[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"global":3,"entry:legal:dpa":324},{"id":4,"documentId":5,"siteName":6,"organizationSchema":7,"contactEmail":13,"contactPhones":48,"address":49,"currencyRates":50,"createdAt":70,"updatedAt":71,"publishedAt":72,"logoDark":49,"logoLight":49,"nav":73,"footer":257},1,"ded2oyx8g005xuue0dkk17wm","Accountaire",{"url":8,"logo":9,"name":6,"@type":10,"email":13,"sameAs":14,"address":16,"@context":21,"legalName":22,"telephone":23,"areaServed":24,"knowsAbout":36,"description":46,"foundingDate":47},"https:\u002F\u002Faccountaire.com","https:\u002F\u002Faccountaire.com\u002Flogo.png",[11,12],"Organization","AccountingService","hello@accountaire.com",[15],"https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Faccountaire",{"@type":17,"streetAddress":18,"addressCountry":19,"addressLocality":20},"PostalAddress","5 Davis Road, G-8, Shimla Tower","PK","Lahore","https:\u002F\u002Fschema.org","Accountaire (SMC-Private) Limited","+1-925-219-6399",[25,28,30,32,34],{"name":26,"@type":27},"United Kingdom","Country",{"name":29,"@type":27},"United States",{"name":31,"@type":27},"United Arab Emirates",{"name":33,"@type":27},"Canada",{"name":35,"@type":27},"Australia",[37,38,39,40,41,42,43,44,45],"Bookkeeping","Cloud Accounting","VAT","Payroll","Management Accounts","CFO Advisory","Xero","QuickBooks Online","Making Tax Digital","Modern remote accounting for ambitious SMEs. ACCA-qualified team delivering bookkeeping, payroll, tax and CFO advisory across the UK, US, UAE, Canada and Australia.","2022-09-08",[23],null,{"AED":51,"AUD":55,"CAD":59,"GBP":63,"USD":67},{"sym":52,"rate":53,"label":54},"AED ",3.67,"AED",{"sym":56,"rate":57,"label":58},"A$",1.52,"AUD",{"sym":60,"rate":61,"label":62},"C$",1.36,"CAD",{"sym":64,"rate":65,"label":66},"£",0.79,"GBP",{"sym":68,"rate":4,"label":69},"$","USD","2026-06-03T16:16:36.280Z","2026-06-23T19:38:06.501Z","2026-06-23T19:38:05.773Z",{"id":74,"groups":75},31,[76,128,197,238],{"id":77,"title":78,"twoCol":79,"links":80},121,"Services",false,[81,85,88,92,96,100,104,108,112,116,120,124],{"id":82,"label":83,"href":84,"badge":49,"external":79},1949,"Cloud bookkeeping","\u002Fservices\u002Fcloud-bookkeeping",{"id":86,"label":40,"href":87,"badge":49,"external":79},1950,"\u002Fservices\u002Fpayroll",{"id":89,"label":90,"href":91,"badge":49,"external":79},1951,"Tax & VAT","\u002Fservices\u002Ftax-vat",{"id":93,"label":94,"href":95,"badge":49,"external":79},1952,"Management accounts","\u002Fservices\u002Fmanagement-accounts",{"id":97,"label":98,"href":99,"badge":49,"external":79},1953,"CFO-as-a-Service","\u002Fservices\u002Fcfo",{"id":101,"label":102,"href":103,"badge":49,"external":79},1954,"Catch-up bookkeeping","\u002Fservices\u002Fcatch-up",{"id":105,"label":106,"href":107,"badge":49,"external":79},1955,"Company incorporation","\u002Fservices\u002Fincorporation",{"id":109,"label":110,"href":111,"badge":49,"external":79},1956,"Audit & assurance","\u002Fservices\u002Faudit-assurance",{"id":113,"label":114,"href":115,"badge":49,"external":79},1957,"Self-assessment","\u002Fservices\u002Fself-assessment",{"id":117,"label":118,"href":119,"badge":49,"external":79},1958,"Company secretary","\u002Fservices\u002Fcompany-secretary",{"id":121,"label":122,"href":123,"badge":49,"external":79},1959,"Business & risk advisory","\u002Fservices\u002Frisk-advisory",{"id":125,"label":126,"href":127,"badge":49,"external":79},1960,"E-commerce accounting","\u002Fservices\u002Fecommerce",{"id":129,"title":130,"twoCol":131,"links":132},122,"Industries",true,[133,137,141,145,149,153,157,161,165,169,173,177,181,185,189,193],{"id":134,"label":135,"href":136,"badge":49,"external":79},1961,"Sole traders","\u002Findustries\u002Fsole-traders",{"id":138,"label":139,"href":140,"badge":49,"external":79},1962,"Startups","\u002Findustries\u002Fstartups",{"id":142,"label":143,"href":144,"badge":49,"external":79},1963,"Small businesses","\u002Findustries\u002Fsmall-business",{"id":146,"label":147,"href":148,"badge":49,"external":79},1964,"SaaS","\u002Findustries\u002Fsaas",{"id":150,"label":151,"href":152,"badge":49,"external":79},1965,"E-commerce","\u002Findustries\u002Fecommerce",{"id":154,"label":155,"href":156,"badge":49,"external":79},1966,"Amazon sellers","\u002Findustries\u002Famazon",{"id":158,"label":159,"href":160,"badge":49,"external":79},1967,"Shopify brands","\u002Findustries\u002Fshopify",{"id":162,"label":163,"href":164,"badge":49,"external":79},1968,"Non-profits","\u002Findustries\u002Fnon-profits",{"id":166,"label":167,"href":168,"badge":49,"external":79},1969,"Landlords \u002F SPVs","\u002Findustries\u002Flandlords",{"id":170,"label":171,"href":172,"badge":49,"external":79},1970,"Restaurants","\u002Findustries\u002Frestaurants",{"id":174,"label":175,"href":176,"badge":49,"external":79},1971,"Dental clinics","\u002Findustries\u002Fdental",{"id":178,"label":179,"href":180,"badge":49,"external":79},1972,"Doctors & GPs","\u002Findustries\u002Fdoctors",{"id":182,"label":183,"href":184,"badge":49,"external":79},1973,"Lawyers","\u002Findustries\u002Flawyers",{"id":186,"label":187,"href":188,"badge":49,"external":79},1974,"Creatives","\u002Findustries\u002Fcreatives",{"id":190,"label":191,"href":192,"badge":49,"external":79},1975,"Freelancers","\u002Findustries\u002Ffreelancers",{"id":194,"label":195,"href":196,"badge":49,"external":79},1976,"Crypto businesses","\u002Findustries\u002Fcrypto",{"id":198,"title":199,"twoCol":79,"links":200},123,"Software",[201,205,210,214,218,222,226,230,234],{"id":202,"label":43,"href":203,"badge":204,"external":79},1977,"\u002Fsoftware\u002Fxero","Certified",{"id":206,"label":207,"href":208,"badge":209,"external":79},1978,"QuickBooks","\u002Fsoftware\u002Fquickbooks","ProAdvisor",{"id":211,"label":212,"href":213,"badge":49,"external":79},1979,"FreeAgent","\u002Fsoftware\u002Ffreeagent",{"id":215,"label":216,"href":217,"badge":49,"external":79},1980,"Sage","\u002Fsoftware\u002Fsage",{"id":219,"label":220,"href":221,"badge":49,"external":79},1981,"Zoho Books","\u002Fsoftware\u002Fzoho",{"id":223,"label":224,"href":225,"badge":49,"external":79},1982,"MYOB","\u002Fsoftware\u002Fmyob",{"id":227,"label":228,"href":229,"badge":49,"external":79},1983,"Wave","\u002Fsoftware\u002Fwave",{"id":231,"label":232,"href":233,"badge":49,"external":79},1984,"FreshBooks","\u002Fsoftware\u002Ffreshbooks",{"id":235,"label":236,"href":237,"badge":49,"external":79},1985,"Neat","\u002Fsoftware\u002Fneat",{"id":239,"title":240,"twoCol":79,"links":241},124,"Markets",[242,245,248,251,254],{"id":243,"label":26,"href":244,"badge":49,"external":79},1986,"\u002Fmarkets\u002Fuk",{"id":246,"label":29,"href":247,"badge":49,"external":79},1987,"\u002Fmarkets\u002Fus",{"id":249,"label":31,"href":250,"badge":49,"external":79},1988,"\u002Fmarkets\u002Fuae",{"id":252,"label":33,"href":253,"badge":49,"external":79},1989,"\u002Fmarkets\u002Fcanada",{"id":255,"label":35,"href":256,"badge":49,"external":79},1990,"\u002Fmarkets\u002Faustralia",{"id":74,"tagline":258,"marqueeItems":49,"copyright":259,"legalLinks":260,"socialLinks":273,"columns":274},"A modern remote finance team for ambitious businesses across the UK, US, UAE, Canada and Australia.","© Accountaire (SMC-Private) Limited. All rights reserved.",[261,265,269],{"id":262,"label":263,"href":264,"badge":49,"external":79},2006,"Privacy","\u002Flegal\u002Fprivacy",{"id":266,"label":267,"href":268,"badge":49,"external":79},2007,"Terms","\u002Flegal\u002Fterms",{"id":270,"label":271,"href":272,"badge":49,"external":79},2008,"DPA","\u002Flegal\u002Fdpa",[],[275,291,304],{"id":276,"title":78,"links":277},91,[278,280,282,284,286,288],{"id":279,"label":83,"href":84,"badge":49,"external":79},1991,{"id":281,"label":40,"href":87,"badge":49,"external":79},1992,{"id":283,"label":90,"href":91,"badge":49,"external":79},1993,{"id":285,"label":94,"href":95,"badge":49,"external":79},1994,{"id":287,"label":98,"href":99,"badge":49,"external":79},1995,{"id":289,"label":290,"href":103,"badge":49,"external":79},1996,"Catch-up",{"id":292,"title":240,"links":293},92,[294,296,298,300,302],{"id":295,"label":26,"href":244,"badge":49,"external":79},1997,{"id":297,"label":29,"href":247,"badge":49,"external":79},1998,{"id":299,"label":31,"href":250,"badge":49,"external":79},1999,{"id":301,"label":33,"href":253,"badge":49,"external":79},2000,{"id":303,"label":35,"href":256,"badge":49,"external":79},2001,{"id":305,"title":306,"links":307},93,"Company",[308,312,316,320],{"id":309,"label":310,"href":311,"badge":49,"external":79},2002,"About","\u002Fabout",{"id":313,"label":314,"href":315,"badge":49,"external":79},2003,"Pricing","\u002Fpricing",{"id":317,"label":318,"href":319,"badge":49,"external":79},2004,"Blog","\u002Fblog",{"id":321,"label":322,"href":323,"badge":49,"external":79},2005,"Contact","\u002Fcontact",{"id":325,"documentId":326,"title":327,"slug":328,"body":329,"createdAt":330,"updatedAt":331,"publishedAt":332,"seo":333},111,"tihq2jx8mtihgixm94pgmzeu","Data Processing Agreement","dpa","\u003Csection class=\"page-header\"> \u003Cdiv class=\"container\"> \u003Cdiv class=\"crumbs\">\u003Ca href=\"\u002F\">Home\u003C\u002Fa>\u003Cspan>\u002F\u003C\u002Fspan>\u003Cspan>Legal\u003C\u002Fspan>\u003Cspan>\u002F\u003C\u002Fspan>\u003Cspan>Data Processing Agreement\u003C\u002Fspan>\u003C\u002Fdiv> \u003Cspan class=\"eyebrow\">Legal · DPA\u003C\u002Fspan> \u003Ch1 style=\"margin-top:20px;\">Data Processing Agreement\u003C\u002Fh1> \u003Cp class=\"lead\">This Data Processing Agreement sets out Accountaire's commitments as a data processor when we handle personal data on your behalf. It meets the \u003Ca href=\"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Faccountability-and-governance\u002F\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\" rel=\"noopener\" target=\"_blank\">Article 28 UK GDPR requirements for a processor contract\u003C\u002Fa>, is incorporated by reference into every Engagement Letter, and names the sub-processors, security measures and transfer safeguards we rely on.\u003C\u002Fp> \u003C\u002Fdiv> \u003C\u002Fsection> \u003Csection class=\"section\"> \u003Cdiv class=\"container\"> \u003Cdiv class=\"legal-doc\"> \u003Cdiv class=\"doc-meta\">Effective 25 May 2026 · Version 2.0\u003C\u002Fdiv> \u003Cdiv class=\"legal-toc\">\u003Ch3>Contents\u003C\u002Fh3>\u003Col>\u003Cli>\u003Ca href=\"#parties\">1. Parties & status\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#subject-matter\">2. Subject matter & duration\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#instructions\">3. Processing on instructions\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#confidentiality-dpa\">4. Confidentiality\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#security-dpa\">5. Security measures\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#sub-processors\">6. Sub-processors\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#data-subject-rights\">7. Data subject rights\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#incidents\">8. Personal data incidents\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#dpia\">9. DPIAs & prior consultation\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#transfers\">10. International transfers\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#audits\">11. Audits & inspections\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#return-deletion\">12. Return & deletion of data\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#liability-dpa\">13. Liability\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#governing-law-dpa\">14. Governing law\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"#schedules\">15. Schedules\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fdiv> \u003Ch2 id=\"parties\">1. Parties & status\u003C\u002Fh2> \u003Cp>This Data Processing Agreement (\"DPA\") forms part of the Engagement Letter, and is read alongside our \u003Ca href=\"\u002Flegal\u002Fterms\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">standard engagement terms\u003C\u002Fa>, between Accountaire (SMC-Private) Limited (\"Processor\", \"we\", \"us\") and the client identified in that Engagement Letter (\"Controller\", \"you\").\u003C\u002Fp> \u003Cp>Personal data we control in our own right, rather than process for you, is covered by our \u003Ca href=\"\u002Flegal\u002Fprivacy\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">privacy policy\u003C\u002Fa> instead. For the purposes of this DPA, you act as Data Controller and we act as Data Processor in respect of personal data we process to deliver the Services described in the Engagement Letter. Where you are yourself a processor (for example, providing services to your own customers), references in this DPA to \"Controller\" include your role as such.\u003C\u002Fp> \u003Ch2 id=\"subject-matter\">2. Subject matter & duration\u003C\u002Fh2> \u003Cp>The subject matter, duration, nature and purpose of processing, categories of personal data and categories of data subjects are set out in \u003Cstrong>Schedule 1\u003C\u002Fstrong>. Processing continues for the duration of the Engagement Letter, plus any post-termination period reasonably required to return or delete data.\u003C\u002Fp> \u003Ch2 id=\"instructions\">3. Processing on instructions\u003C\u002Fh2> \u003Cp>We process personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by UK, EU or applicable law. Where such legal requirement applies, we will inform you of the requirement before processing, unless that law prohibits informing you on important grounds of public interest.\u003C\u002Fp> \u003Cp>Your instructions are documented in the Engagement Letter and any subsequent written communications (including email). If we believe that an instruction infringes data protection law, we will inform you immediately.\u003C\u002Fp> \u003Ch2 id=\"confidentiality-dpa\">4. Confidentiality\u003C\u002Fh2> \u003Cp>We ensure that all persons authorised to process personal data are under appropriate confidentiality obligations (by employment contract, contractor agreement or equivalent) and have received appropriate training on data protection.\u003C\u002Fp> \u003Ch2 id=\"security-dpa\">5. Security measures\u003C\u002Fh2> \u003Cp>We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including (as applicable):\u003C\u002Fp> \u003Cul> \u003Cli>\u003Cstrong>Pseudonymisation and encryption\u003C\u002Fstrong>: encryption in transit (TLS 1.2+) and at rest within all cloud platforms used.\u003C\u002Fli> \u003Cli>\u003Cstrong>Confidentiality, integrity, availability\u003C\u002Fstrong>: multi-factor authentication enforced, role-based access controls, redundancy across SOC 2 Type II-certified providers.\u003C\u002Fli> \u003Cli>\u003Cstrong>Resilience\u003C\u002Fstrong>: incident response procedures, backup and recovery processes through our cloud providers.\u003C\u002Fli> \u003Cli>\u003Cstrong>Testing & review\u003C\u002Fstrong>: regular review of vendor SOC 2 reports and security certifications; annual internal review of our own controls.\u003C\u002Fli> \u003C\u002Ful> \u003Cp>The detailed measures applicable to your engagement are set out in \u003Cstrong>Schedule 2\u003C\u002Fstrong>.\u003C\u002Fp> \u003Ch2 id=\"sub-processors\">6. Sub-processors\u003C\u002Fh2> \u003Cp>You provide general written authorisation for us to engage sub-processors. Our current sub-processors are listed in \u003Cstrong>Schedule 3\u003C\u002Fstrong>. We will inform you of any intended changes concerning the addition or replacement of sub-processors, giving 30 days' notice. You may object to a sub-processor on reasonable data-protection grounds within that period; if we cannot reasonably accommodate your objection, you may terminate the relevant part of the engagement without penalty.\u003C\u002Fp> \u003Cp>We impose on each sub-processor, by contract, data-protection obligations no less protective than those in this DPA. We remain fully liable to you for sub-processor performance.\u003C\u002Fp> \u003Ch2 id=\"data-subject-rights\">7. Data subject rights\u003C\u002Fh2> \u003Cp>Taking into account the nature of processing, we assist you by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests under Chapter III UK GDPR (access, rectification, erasure, restriction, portability, objection).\u003C\u002Fp> \u003Cp>Where we receive a request directly from a data subject relating to data we process on your behalf, we will not respond directly and will refer them to you, notifying you within 48 business hours.\u003C\u002Fp> \u003Ch2 id=\"incidents\">8. Personal data incidents\u003C\u002Fh2> \u003Cp>We notify you without undue delay (and in any event within 48 hours of becoming aware) of any personal data breach affecting personal data we process on your behalf. The notification will include (insofar as known):\u003C\u002Fp> \u003Cul> \u003Cli>The nature of the breach, categories of data and data subjects affected, and approximate numbers.\u003C\u002Fli> \u003Cli>The likely consequences.\u003C\u002Fli> \u003Cli>The measures taken or proposed to address the breach and mitigate its effects.\u003C\u002Fli> \u003C\u002Ful> \u003Cp>We will assist you in any required notifications to supervisory authorities and data subjects.\u003C\u002Fp> \u003Ch2 id=\"dpia\">9. DPIAs & prior consultation\u003C\u002Fh2> \u003Cp>We provide reasonable assistance with Data Protection Impact Assessments and prior consultations with supervisory authorities under Articles 35 and 36 UK GDPR, taking into account the nature of processing and information available to us.\u003C\u002Fp> \u003Ch2 id=\"transfers\">10. International transfers\u003C\u002Fh2> \u003Cp>Where we transfer personal data outside the UK or EEA, we will: (a) ensure the destination has an adequacy decision; (b) implement Standard Contractual Clauses or equivalent appropriate safeguards under Article 46 UK GDPR; or (c) rely on another lawful transfer mechanism with your prior agreement.\u003C\u002Fp> \u003Cp>Our principal operational location is Pakistan. Where you require data residency in the UK or EEA, we configure cloud platforms accordingly during onboarding.\u003C\u002Fp> \u003Ch2 id=\"audits\">11. Audits & inspections\u003C\u002Fh2> \u003Cp>We make available to you all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you. Audits are limited to once per calendar year (unless a personal-data incident gives reasonable grounds for additional audit), subject to 30 days' written notice, conducted during business hours and minimising disruption.\u003C\u002Fp> \u003Cp>In place of physical audit, you may rely on independent third-party certifications and audit reports of our cloud platform providers (SOC 2 Type II reports) and our own internal review documentation, which we will share on reasonable request under confidentiality.\u003C\u002Fp> \u003Ch2 id=\"return-deletion\">12. Return & deletion of data\u003C\u002Fh2> \u003Cp>At your choice on termination of the engagement, we will return all personal data to you or delete it. Return is the default. Where deletion is requested, we delete personal data within 30 days from the last live operational system and within 90 days from backups.\u003C\u002Fp> \u003Cp>We may retain personal data to the extent required by applicable law (notably tax-record retention requirements). Such retained data continues to be protected under this DPA.\u003C\u002Fp> \u003Ch2 id=\"liability-dpa\">13. Liability\u003C\u002Fh2> \u003Cp>The liability provisions of the underlying Engagement Letter apply. Where Article 82 UK GDPR or equivalent liability provisions apply directly, those statutory provisions govern.\u003C\u002Fp> \u003Ch2 id=\"governing-law-dpa\">14. Governing law\u003C\u002Fh2> \u003Cp>This DPA is governed by the laws of England and Wales. Any dispute is subject to the dispute-resolution provisions of the Engagement Letter.\u003C\u002Fp> \u003Ch2 id=\"schedules\">15. Schedules\u003C\u002Fh2> \u003Ch3>Schedule 1: Details of processing\u003C\u002Fh3> \u003Ctable>\u003Ccaption class=\"sr-only\">Schedule 1: Details of processing\u003C\u002Fcaption> \u003Ctbody>\u003Ctr>\u003Cth>Subject matter\u003C\u002Fth>\u003Ctd>Provision of the accounting, bookkeeping, tax, payroll and advisory services listed in our \u003Ca href=\"\u002Fservices\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">list of accounting and bookkeeping services\u003C\u002Fa> and described in the Engagement Letter.\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Cth>Duration\u003C\u002Fth>\u003Ctd>For the term of the Engagement Letter, plus post-termination return\u002Fdeletion period (up to 90 days).\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Cth>Nature & purpose\u003C\u002Fth>\u003Ctd>Recording financial transactions, preparing returns and reports, communicating with you and authorities, maintaining records as required by law.\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Cth>Categories of data subjects\u003C\u002Fth>\u003Ctd>Your directors, employees, contractors, customers, suppliers and other parties whose data appears in your financial records.\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Cth>Categories of personal data\u003C\u002Fth>\u003Ctd>Identification data (names, addresses, ID numbers), financial data (salaries, payments, tax data), contact data (emails, phone numbers). No special-category data unless specifically agreed.\u003C\u002Ftd>\u003C\u002Ftr> \u003C\u002Ftbody>\u003C\u002Ftable> \u003Ch3>Schedule 2: Security measures\u003C\u002Fh3> \u003Cul> \u003Cli>SOC 2 Type II certified cloud platforms for all production data (Xero, QuickBooks Online, Dext, Karbon, etc.).\u003C\u002Fli> \u003Cli>TLS 1.2+ for data in transit; AES-256 encryption at rest (provided by platform vendors).\u003C\u002Fli> \u003Cli>Multi-factor authentication mandatory on every tool, every team member.\u003C\u002Fli> \u003Cli>Role-based access controls: least-privilege principle.\u003C\u002Fli> \u003Cli>Annual security awareness training for all team members.\u003C\u002Fli> \u003Cli>Documented incident response procedure with 48-hour notification commitment.\u003C\u002Fli> \u003Cli>Professional indemnity and cyber-liability insurance.\u003C\u002Fli> \u003Cli>No client data stored on personal devices or local drives.\u003C\u002Fli> \u003C\u002Ful> \u003Ch3>Schedule 3: Approved sub-processors\u003C\u002Fh3> \u003Ctable>\u003Ccaption class=\"sr-only\">Schedule 3: Approved sub-processors\u003C\u002Fcaption> \u003Cthead>\u003Ctr>\u003Cth>Sub-processor\u003C\u002Fth>\u003Cth>Service\u003C\u002Fth>\u003Cth>Location\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead> \u003Ctbody> \u003Ctr>\u003Ctd>\u003Ca href=\"\u002Fsoftware\u002Fxero\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">Xero Limited\u003C\u002Fa>\u003C\u002Ftd>\u003Ctd>Cloud accounting platform\u003C\u002Ftd>\u003Ctd>UK \u002F EEA \u002F Australia\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>\u003Ca href=\"\u002Fsoftware\u002Fquickbooks\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">Intuit Inc.\u003C\u002Fa>\u003C\u002Ftd>\u003Ctd>QuickBooks Online platform\u003C\u002Ftd>\u003Ctd>US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Dext (Receipt Bank)\u003C\u002Ftd>\u003Ctd>Document capture\u003C\u002Ftd>\u003Ctd>UK \u002F EEA\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Karbon\u003C\u002Ftd>\u003Ctd>Practice management\u003C\u002Ftd>\u003Ctd>US (AWS hosting)\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Fathom\u003C\u002Ftd>\u003Ctd>Reporting & analytics\u003C\u002Ftd>\u003Ctd>Australia \u002F US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Slack Technologies\u003C\u002Ftd>\u003Ctd>Client communication\u003C\u002Ftd>\u003Ctd>US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Zoom Video Communications\u003C\u002Ftd>\u003Ctd>Video calls\u003C\u002Ftd>\u003Ctd>US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Google (Workspace)\u003C\u002Ftd>\u003Ctd>Email & document storage\u003C\u002Ftd>\u003Ctd>EU \u002F US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>DocuSign\u003C\u002Ftd>\u003Ctd>Engagement letter signing\u003C\u002Ftd>\u003Ctd>US\u003C\u002Ftd>\u003C\u002Ftr> \u003Ctr>\u003Ctd>Wise & Stripe\u003C\u002Ftd>\u003Ctd>Payment processing\u003C\u002Ftd>\u003Ctd>UK \u002F US \u002F EU\u003C\u002Ftd>\u003C\u002Ftr> \u003C\u002Ftbody> \u003C\u002Ftable> \u003Cp>The full, current list (including any specific regional configurations) is maintained internally and made available on request.\u003C\u002Fp> \u003Ch2 id=\"contact-us\">Questions about this data processing agreement\u003C\u002Fh2> \u003Cp>Questions about this document should be directed to the addresses below, or raised through our \u003Ca href=\"\u002Fcontact\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">contact page\u003C\u002Fa>:\u003C\u002Fp> \u003Cp>\u003Cstrong>Accountaire (SMC-Private) Limited\u003C\u002Fstrong>\u003Cbr> Reg. 0210374\u003Cbr> Email: \u003Ca href=\"mailto:legal@accountaire.com\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">legal@accountaire.com\u003C\u002Fa>\u003Cbr> General enquiries: \u003Ca href=\"mailto:hello@accountaire.com\" style=\"color:var(--ink);text-decoration:underline;text-underline-offset:3px;\">hello@accountaire.com\u003C\u002Fa>\u003C\u002Fp> \u003C\u002Fdiv> \u003C\u002Fdiv> \u003C\u002Fsection>","2026-06-01T17:04:35.204Z","2026-09-11T00:59:04.735Z","2026-09-11T00:59:04.793Z",{"id":334,"metaTitle":327,"metaDescription":335,"keywords":49,"canonicalURL":336,"ogType":337,"ogLocale":338,"twitterCard":339,"noindex":79,"structuredData":49,"ogImage":49},4484,"Data Processing Agreement governing personal-data processing by Accountaire as data processor on behalf of clients. UK GDPR Article 28 compliant.","https:\u002F\u002Faccountaire.com\u002Flegal\u002Fdpa","website","en_GB","summary_large_image"]