control on a least-privilege basis, with multi-factor authentication for privileged access and read-only, consent-based connections to the Controller’s systems;
• the ability to restore availability and access to Customer Personal Data in a timely manner in the event of a physical or technical incident; and
• a process for regularly testing, assessing and evaluating the effectiveness of the measures, including secure-development gates and vulnerability management.

The Processor does not materially decrease the overall security of the Services during the term of the Principal Agreement.

6.Sub-processing

The Controller provides a general authorisation for the Processor to engage Sub-processors to Process Customer Personal Data, subject to this Section. A current list of Sub-processors is set out in Annex 3. The Processor:

• imposes on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, in particular in relation to security and the requirements of Article 28 of the GDPR;
• remains fully liable to the Controller for the performance of each Sub-processor’s obligations;
• maintains an up-to-date list of Sub-processors and makes it available to the Controller; and
• gives the Controller prior notice of any intended addition or replacement of a Sub-processor (at least thirty (30) days in advance where reasonably practicable), giving the Controller the opportunity to object on reasonable data-protection grounds.

If the Controller reasonably objects, the parties will work in good faith to resolve the concern. If no resolution is reached within a reasonable period, the Controller may, as its sole remedy, terminate the affected portion of the Services in accordance with the Principal Agreement.

7.Data subject rights

Taking into account the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects (or, under US State Privacy Laws, Consumers) exercising their rights. If the Processor receives such a request directly, it refers the requester to the Controller and does not respond to the request itself, except on the Controller’s instruction or as required by law.

8.Assistance to the Controller

The Processor provides the Controller with reasonable assistance, taking into account the nature of Processing and the information available to the Processor, with: data-protection impact assessments; prior consultations with a Supervisory Authority; the Controller’s obligations to secure Processing; and the notification and communication of Personal Data Breaches (Articles 32 to 36 of the GDPR and equivalent provisions of Data Protection Law).

9.Personal Data Breach

The Processor notifies the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it; where the information cannot be provided at once, it may be provided in phases without further undue delay.

The Processor takes reasonable steps to mitigate the breach, cooperates with the Controller in its response and provides the information the Controller reasonably requires to meet its own notification obligations. The Processor’s notification is not, and may not be construed as, an acknowledgement of fault or liability.

10.Audit and information

The Processor makes available to the Controller information reasonably necessary to demonstrate compliance with this DPA. The Processor may satisfy this obligation, in the first instance, by providing third-party attestations, certifications, or reports (such as SOC 2 reports or ISO/IEC 27001 certificates) where available.

On reasonable prior written notice, and subject to confidentiality, the Processor allows for and contributes to audits conducted by the Controller or an independent auditor it mandates. Audits do not unreasonably disrupt the Processor’s operations, respect the security and confidentiality of other customers’ data, and are limited to once per calendar year, unless a Personal Data Breach or a binding regulatory requirement justifies more frequent review.

11.International transfers

The Controller may transfer Customer Personal Data to the Processor in the United Kingdom in order for the Processor to provide the Services.

The Processor does not make a Restricted Transfer of Customer Personal Data without ensuring that an appropriate transfer mechanism under Data Protection Law is in place (for example, an adequacy decision or the Standard Contractual Clauses). Where the Processor or a Sub-processor Processes Customer Personal Data outside the jurisdiction(s) agreed with the Controller, the relevant SCCs are deemed incorporated into this DPA by reference and completed as set out in Annex 4, including the UK Addendum for transfers subject to the UK GDPR and the applicable amendments for transfers subject to Swiss law.

Where there is any conflict between the SCCs and this DPA, the SCCs prevail in respect of the relevant Restricted Transfer. The Processor ensures that Sub-processor transfers are likewise covered by an appropriate mechanism.

12.US State Privacy Laws (CCPA and equivalents)

This Section applies to the extent the Processor Processes Customer Personal Data subject to US State Privacy Laws. The Processor acts as a “service provider” or “processor” and Processes such data solely to perform the Services for the Controller (the “Business Purpose”).

The Processor will not: (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the Business Purpose, or outside the direct business relationship between the parties, except as permitted by US State Privacy Laws; or (c) combine Customer Personal Data with personal information received from, or on behalf of, third parties, or collected from its own interactions with Consumers, except as permitted by those laws.

The Processor certifies that it understands the restrictions in this Section and will comply with them. The Processor assists the Controller in responding to verifiable Consumer rights requests, and will notify the Controller without undue delay if it determines that it can no longer meet its obligations under US State Privacy Laws. The Controller may take reasonable steps to stop and remediate any unauthorised Processing.

13.Return and deletion

This DPA remains in effect until (i) the Services are terminated and (ii) the Processor no longer Processes Customer Personal Data on the Controller’s behalf, except that Section 14 survives for as long as the Processor processes Account Information and Usage Personal Data. Within thirty (30) days of either (i) termination of the Services or (ii) the Controller’s reasonable request, the Processor shall, and shall direct each Sub-processor to, return to the Controller or delete the Customer Personal Data, unless the Processor is required by law to retain such Customer Personal Data. Residual copies held in routine, secured backups are deleted or overwritten in the ordinary course of the Processor’s backup cycle and remain protected by the measures in Annex 2 until purged.

During the Services, the Processor stores Customer Personal Data only as needed to perform the Services and maintains routine, encrypted backups. Working copies of engagement files are purged automatically thirty (30) days after the Controller closes the engagement, with a signed manifest of file hashes retained. On the Controller’s written request, the Processor confirms in writing that deletion has been completed in accordance with this Section.

14.heily as a Data Controller

When the Processor processes Personal Data contained in Account Information and Usage Personal Data, the Processor is acting as a Data Controller, and the Processor will:

14.1 Process such Personal Data in compliance with applicable Data Protection Law, and strictly to:

• 14.1.1 manage the Controller’s account, and the Processor’s relationship with the Controller, including identity verification, and providing support, required to access or use the Services;
• 14.1.2 carry out the Processor’s core business operations, such as accounting and auditing;
• 14.1.3 prevent, detect or investigate security incidents and manage the security of the Processor’s platform and Services;
• 14.1.4 for business analytics and product strategy; and
• 14.1.5 develop and improve new products and services and improve the performance, functionality, safety and security of the Services.

14.2 The Processor will implement technical and organisational measures designed to mitigate the risk of unlawful or unauthorised access, destruction, alteration, disclosure or use of Account Information and Usage Personal Data. These technical and organisational measures will be designed to provide a level of security appropriate to the risk of processing.

15.Liability

Each party’s liability arising out of or related to this DPA is subject to the exclusions and limitations of liability set out in the Principal Agreement. Any reference in the Principal Agreement to the liability of a party means the aggregate liability of that party under the Principal Agreement and this DPA together. Nothing in this DPA limits liability that cannot be limited under applicable law.

16.Term and general provisions

This DPA takes effect on the effective date of the Principal Agreement and continues for as long as the Processor Processes Customer Personal Data. Provisions that by their nature should survive termination do so.

If any provision of this DPA is found unenforceable, the remainder continues in effect. This DPA is governed by the law and jurisdiction stated in the Principal Agreement (absent that, the laws and courts of England and Wales), unless Data Protection Law requires otherwise. This DPA may be executed in counterparts, including by electronic signature, each of which is an original and which together form one instrument. Any variation must be agreed in writing by the parties.

Annex 1Details of Processing

The subject matter and details of the Processing, as required by Article 28(3) of the GDPR.

Annex 2Technical and organisational measures

The security measures maintained by the Processor. Status indicators show measures that are Live, In progress or Planned.

Certifications and roadmap. The Processor maintains a formal information-security programme and intends to pursue SOC 2 Type I, SOC 2 Type II and ISO/IEC 27001. Target dates will be published here once scheduled and do not constitute a contractual commitment. Current attestations are made available under Section 10 as they become available.

Annex 3Sub-processors

The Processor engages the following Sub-processors to Process Customer Personal Data, and informs the Controller of intended changes in accordance with Section 6.

• Anthropic
• Cloudflare
• GitHub
• Google Cloud (Vertex AI / Gemini)
• Google Workspace
• LangSmith (LangChain)
• Microsoft Azure
• Railway
• Resend
• Stripe

Customer-connected services. Where the Controller connects third-party systems to the Services (for example, Microsoft 365, an audit platform such as Caseware or Inflo, or accounting software such as Xero or QuickBooks), those systems are controlled by the Controller and are not Sub-processors of the Processor under this DPA. The Controller is responsible for its own agreements with those providers.

Annex 4Cross-border transfer mechanisms

Population of the Standard Contractual Clauses and the UK Addendum, applicable where a Restricted Transfer occurs (Section 11).

EU Standard Contractual Clauses, Decision (EU) 2021/914

UK International Data Transfer Addendum (UK Addendum)

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with the amendments necessary under Swiss law, including that references to the GDPR are read as references to the Swiss FADP and the competent authority is the Swiss Federal Data Protection and Information Commissioner.