Data processing agreement
This document forms part of our terms of service.
0. Who we are
A1 Books ("A1 Books", "we", "us"). The legal entity that provides the service will be named here once its registration is complete. Contact: [email protected].
1. What this covers
This agreement applies where we process personal data on your behalf in the course of providing the service — for example the names, contact details and payment details of your employees, customers and suppliers that appear in your books. For that data you are the controller and we are the processor. For data about your own account and the people who use it, we are the controller and our privacy notice explains what we do.
2. Our instructions
We process your personal data only on your documented instructions, which are these terms, your order form and any further written instruction you give us. We will tell you if we believe an instruction breaches data protection law. If the law requires us to process your data for another reason, we will tell you first unless the law forbids it.
3. Subject matter, duration, nature and purpose
| Subject matter | Bookkeeping services and accounting software. |
|---|---|
| Duration | For as long as your subscription lasts, plus the retention periods in section 8. |
| Nature and purpose | Recording, storing, organising, reconciling and reporting on your financial records, and supporting you in using the service. |
| Types of personal data | Names, business and personal contact details, job titles, bank and payment details, payroll and salary information, invoice and transaction details, and anything else you choose to put into your books. |
| Categories of data subject | Your employees, contractors, customers, suppliers, directors and beneficial owners. |
| Special category data | We do not ask for it. If you put it into the service, you remain responsible for having a lawful basis to do so. |
4. Confidentiality
Everyone we allow to process your personal data is bound by a duty of confidence, is trained on handling it, and may only access what they need for their work.
5. Security
We put in place technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access control and authentication, logging of access, separation of client data, regular backups, and a documented process for responding to incidents. We review these measures regularly and may improve them, but we will not reduce the overall level of protection. You can ask us for a current summary at any time.
6. Subprocessors
You give us general authorisation to use subprocessors. The current list is:
| Subprocessor | What it does | Where it processes data |
|---|---|---|
| Cloudflare, Inc. | Platform hosting, database, document storage and backups | European Union |
| Resend, Inc. | Account and service emails (sign-up, log-in, invitations, invoices) | European Union (sending region); company in the United States |
| Zoho Corporation (Zoho Mail) | Business mailboxes for support and replies | European Union (EU data centre) |
| Google LLC (Google Meet, on a paid Google Workspace account) | Video calls for demos, onboarding and support | Worldwide, on Google's own network (no fixed region); transfers under section 7 (EU standard contractual clauses or the EU-US Data Privacy Framework) |
We do not take payments yet. Before we do, we will add our payment provider to this list, with the notice described below.
We impose the same data protection obligations on each subprocessor, and we remain responsible to you for what they do. We will give you at least 30 days' notice by email before adding or replacing a subprocessor. If you reasonably object on data protection grounds within that period, we will work with you to find a solution; if we cannot, you may end the affected part of the service and we will refund the unused part of any fee you have paid in advance.
6A. Tax partners
If you order our filing service, you instruct us, in the filing authority you sign, to share your records and year-end figures with the independent tax professional named in it (the "Tax Partner"). The Tax Partner is not our subprocessor: it receives the data as an independent controller, under its own professional duties, and uses it only for your return. We give you its name before you order the service. The 30-day notice in section 6 does not apply to Tax Partners, because you choose to use one for each return. For clients in the United States, the Tax Partner obtains your consent under Internal Revenue Code §7216 before it uses or discloses your tax return information.
7. International transfers
Where we transfer personal data outside the United Kingdom or the European Economic Area, we do so under an adequacy decision, or under the UK International Data Transfer Agreement or Addendum, or under the EU standard contractual clauses, together with any additional measures the transfer requires. Where the data comes from another country, including the UAE, Saudi Arabia, Qatar, Lebanon or Canada, we use the transfer safeguards that country's law requires, as listed in section 6 of our privacy notice. Details of where each subprocessor processes data are in the table above.
8. Your rights, and helping you
- Data subject requests. If someone contacts us directly about data in your books, we will not respond to the substance; we will pass the request to you without undue delay. We will help you respond, using the tools in the service and, where those are not enough, reasonable assistance at no extra charge.
- Breaches. If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within 48 hours, and give you the information you need to meet your own notification duties.
- Impact assessments. We will give you reasonable help with data protection impact assessments and prior consultations that relate to our processing.
- Deletion and return. When your subscription ends, section 10 of the terms of service applies: read-only access for 90 days, a full export, then deletion within 30 days and removal from backups within a further 35 days, except what the law requires us to keep. You may ask us to delete sooner.
- Audit. We will give you the information you reasonably need to show we are meeting this agreement. Once in any 12-month period, or after a breach affecting your data, you may audit us, or appoint an independent auditor to do so, on 30 days' notice, during business hours and without disrupting the service. You cover the cost unless the audit finds a material failure on our side.
9. Changes
We may update this agreement, but not in a way that reduces the protection it gives you without your agreement. We will tell you about material changes by email at least 30 days before they apply.
10. Order of priority
If this agreement and the terms of service conflict on the handling of personal data, this agreement wins.