Data Processing Agreement

Capitalised terms not defined here have the meanings given in the GDPR. For convenience:

• “Personal Data” means any information relating to an identified or identifiable natural person submitted to, stored in, or generated by the Service on behalf of the Controller.
• “Processing” has the meaning in GDPR Article 4(2) and includes collection, storage, use, transmission, and deletion.
• “Sub-processor” means any third party engaged by the Processor to Process Personal Data on behalf of the Controller, as listed in Annex III.
• “Standard Contractual Clauses” or “SCCs” means the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries.
• “UK IDTA”means the United Kingdom International Data Transfer Agreement issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018.

The Processor will:

1. Process Personal Data only on the Controller's documented instructions, including with regard to transfers to a third country, unless required to do so by EU or Member State law to which the Processor is subject. The Processor will inform the Controller of any such legal requirement before Processing unless the law prohibits such information on important grounds of public interest.
2. Ensure that persons authorised to Process Personal Data have committed themselves to confidentiality.
3. Implement the technical and organisational measures described in Annex II.
4. Engage Sub-processors only in accordance with Section 5.
5. Assist the Controller, taking into account the nature of the Processing, by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising data subject rights (Section 7) and in ensuring compliance with the Controller's obligations under GDPR Articles 32 to 36 (Section 6 and Section 8).
6. At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Service, and delete existing copies unless EU or Member State law requires storage of the Personal Data (Section 9).
7. Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28 and allow for and contribute to audits in accordance with Section 10.

Access to Personal Data is restricted to Processor personnel who require such access to perform the Agreement. All such personnel are bound by written confidentiality obligations and receive training on data protection. Production database access is limited to the engineering personnel responsible for operating the Service and is logged.

The Processor implements the technical and organisational measures set out in Annex II to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing, and the risks to data subjects.

The Controller is responsible for the security of any Personal Data outside the Service (for example, statement files stored on the Controller's own systems before upload, or files exported from the Service).

The Processor will, taking into account the nature of the Processing, assist the Controller through appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights under GDPR Chapter III. Specifically:

• The Service provides self-service mechanisms in /settings to access, export, correct, and delete Personal Data.
• The Processor will forward any data subject request received directly by the Processor to the relevant Controller within five (5) business days and will not respond substantively except to confirm receipt.
• Where a Controller request requires deletion or export beyond what the self-service interface allows, the Processor will complete the request within thirty (30) days of receipt.

The Processor will notify the Controller without undue delay and in any event within seventy-two (72) hoursafter becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will include, to the extent then known:

1. The nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned;
2. The likely consequences of the Personal Data Breach;
3. The measures taken or proposed to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects;
4. The name and contact details of the Processor's data protection contact point.

Notification of, or response to, a Personal Data Breach by the Processor is not an acknowledgement by the Processor of any fault or liability with respect to the Personal Data Breach.

The Processor will make available to the Controller, upon written request and no more than once per twelve (12) month period, the following:

1. The Processor's then-current Annex II security measures summary;
2. The Processor's then-current third-party security attestations and certifications (e.g. SOC 2 reports, ISO 27001 certificates, penetration test summaries), if any, subject to a mutual non-disclosure agreement;
3. Reasonable written responses to a security questionnaire addressing the topics in Annex II.

If the Controller can demonstrate, after exhausting the above, that this information is insufficient to demonstrate compliance with the Processor's obligations under this DPA, the Controller may request an on-site audit by an independent third-party auditor reasonably acceptable to the Processor, at the Controller's expense, on at least sixty (60) days' written notice, during regular business hours, and subject to the Processor's reasonable security and confidentiality requirements.

Audits in connection with a regulator's binding instruction or a Personal Data Breach are not subject to the frequency or cost limitations of this Section.

Where the Processor or a Sub-processor Processes Personal Data outside the European Economic Area (“EEA”), the United Kingdom, or Switzerland, the transfer is subject to one of the following safeguards:

1. For EEA→Third Country transfers: the Standard Contractual Clauses (Module Two: Controller-to-Processor where the Processor is the data exporter and the Sub-processor is the data importer; or Module Three: Processor-to-Processor where applicable), incorporated by reference into this DPA. The Parties select Clause 7 (Docking clause) — included; Clause 9(a) (Sub-processor authorisation) — option 2 (general written authorisation) with 30 days' notice; Clause 11(a) (Independent dispute resolution) — omitted; Clause 17 (Governing law) — law of the Republic of Ireland; Clause 18 (Forum and jurisdiction) — courts of the Republic of Ireland.
2. For UK→Third Country transfers: the UK IDTA, or the EU SCCs together with the UK International Data Transfer Addendum, incorporated by reference.
3. For Swiss→Third Country transfers: the EU SCCs as modified by the guidance of the Swiss Federal Data Protection and Information Commissioner.

The data exporter of record is the Controller; the data importer is the Processor (or, where applicable, the relevant Sub-processor).

To the extent the Processor Processes Personal Information (as defined in the CCPA/CPRA) of California residents on behalf of the Controller:

1. The Processor acts as a “service provider” under the CCPA/CPRA;
2. The Processor will not retain, use, or disclose the Personal Information for any purpose other than for the specific purpose of performing the Service, as required for that purpose, or as otherwise permitted by the CCPA/CPRA;
3. The Processor will not sell or share the Personal Information as those terms are defined in the CCPA/CPRA;
4. The Processor will not combine the Personal Information with personal information that the Processor receives from or on behalf of any other person or persons, except to perform a business purpose permitted under the CCPA/CPRA regulations.

The liability of each Party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

This DPA takes effect on the earlier of (i) the date the Controller accepts it electronically or by countersignature, and (ii) the date the Controller first uses a paid feature of the Service. It remains in force for so long as the Processor Processes Personal Data on behalf of the Controller and continues to govern such Processing after termination of the Agreement until all Personal Data has been deleted in accordance with Section 9.

In the event of any conflict between (a) the SCCs or UK IDTA, (b) this DPA, and (c) the Agreement, the order of precedence is (a) > (b) > (c) for matters relating to the Processing of Personal Data.

This DPA is governed by the law of the Republic of Ireland, without regard to its conflict of laws principles. Disputes arising under this DPA are subject to the exclusive jurisdiction of the courts of the Republic of Ireland, save that nothing in this Section limits either Party's right to seek injunctive relief in any court of competent jurisdiction.

Categories of data subjects

(i) The Controller's authorised users (Workspace Owners, Admins, Members, Viewers); (ii) the Controller's employees, contractors, and authorised representatives whose names, signatures, or email addresses appear in financial statements or contract documents Processed via the Service; (iii) counterparties (e.g. vendor billing contacts) named in those documents.

Categories of Personal Data

Account data (email, name, password hash via the auth Sub-processor); financial transaction data extracted from bank and card statements (date, amount, currency, counterparty name and reference); contract metadata (party names, contract value, term, notice period); contract document text and extracted fields; outbound and inbound email content related to cancellations and contract ingestion; usage logs (IP address, user agent, request path, timestamp); billing reference data (Stripe customer ID and subscription ID — no card data is stored).

Special categories (Art. 9 GDPR)

None are intentionally Processed. The Controller is responsible for not uploading documents containing special categories unless necessary.

Nature of the Processing

Ingestion, parsing, classification, deduplication, aggregation, AI-assisted categorisation, storage, display, export, and (on paid tiers) outbound email composition and dispatch via the Controller's own SMTP credentials.

Purpose of the Processing

Provide the Service: detect recurring subscription charges, surface saving opportunities, alert on contract renewals, support subscription cancellation, and provide bank-feed monitoring.

Retention period

Raw statement files: minutes to seven (7) days. Parsed transactions, subscriptions, contracts, and audits: for the duration of the Agreement plus thirty (30) days after account deletion (primary database), plus the rolling backup retention period (thirty (30) days). Workspace soft-delete restore window: thirty (30) days.

Frequency of transfer

Continuous, on user request, for the duration of the Agreement.

Means of transfer

TLS 1.2 or higher over HTTPS for all data in transit.

The current list of Sub-processors engaged by the Processor is maintained at spendrein.com/legal/subprocessors and forms part of this DPA by reference. The Processor will update that page and notify Workspace Owners as set out in Section 5.3.

This DPA is incorporated by reference into the Agreement and takes effect automatically on the Controller's first paid use of the Service. No counter-signature is required for the DPA to be binding.

If your procurement process requires a counter-signed copy on file, email privacy@spendrein.com and we will return a counter-signed PDF within five (5) business days.