Data Processing Agreement
1. Parties + scope
This DPA is between Finacra Technologies (“Processor”) and the Customer (“Controller”) whose account is provisioned in Finacra and on whose behalf personal data is processed. It governs every processing operation Finacra performs on Controller's personal data while the Terms of Service are in force.
Where Controller is itself a processor for an end-customer (e.g. a CA firm processing a client's data), Finacra acts as a sub-processor and this DPA flows down accordingly.
2. Subject-matter + nature + duration + purpose
- Subject-matter — the personal data Controller submits to Finacra (account identity, company profile, compliance facts, documents, integration data; see Privacy §2).
- Nature — storage, structuring, retrieval, analysis (including LLM-assisted), transmission to sub-processors as listed at /sub-processors, deletion on request.
- Duration — for the term of the Terms of Service plus the deletion grace period (30 days) plus the statutory-retention window applicable to records (typically 7 years for tax-relevant data).
- Purpose — to provide the Finacra service and discharge legal obligations.
- Categories of data subjects — Controller's authorised users; Controller's directors, employees, contractors, vendors, customers (to the extent identifiable from documents / integration data).
- Categories of personal data — see Privacy §2.
- Special categories — Finacra is not designed to process special-category data. If a document upload incidentally contains it (e.g. health-insurance forms with disease codes), Finacra processes only the minimum needed and applies the same safeguards.
3. Processor obligations (GDPR Art. 28(3))
Finacra will:
- Process personal data only on documented instructions from Controller, including transfers to third countries, unless required by law (in which case Finacra informs Controller first, unless the law forbids it).
- Ensure persons authorised to process personal data have committed to confidentiality (every Finacra employment contract carries the obligation).
- Take all measures required pursuant to Art. 32 (Security of processing) — see /security.
- Engage sub-processors only on the terms in §6 below.
- Assist Controller, taking into account the nature of processing, to respond to data-subject rights requests (Chapter III) — see Privacy §5.
- Assist Controller in complying with Art. 32–36 (security, breach notification, DPIA) and equivalent DPDP / PDPL / UAE law obligations.
- On termination, delete or return all personal data to Controller, unless required by law to retain.
- Make available to Controller all information necessary to demonstrate compliance with Art. 28; allow audits per §8 below.
4. Security measures (Art. 32)
Detailed technical + organisational measures are documented at /security. Summary: TLS 1.3, AES-256 encryption at rest, AES-256-GCM application-layer encryption for secrets, RBAC, audit logging, daily backups, breach notification within 72 hours of awareness.
5. Breach notification
On becoming aware of a personal-data breach affecting Controller's data, Finacra notifies Controller within 72 hours(the strictest of GDPR Art. 33 + DPDP draft Rule 7), including:
- Nature of the breach, categories + approximate number of data subjects + records concerned.
- Likely consequences.
- Measures taken or proposed to address it, including measures to mitigate possible adverse effects.
- Name + contact of Finacra's DPO: ibrahim@finacra.com.
6. Sub-processors (Art. 28(2) + (4))
Controller grants Finacra general authorisation to engage the sub-processors listed at /sub-processors. For each sub-processor, Finacra has in place a written contract imposing data-protection obligations equivalent to those in this DPA.
For new sub-processors, Finacra gives 30 days' prior noticevia email + a banner on the sub-processors page. If Controller objects in good faith on data-protection grounds, the parties will discuss in good faith; if no resolution within 30 days, Controller may terminate the affected service portion.
7. International transfers (Chapter V + DPDP Sec 16)
To the extent Finacra transfers personal data outside the country where Controller is established, the transfer is covered by:
- EU/EEA + UK transfers — the 2021 Standard Contractual Clauses (module 2 controller-to-processor; module 3 processor-to-processor) and, for UK transfers, the UK International Data Transfer Addendum.
- DPDP transfers — limited to jurisdictions not on the negative list under DPDP Sec 16; technical safeguards documented in /security.
- PDPL transfers — Article 29 KSA cross-border framework; in-region deployment available on request.
- UAE transfers — Article 22 of Federal Decree-Law 45/2021.
8. Audits + inspections (Art. 28(3)(h))
Controller may audit Finacra's compliance with this DPA once per year on 30 days' written notice, or more frequently in response to a substantiated breach concern. Audits are conducted during business hours, do not unreasonably interfere with Finacra's operations, and respect Finacra's confidentiality obligations to other customers. SOC 2 Type 2 / ISO 27001 reports (when issued) satisfy this obligation in lieu of an on-site audit, at Controller's discretion.
9. Assistance with data-subject rights
Finacra provides self-service data export at /me/data-export and account deletion at /me/delete-account. For controller-side requests Finacra cannot satisfy via self-service (e.g. an end-customer of a CA-firm Controller asks the Controller for portability of data held in Finacra), Finacra will assist within 10 business days of a written request.
10. Return + deletion on termination
Within 30 days of termination of the Terms of Service, Finacra returns or deletes all personal data, at Controller's choice. Backups containing the personal data are deleted at their next-scheduled rotation (no more than 35 days). Records subject to statutory retention (e.g. tax-records 7-year window) are retained until that obligation expires, then deleted.
11. Liability
Each party's liability under this DPA is governed by the limitation-of-liability clause in the Terms of Service. Nothing in this DPA limits a party's liability where applicable law prohibits such limitation (e.g. for GDPR fines apportioned among joint controllers / processors).
12. Order of precedence
In the event of conflict between this DPA and the Terms of Service, this DPA prevails on data-protection matters. In the event of conflict between this DPA and Standard Contractual Clauses incorporated by reference, the SCCs prevail.
13. Governing law
Governed by the law specified in the Terms of Service. For EU/EEA data subjects, mandatory law of the country of habitual residence of the data subject also applies as required by Art. 79 GDPR.
14. Contact
DPO: ibrahim@finacra.com
Legal: legal@finacra.co
Security incidents: ibrahim@finacra.com