Data Processing Agreement
Last updated: 11 June 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (the practice or business using eCashbook — the “Controller”) and Finnacc (UK) Ltd (the “Processor”), and reflects Article 28 of the UK GDPR. It applies to all personal data the Controller uploads to or processes in eCashbook.
1. Details of the processing
| Subject matter | Provision of the eCashbook cash-basis bookkeeping service. |
|---|---|
| Duration | The term of the customer's subscription, plus the deletion period below. |
| Nature & purpose | Storing, importing, reading (including AI-assisted reading of statements), categorising and reporting on bookkeeping records, on the Controller's instructions. |
| Personal data | Names and contact details of the Controller's clients and their counterparties; bank-transaction lines (dates, descriptions, amounts); uploaded statements and supporting documents; notes and queries. |
| Data subjects | The Controller's clients, their customers/suppliers/employees, and the Controller's own staff. |
2. Processor obligations
The Processor shall:
- process personal data only on the Controller's documented instructions (using the service constitutes such instructions), unless required by law — in which case it will inform the Controller unless prohibited;
- ensure persons authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational measures (summarised in the Security overview): encryption in transit and at rest, per-tenant isolation enforced by row-level security, role-based access, audit logging and managed backups;
- engage sub-processors only as listed below, remain responsible for them, and give the Controller prior notice of changes (with the right to object on reasonable grounds);
- taking into account the nature of the processing, assist the Controller in responding to data-subject rights requests;
- assist the Controller with security, breach-notification, and data-protection impact obligations;
- notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data;
- at the end of the service, delete or return the personal data at the Controller's choice (and delete remaining copies within [60] days, subject to backup roll-off), unless law requires retention;
- make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, no more than once per year on reasonable notice, at the Controller's cost.
3. Sub-processors
| Sub-processor | Processing | Location |
|---|---|---|
| Supabase | Database, authentication and file storage (all bookkeeping data) | Ireland (AWS eu-west-1) |
| Vercel | Application hosting and content delivery | Global edge network (USA-headquartered) |
| Anthropic | AI reading of uploaded bank-statement PDFs and transaction-description categorisation. API data is not used to train models. | USA |
| Google Cloud (Document AI) | PDF bank-statement text extraction (secondary engine) | EU processing region |
| Google (Gmail / Apps Script) | Transactional email (notifications, reminders, invites) | Google infrastructure (EU/USA) |
4. International transfers
Where a sub-processor processes personal data outside the UK, the Processor ensures appropriate safeguards are in place (UK adequacy regulations, or the UK International Data Transfer Agreement/Addendum incorporating standard contractual clauses).
5. Controller obligations
The Controller warrants it has a lawful basis (and where needed, has informed its own clients) for the personal data it uploads, that the data is accurate so far as required, and that its instructions comply with data protection law.
6. Liability and order of precedence
Liability under this DPA is subject to the limitations in the Terms of service. If this DPA conflicts with the Terms, this DPA prevails for data protection matters.
7. Contact
Data protection contact: info@finnacc.com · Finnacc (UK) Ltd, 12 Cavendish House, Plumpton Road, Hoddesdon EN11 0LB, United Kingdom.