Data processing agreement

1. About this agreement

This data processing agreement (“DPA”) is between the accounting practice using Octotax for Accountants (“your firm”, “you”) and Jacob Norton, a sole trader trading as Octotax (“Octotax”, “we”, “us”). It forms part of our terms of service for firms and is accepted with them when your firm creates a practice. It's written to meet Article 28 of the UK GDPR. If you'd like a copy signed by us for your files, email [email protected].

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR. “Data protection law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time.

2. Our roles

For the personal data your firm, your staff and your clients put into Octotax for Accountants (including the client area your clients use), your firm is the controller and Octotax is the processor.

This DPA doesn't cover the details we hold to run your firm's account (your users' names and email addresses, sign-in and security records, support messages and billing details), or the free Octotax app for business owners. For those, Octotax is the controller, as explained in our privacy notice for firms and their clients and our app privacy notice.

3. Linked accounts and the Octotax app

Your clients can link the free Octotax app to your firm. They sign in to the app and to your client area with the same email address. Linking is always the client's choice, and either side can end it at any time. This is how the roles work:

• Your client records stay yours. Your firm remains the controller of everything in your client records, and we remain your processor for it. That includes the work, dates, tax to pay, documents and messages you show the client in the client area or in their app. Showing them there is processing on your instructions.
• The app's own data is ours. Octotax is the controller of the data a person keeps in their own app: their businesses, the deadlines the app works out, what they tick off, their reminders and their tax pot. When a client links, we add the business your firm holds (its Companies House details and which of your services apply) to their app so their deadlines line up. From then on that copy is part of their app.
• The client chooses what you see. The client decides whether your firm can see their app deadlines, their Companies House alerts and, if they choose, their tax pot. We show you those at the client's request, as an independent controller sharing data with your firm. You see them live while the link is active; we don't copy them into your records. If you record something you've learned from them in your own records, your firm is the controller of that record.
• Unlinking. When either side unlinks, your firm immediately stops seeing anything from the client's app, and your work stops showing in it. Your client records aren't changed, and the client keeps their own app and its data. A record that the link existed, and who ended it, stays in the client's audit log.
• Requests to link. A person already using the app can ask to link with your firm. We pass you their name, email address and any note they add, at their request. If you accept and create or match a client record, that record is yours as controller like any other.
• Leads. When someone asks to contact your firm through the Octotax app, we pass you the details they choose to send, with their consent. Octotax and your firm are separate controllers: we're responsible for collecting the enquiry, and your firm for what it does with it once received.
• Feedback and your listing. Ratings your clients give after a job are part of your client records. If a client agrees and an owner chooses to publish a rating on your Octotax listing, we show it there on your instructions, with the client's first name and town only.

You agree to use what a client shares from their app only for your work for that client, and not to make linking a condition of providing your services.

4. Details of the processing

Subject matter

Providing Octotax for Accountants, the practice management service described in the terms, to your firm.

Duration

For as long as your firm uses the service, and afterwards until the data is deleted or returned under section 13.

Nature and purpose

Storing, organising, displaying, searching, updating, sending (by email, web push notification and through the client area), encrypting, backing up and deleting personal data, and working out deadlines, reminders and suggestions from it, so that your firm can manage its clients, jobs, deadlines, engagement letters, AML checks, documents, Self Assessment, bookkeeping, VAT, payroll, Making Tax Digital, time, billing and communications, and so that your clients can use the client area.

Types of personal data

• Contact details: names, email addresses, phone numbers and postal addresses.
• Identifiers: National Insurance numbers, Unique Taxpayer References, VAT numbers, PAYE references, dates of birth, and Companies House authentication and personal codes.
• Company and officer information, including public data from Companies House and identity verification status.
• Tax and financial information: Self Assessment questionnaire answers, income and tax details, tax to pay and payment references, bank details, fees, quotes and billing records, and VAT, payroll and Making Tax Digital information.
• Anti-money laundering information: risk assessments, identity and address checks, ID expiry dates, politically exposed person and sanctions results, monitoring notes and evidence documents (such as copies of passports, driving licences and utility bills).
• Documents and records uploaded by your firm or your clients, such as accounts, receipts, payslips, bank statements and signed engagement letters, and electronic signatures (typed name, time and IP address).
• What clients tell you through the client area: life events, requested changes to their details, feedback ratings and comments, and anything they enter in the client tools you switch on (such as a mileage log or VAT turnover).
• Communications: messages, emails and notifications sent through the service, and when they were delivered, opened or clicked.
• Leads and proposals: enquirers' contact details, notes and the services they asked about.
• Your staff's activity in the service: timesheet entries, task and job assignments and audit log entries.
• Technical data: IP addresses, browser details, sign-in records and push notification subscriptions for your staff and your clients.

Special category and criminal offence data

The service isn't designed to collect special category data, but some will reach it as a normal part of a firm's work. Copies of passports and photo ID can reveal racial or ethnic origin; AML checks can include politically exposed person, sanctions and adverse media results, which may count as criminal offence data; and clients sometimes mention health or similar matters in notes, messages or tax answers.

As controller, your firm is responsible for having a lawful basis and an appropriate condition under the Data Protection Act 2018 for that data (for AML records, usually the conditions for meeting regulatory requirements and preventing fraud and other unlawful acts), and for keeping the appropriate policy document where the law requires one. We protect it as described in section 7: AML answers and documents are encrypted at rest, and staff access to the AML register can be switched off in your permissions.

Data subjects

• Your firm's clients and prospective clients who are individuals, such as sole traders, landlords, partners and company directors.
• Officers, shareholders, persons with significant control, contacts and other people connected with your clients, including any second person recorded on a client's record.
• Your clients' employees, where their details appear in payroll documents or records. Your client, as their employer, is responsible for telling them that their details are shared with your firm; your firm is responsible for its own use of them.
• People who enquire about your firm's services (leads).
• Your firm's owners and staff who use the service.

5. Following your instructions

We process the personal data only on your documented instructions. Your instructions are these terms and this DPA, and the choices you and your users make in the service (for example, adding a client, sending an email, publishing tax to pay or deleting a document). If UK law requires us to process the data in some other way, we'll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you straight away.

6. Confidentiality

Only people who need access to provide or support the service can access the personal data, and each of them is bound by a duty of confidentiality. At present that is only the operator of Octotax. We look at your firm's data only when we need to, for example to fix a problem you've reported, to carry out an import you've asked us to do, or to keep the service secure.

7. Security

We take appropriate technical and organisational measures to protect the personal data, as Article 32 of the UK GDPR requires, taking into account the nature of the data and the risks. The measures in place today are listed in Annex 2. We may change them over time, but we won't reduce the overall level of protection.

8. Sub-processors

You give us general authorisation to use sub-processors. The current ones are listed in Annex 3 and on our sub-processors page.

• Before we add or replace a sub-processor that will process your clients' personal data, we'll email your practice owner at least 30 days in advance and update the sub-processors page.
• If you object on reasonable data protection grounds within that time, we'll work with you in good faith to resolve it. If we can't, you can end the agreement before the change takes effect, and we'll refund any fees you've paid for the period after it.
• Each sub-processor is bound by a written contract with data protection obligations that give at least the same protection as this DPA, as far as they apply to the service it provides.
• We remain responsible to you for how our sub-processors process the personal data.

9. Helping you with data subjects' rights

Most requests from your clients (to see, correct or delete their data) you can handle yourself in the service, including with the client export and the data export in Settings. Where you can't, we'll help you respond, as far as reasonably possible, using appropriate technical and organisational measures. If we receive a request directly from one of your clients or other data subjects about your firm's data, we'll pass it to you within five working days and won't respond to it ourselves, except to tell them we've passed it on. A request about the person's own Octotax app data we handle ourselves, as its controller.

10. Personal data breaches

If we become aware of a personal data breach affecting your firm's data, we'll tell your practice owner by email without undue delay, and in any case within 48 hours of becoming aware of it. We'll give you the information you need to meet your own obligations, as it becomes available, including:

• what happened, and the categories and approximate number of people and records affected;
• the likely consequences;
• what we've done, or plan to do, to deal with the breach and reduce its effects; and
• who to contact for more information.

If we don't have all the details within 48 hours, we'll tell you what we know and follow up as we learn more. As controller, your firm decides whether to notify the Information Commissioner's Office (normally within 72 hours of becoming aware) and the people affected. We'll help you with that, and we won't notify them on your behalf unless you ask us to or the law requires it. We keep a record of every breach, including ones that don't need reporting.

11. Helping you with your other obligations

Taking into account the nature of the processing and the information available to us, we'll give you reasonable help with security, data protection impact assessments and any prior consultation with the Information Commissioner's Office that relates to your use of the service.

12. International transfers

The service and its database are hosted in the United Kingdom. Some sub-processors may process personal data outside the UK, as shown in Annex 3:

• Cloudflare runs a global network, so data in transit may pass through its data centres in other countries, including the US. Cloudflare is certified under the UK extension to the EU-US Data Privacy Framework.
• Google stores our backups on its global infrastructure. The backups are encrypted before upload and Google doesn't have the key. Google is certified under the UK extension to the Data Privacy Framework.
• Resend sends our email from its European Union region. Resend is a US company, and its staff may access data from the US to provide support; that access is covered by the transfer safeguards in Resend's data processing agreement.
• Stripe may process your firm's billing details in the UK, the EU and the US, under the UK extension to the Data Privacy Framework and its own data processing agreement. It doesn't receive your clients' data.

So every transfer outside the UK relies on one of these: UK adequacy regulations (for the EU and EEA, and for US organisations certified under the UK extension to the EU-US Data Privacy Framework), or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses issued by the Information Commissioner's Office. You can ask us for a copy of the safeguard used for any sub-processor. We'll tell you if a sub-processor loses its certification, and what we're relying on instead.

13. Deleting or returning data

At any time, and when your firm stops using the service, an owner can download a full export of your firm's data (clients, documents and history) from Settings, then Your data. When an owner closes the account, your data is kept for a 30-day grace period, so you can change your mind or take an export, then deleted from the service. Deleted data drops out of our encrypted backups as they're replaced, within a further 30 days. We'll keep data for longer only if UK law requires us to, and only for as long as it requires. If you ask, we'll confirm in writing when deletion is complete.

While you use the service, you decide how long to keep a former client's data. An owner sets a retention period (at least five years after the client leaves, the minimum the Money Laundering Regulations 2017 set for due diligence records) and, once it has passed, can permanently erase that client and everything linked to it, including stored files, from Data retention. Erased data drops out of our encrypted backups within 30 days.

14. Audits and information

We'll make available the information you reasonably need to show that we're meeting our obligations under Article 28. We do this in stages, which keeps audits proportionate for a business of our size:

• First, information. We'll answer your written questions and your security or due diligence questionnaire, normally within 20 working days, and once a year without charge.
• Then an audit, where it's needed. If those answers don't reasonably show that we're meeting this DPA, or after a personal data breach affecting your firm's data, or where a regulator requires it, we'll allow and contribute to an audit by your firm or an independent auditor you appoint who is bound by confidentiality. We'll offer a remote audit first.
• How. On at least 30 days' notice (or 7 days after a breach), during UK working hours, no more than once in any 12 months (unless there has been a breach or a regulator requires it), and at your cost. An audit must not give access to other firms' data or put the security of the service at risk.

15. Your firm's obligations

• Make sure you have a lawful basis for the personal data you put into the service, and that your instructions to us comply with data protection law.
• Tell your clients how you use their data, including that you use service providers like us and, if you use them, the client area and linked accounts. Our privacy notice for firms and their clients can help.
• Self Assessment questionnaire emails record when they're opened and when their link is clicked, using a small image and a tracked link. Your firm sends those emails, so under the Privacy and Electronic Communications Regulations you're responsible for telling your clients about this tracking (for example in your privacy notice or engagement letter) and for deciding whether it's appropriate.
• Use the service's settings appropriately, for example removing staff who leave, requiring two-factor sign-in and limiting staff access to the modules they need.
• Tell us without undue delay if you become aware of a breach involving the service.

16. Liability

This DPA has its own liability cap, separate from the general cap in the terms. Each party's total liability for claims arising from a breach of this DPA or of data protection law in connection with the service is limited to the greater of £5,000 and twice the fees your firm paid or owed us in the 12 months before the event giving rise to the claim. This is in addition to the general cap in section 14 of the terms of service for firms, and the other parts of that section (including what we're never liable for) apply to this DPA too. Nothing limits liability that the law doesn't allow to be limited, or either party's liability to the other for fines a regulator imposes because of that party's own breach.

17. How long this agreement lasts, and the law

This DPA lasts as long as we process personal data for your firm, including during the deletion period in section 13. If the terms are transferred under their section 16, this DPA transfers with them. It's governed by the law of England and Wales.

Questions about this agreement: [email protected].

Annex 1: Parties

• Controller: the accounting practice named on the Octotax for Accountants account, contacted through its practice owner's email address.
• Processor: Jacob Norton, a sole trader trading as Octotax, United Kingdom. Contact: [email protected].

The details of the processing are in section 4.

Annex 2: Security measures

These are the measures in place today. Planned improvements are listed on our security page.

• Hosted in the UK. The service and its database run on equipment Octotax operates in the United Kingdom.
• Network protection. Traffic to Octotax passes through Cloudflare, which filters out attacks and abusive traffic before it reaches our equipment.
• Encrypted in transit. Every connection to the app and the client portal uses HTTPS (TLS).
• Sensitive fields encrypted at rest. National Insurance numbers, dates of birth, Companies House authentication and personal codes, AML risk assessment answers, Self Assessment questionnaire answers and saved passwords (shared resources and your mail server password) are encrypted in the database with authenticated encryption.
• Documents encrypted at rest. Files uploaded by your firm and by your clients are encrypted when stored. The only exception is the logo you upload for white-label branding, which is public.
• Encrypted off-site backups. The database is backed up every night and backups are kept for 30 days. Each backup is encrypted on our equipment before it's copied to Google Drive, so Google can't read it.
• Each firm's data kept separate. Every record belongs to one firm, and every request is limited to the signed-in firm's data.
• Role-based access. Owners, staff and clients have different access. Owners choose which modules staff can use, and WIP and billing figures are owner-only unless an owner allows them. Clients see only their own client area, and firms see nothing from a client's Octotax app unless the client chooses to share it.
• Sign-in protection. Passwords are stored only as salted hashes. Emailed sign-in codes work once and expire after 15 minutes. Sign-in attempts are rate-limited. Invitation links, one-time links and portal sessions are stored only as one-way hashes.
• Two-factor sign-in. Owners and staff can protect their sign-in with an authenticator app code and recovery codes. Owners can require it across the firm, and it's required for Octotax administrators. Staff can sign out of every other device from Your account.
• Full export and account closure. Owners can download a full export of the firm's data (clients, documents and history) at any time, and close the account. Data is deleted 30 days after closure, and drops out of backups within a further 30 days.
• Audit log. Changes to client records and actions in the client portal are recorded with who did what and when, on each client's Audit log tab.
• Limited access at Octotax. Only the operator, Jacob Norton, has administrative access to the servers, database and backups.

Annex 3: Sub-processors

• Cloudflare, Inc. (Global network, including the US). Network and security service in front of Octotax: protection from attacks, secure connections (TLS), DNS, and forwarding of email sent to octotax.co.uk addresses. Safeguard: UK extension to the EU-US Data Privacy Framework (Cloudflare is certified), with the UK Addendum to the EU standard contractual clauses in its data processing terms as a fallback.
• Google LLC (Google Drive) (Google's global infrastructure). Off-site storage of nightly database backups. Safeguard: UK extension to the EU-US Data Privacy Framework (Google is certified). The files are encrypted before they leave the UK.
• Resend (European Union, with support access from the US). Delivering email sent by the platform: sign-in codes, invitations and notifications, plus email to your clients when you haven't connected your own mail server. Safeguard: The international transfer safeguards in Resend's data processing agreement (the EU standard contractual clauses with the UK Addendum, or the UK extension to the Data Privacy Framework where Resend is certified).
• Stripe (UK, EU and US). Taking subscription payments by card or Bacs Direct Debit. Safeguard: UK extension to the EU-US Data Privacy Framework (Stripe is certified), with the standard contractual clauses in Stripe's data processing agreement.

The current list, with the data each one handles, is on our sub-processors page.