Data Processing Agreement

Data subjects

The Controller's authorised users (employees, accountants); the Controller's customers and vendors whose details are entered into the platform.

Categories of personal data

• Identity data: names, email addresses
• Contact data: postal addresses, phone numbers (where provided)
• Financial data: invoice amounts, payment records, account codes
• Tax data: tax identification numbers (where provided)
• Account credentials: email addresses used for platform access

Instructions

Process personal data only on documented instructions from the Controller, unless required to do so by applicable law. KontraBooks will inform the Controller if any instruction infringes GDPR.

Confidentiality

Ensure that all personnel authorised to process personal data are bound by confidentiality obligations.

Security

Implement and maintain appropriate technical and organisational measures to protect personal data, as described in Annex A of this DPA.

Sub-processors

Not engage a sub-processor without prior general written authorisation from the Controller. The current sub-processor list is published at kontrabooks.com/legal/subprocessors. KontraBooks will give at least 30 days' notice of changes, during which the Controller may raise a reasoned objection.

Data subject rights

Assist the Controller in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection) to the extent technically feasible. Requests will be acknowledged within 72 hours.

Security assistance

Notify the Controller without undue delay (and within 24 hours) upon becoming aware of a personal data breach. Provide all information necessary for the Controller to meet its obligations under GDPR Articles 33 and 34.

Deletion or return

Upon termination of the agreement, at the Controller's choice, delete or return all personal data and delete existing copies, unless retention is required by law. Controllers may export their data within 30 days of account termination.

Audit rights

Make available all information necessary to demonstrate compliance with this DPA. Allow for and contribute to audits conducted by the Controller or a mandated third-party auditor, subject to reasonable notice and confidentiality obligations. KontraBooks may provide security certification reports (such as SOC 2 or equivalent) as an alternative to on-site audits where appropriate.

Encryption in transit

All data transmitted between users and the service is encrypted using TLS 1.2 or higher.

Encryption at rest

All data stored in our database and backups is encrypted at rest.

Access controls

Access to production systems is restricted to authorised personnel only, using multi-factor authentication and the principle of least privilege.

Authentication security

Short-lived access tokens with automatic rotation; httpOnly and Secure cookie flags; brute-force protection with automatic lockout after repeated failed attempts.

Audit logging

All significant data access and modification events are logged with timestamps and user identifiers.

Backups

Regular automated backups with a rolling 30-day retention window. Backups are encrypted.

Vulnerability management

Regular dependency audits and security reviews. Critical vulnerabilities are patched within 30 days of disclosure.

Breach response

A documented incident response plan. The Controller will be notified within 24 hours of a confirmed breach.

Physical security

All infrastructure is hosted on a major cloud provider with ISO 27001 certification. No personal data is stored on physical media under KontraBooks' direct control.