Data Processing Agreement

The Processor processes the personal data in the documents and answers the Controller's people and clients upload or type into Vedas, to prepare VAT returns, accounts, MTD updates and tax computations for the Controller to review. The processing includes storing, sorting and reading documents, extracting lines and figures, suggesting codings, drafting questions and working papers, and deleting documents. Annex 1 gives the details.

The processing lasts as long as the Terms of Service, and until the data is deleted under section 9.

The Processor processes the personal data only on the Controller's documented instructions, including on transfers outside the UK, unless UK law requires otherwise; in that case it tells the Controller first, unless the law forbids it. The Controller's instructions are these terms, its settings in Vedas (such as its retention period) and what its people do in Vedas.

The Processor tells the Controller at once if it thinks an instruction breaks data protection law.

The Processor makes sure everyone it authorises to process the personal data is bound by confidentiality. It gives access only to those who need it to run and support the service.

The Processor takes the technical and organisational measures in Annex 2 to protect the personal data, as Article 32 of the UK GDPR requires, and keeps them up to date.

The Controller gives general authorisation for the Processor to use the subprocessors listed on the Subprocessors page (Annex 3).

The Processor gives at least 30 days' notice of a new or replaced subprocessor, by email to the Controller's Partners and on that page. The Controller may object on reasonable data protection grounds within that time. If the parties can't resolve it, the Controller may end the Terms of Service before the change takes effect.

This notice applies only to a new or replaced subprocessor that will process the Controller's personal data. The Processor may change the other systems, tools and suppliers behind Vedas without notice, as long as the protections in this agreement stay in place.

The Processor puts the same data protection obligations as in this agreement on each subprocessor by contract, and stays liable to the Controller for each subprocessor's performance.

Taking into account the nature of the processing, the Processor helps the Controller answer requests from people exercising their rights. Most requests the Controller can deal with in Vedas itself. If a request comes to the Processor directly, it passes it to the Controller without undue delay and does not answer it unless told to.

The Processor helps the Controller meet its obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to it.

The Processor tells the Controller of a personal data breach affecting its data without undue delay, and within 48 hours of becoming aware of it. The notice says what is known of what happened, the data and people affected, the likely consequences and what is being done, and is updated as more is known.

The Processor keeps the security measures in Annex 2 and follows a written process for handling a breach. If a breach happens, including one beyond its reasonable control such as a criminal attack on its systems or a provider's systems, its standard steps are:

• tell the Controller, as above, so that it can protect its clients, including deleting any data it holds in Vedas if it chooses;
• report an attack to the UK's cyber security authorities: the National Cyber Security Centre, and the police's cyber crime reporting service where a crime is involved;
• contain the breach, find the cause and fix it;
• keep a record of the breach and what was done.

The Controller decides whether to report the breach to the ICO and whether to tell the people affected. The Processor gives it the information it needs to do so.

The Processor gives the Controller the information it reasonably needs for a data protection impact assessment, or a consultation with the ICO, about its use of Vedas.

The Processor stores the personal data in the UK, and the models that read documents run in the EU. Some processing passes outside the UK and EU, as Annex 3 shows. For any such transfer, the Processor makes sure an Article 46 safeguard is in place: the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or, where the recipient is certified under it, the UK-US data bridge.

During the agreement, client documents are deleted after the Controller's retention period, as Annex 2 describes. The Controller can download its outputs at any time.

When the Terms of Service end, the Processor deletes the personal data within 30 days, unless UK law requires it to keep it. Before the end, the Controller may download its outputs, or ask for a copy of its data in a common format.

If no one at the Controller signs in or uses Vedas for 60 days, the Processor deletes the Controller's documents and outputs. If there is no sign-in or use for 6 months, the Processor closes the Controller's account and deletes all its data. In both cases the Processor first emails the Controller's Partners at least 14 days ahead.

The Processor makes available the information needed to show it meets this agreement and Article 28, and allows for and contributes to audits and inspections by the Controller or an auditor it appoints. An audit needs 30 days' notice, takes place in working hours, at most once a year unless after a breach or at a regulator's request, and under confidentiality. The Controller pays its own costs.

The Controller is responsible for having a lawful basis for the processing and for telling its clients about it. Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow it. This agreement is governed by the law of England and Wales.

Categories of data subject:

• The firm's own clients: sole traders, partners, company directors and shareholders, landlords and individuals whose returns or accounts the firm prepares.
• People named in those clients' documents: customers, suppliers, employees, tenants, payers and payees on bank statements, invoices and receipts.
• The firm's clients who use a client link to answer questions or upload files.

Categories of personal data:

• Names, addresses, email addresses and phone numbers printed in the documents.
• Financial data: bank transactions, invoices, receipts, payslips, P60s, pension, interest, dividend and rent statements, and the figures worked out from them.
• Tax references, such as VAT registration numbers, Unique Taxpayer References and company numbers.
• Answers and notes the firm's people or their clients type into Vedas.
• Any other personal data the firm chooses to upload. Special category data is not needed, and firms should not upload it on purpose.

Frequency: continuous, while the Controller uses Vedas. Retention: see section 9 and Annex 2.

• Hosting: the database and files are stored in London. The app runs in the Netherlands, in the EU. The AI models that read documents run in the EU, pinned in code with no fallback.
• AI models: every request is sent with zero data retention and with data collection for training refused; a check in code refuses any request that does not meet both.
• Separation between firms: each firm's data is kept apart by row-level security in the database, checked on every request. The firm is always taken from the signed-in person's membership, never from the request.
• Per-job keys: each job's requests to the AI models use their own key with its own spend limit.
• Encryption: data is encrypted in transit with TLS 1.2 or 1.3 (HTTPS only), and at rest with AES-256 by the hosting providers, including backups. Tax references and stored keys are also encrypted by Vedas with AES-256-GCM before they are saved.
• Access control: sign-in by single-use email links that expire after an hour, with rate limits; roles within each firm; downloads through signed links that last 5 minutes. The Processor's staff have no screen that opens a firm's jobs.
• Retention: a job's documents, the text read from its scans and its page images are deleted after the Controller's retention period (7, 30 or 90 days after the job closes), or 30 days after a job finished if it was never unlocked. A scheduled task checks every six hours. Separately, a firm's documents and outputs are deleted after 60 days with no sign-in or use, and its account is closed after 6 months, each after 14 days' notice by email.
• Human review: code computes every figure, and nothing is filed or sent for the Controller.
• Logging: important actions are kept in an audit record. Logs do not hold document content.
• Breaches: a written process for handling a breach, with the steps in section 7.

The subprocessors, what each does and where, are listed on the Subprocessors page, which forms part of this agreement.