Data Processing Addendum

1. Parties, scope and precedence

This Data Processing Addendum (“DPA”) is between the customer that accepted the ExpenseCatcher Terms of Service (“Customer”) and AffZero LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States (“Processor”). It applies to personal data contained in emails and documents that Customer sends to the Service, and the data extracted from them (“Customer Personal Data”), where Customer is a controller and Processor processes on its behalf. Terms such as controller, processor, personal data and data subject have the meaning given in the GDPR and UK GDPR; “service provider” and “business” have the meaning given in the CCPA. If this DPA conflicts with the Terms on data protection, this DPA prevails.

2. Instructions

Processor processes Customer Personal Data only on Customer’s documented instructions, which are these Terms, this DPA and the catcher configuration Customer sets in the Service, unless the law requires otherwise — in which case Processor will tell Customer first unless the law forbids it. Processor will tell Customer if it believes an instruction breaks data protection law. Customer is responsible for having a lawful basis for the processing and for the instructions it gives.

3. Confidentiality

Everyone Processor authorises to process Customer Personal Data is bound by confidentiality obligations.

4. Security

Processor maintains the technical and organisational measures described on the Security, data & AI page (Annex II), including encryption in transit and at rest, application-level encryption of stored files and Google credentials, per-user access controls, restricted production access and automatic deletion of stored originals after 30 days and of emails held over a plan limit after 30 days. Processor may update these measures if the overall level of protection does not decrease.

5. Sub-processors

Customer generally authorises Processor to use the sub-processors listed in Annex III. Processor imposes data protection terms on each that are at least as protective as this DPA and remains responsible for their performance. Processor will give at least 30 days’ notice of a new sub-processor by email or by updating this page; Customer may object on reasonable data protection grounds, and if the parties can’t resolve it, Customer may terminate the affected Service and receive a refund of any prepaid fees for the remaining period.

6. Assistance

Taking into account the nature of the processing, Processor will help Customer respond to data subject requests (the Service lets Customer view, correct, export and delete data directly), and with security, breach notification, data protection impact assessments and prior consultations, to the extent required by law.

7. Personal data breaches

Processor will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations, and will take reasonable steps to contain it.

8. Deletion and return

Customer can export its data at any time from Settings. When Customer deletes its account, or the Terms end, Processor deletes Customer Personal Data as described in the Privacy Policy, with backups rolling over within 30 days, unless the law requires it to be kept. Files in Customer’s own Google Drive are not affected.

9. Audits

Processor will make available the information needed to show compliance with this DPA. If that is not enough, Customer may audit Processor, at Customer’s cost, no more than once a year, with 30 days’ written notice, during business hours and under confidentiality — unless a regulator requires otherwise or after a personal data breach.

10. International transfers

Where Customer Personal Data is transferred from the EEA to Processor in the United States, the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference, with Customer as data exporter and Processor as data importer. For the Clauses: the optional docking clause in Clause 7 applies; Clause 9 option 2 (general authorisation, with notice as in section 5) applies; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by the law and courts of Ireland; and Annexes I–III are as set out below. For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies, and for Switzerland the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

11. CCPA service-provider terms

For personal information covered by the CCPA, Processor acts as a service provider and will not: sell or share it; retain, use or disclose it for any purpose other than providing the Service, or outside the direct business relationship with Customer; or combine it with personal information from other sources except as the CCPA allows. Processor will comply with the CCPA, give the same level of privacy protection the CCPA requires, notify Customer if it can no longer meet these obligations, and let Customer take reasonable steps to stop unauthorised use.

12. Term and liability

This DPA lasts as long as Processor processes Customer Personal Data. Each party’s liability under it is subject to the limitations in the Terms, except where the law or the Standard Contractual Clauses do not allow that.

Annex I — Details of processing

Annex II — Technical and organisational measures

As described on the Security, data & AI page: encryption in transit (TLS) and at rest (AES-256); application-level AES-256-GCM encryption of stored files and Google tokens with keys held outside the database; row-level security; no direct database writes from browsers; least-privilege Google access (drive.file); signed inbound webhooks; outbound webhook restrictions; automatic retention enforcement; restricted production access; incident response and notification.

Annex III — Sub-processors