Data Processing Addendum

1. Roles

For the personal information in your books, you are the controller (or, under U.S. state privacy laws, the business) and we are the processor (or service provider). You decide what to upload and how to use it; we process it only to provide the Service to you. For your own account information, such as your name, email address and billing details, we are the controller and our Privacy Policy applies.

2. What we process

Subject matter and duration: bookkeeping data for the organizations on your account, for as long as your account exists plus the deletion period in section 8. Nature and purpose:storing, importing, categorizing, analysing, reporting and exporting financial records, and the AI features described in the Privacy Policy. Types of personal information: names, email addresses, postal addresses, bank and card transaction descriptions and amounts, invoice and bill details, receipt images, and any notes you add. Categories of people: your customers, vendors, employees, contractors and clients, and the members of your organizations.

3. Our obligations

• We process personal information only on your documented instructions, which are the Terms of Service, this DPA and your use of the Service’s features, unless the law requires otherwise, in which case we will tell you before processing where the law allows.
• We do not sell personal information, share it for cross-context behavioural advertising, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal information we receive from anyone else except as the Service requires.
• Everyone we allow to access personal information is bound by confidentiality obligations.
• We will tell you without undue delay if we believe an instruction breaks a data protection law, and if we can no longer meet our obligations under this DPA.
• We will help you respond to requests from individuals to access, correct, delete or export their information, and with any data protection assessment or regulator consultation that concerns our processing, to the extent the information is in our possession.

4. Security

We maintain the technical and organizational measures described in section 7 of the Privacy Policy: encryption in transit for every connection, salted password hashes, encryption at rest for bank access tokens, role-based access to each organization enforced by the API, isolation between organizations, and restricted access to production systems. We will notify you without undue delay, and in any case within 72 hours of becoming aware, of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information we process for you, and give you the information you need to meet your own notification duties.

5. Sub-processors

You authorise us to use the sub-processors below. We impose data protection obligations on each of them that are no less protective than this DPA, and we remain responsible for their performance.

The Service itself runs on infrastructure we operate in the United States. We will email the address on your account at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the affected subscription and we will refund any prepaid fees for the remainder of the term.

6. International transfers

We process personal information in the United States. If you are subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland, you instruct us to process the information in the United States and the parties agree that the European Commission’s Standard Contractual Clauses (module two, controller to processor), and the UK International Data Transfer Addendum where UK law applies, are incorporated into this DPA by reference, with you as the data exporter and Novaluna as the data importer, the governing law and courts of Ireland for the clauses themselves, and this DPA supplying the annex information. On request we will provide a signed copy.

7. Audit and information

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, in the form of written answers and documentation, no more than once a year unless a regulator or a security incident requires more. If that is not enough to meet a legal obligation you have, we will allow an audit by you or an independent auditor you appoint, on at least 30 days’ notice, during business hours, under confidentiality obligations and at your cost.

8. Deletion and return

You can export your organizations’ data at any time through the accountant package and transaction exports. When you ask us to delete an organization or your account, or when we terminate your account and the 30-day export period in the Terms of Service has passed, we delete the personal information we process for you from our live systems within 30 days, except where the law requires us to keep it, in which case we keep it only for that purpose and for that time. Encrypted backup copies are kept for up to 12 months and then overwritten; we do not restore deleted data from them except to recover the Service after a failure, and if we do, we delete it again.

9. U.S. state privacy laws and the FTC Safeguards Rule

Where the California Consumer Privacy Act or another U.S. state privacy law applies to you, we act as your service provider or processor, we certify that we understand and will comply with the restrictions in section 3, you may take reasonable steps to stop and remedy unauthorised use of personal information, and we will tell you if we can no longer meet those obligations. If you are a financial institution under the Gramm-Leach-Bliley Act, including a tax preparer or accounting firm covered by the FTC Safeguards Rule, this DPA is the written agreement under which we maintain safeguards for the customer information you give us, and sections 4 and 7 describe those safeguards and how you can assess them.

10. General

Our liability under this DPA is subject to the limitations in the Terms of Service. This DPA lasts as long as we process personal information for you. We may update it to reflect changes in law or in the Service; for material changes we will email the address on your account at least 14 days before they take effect, and changes never reduce the protection this DPA gives to personal information. Questions and requests about this DPA go to support@novaluna.ai.