Data Processing Agreement (DPA)

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between ProfitLens Technologies Ltd, trading as ProfitLens UK ("Processor", "we", "us"), and the customer using the ProfitLens platform ("Controller", "you").

This DPA governs how we process personal data on your behalf in accordance with:

• UK GDPR
• Data Protection Act 2018
• Applicable UK privacy laws

2. Definitions

• Controller: The individual or business determining the purposes and means of processing personal data.
• Processor: ProfitLens Technologies Ltd, processing data on behalf of the Controller.
• Personal Data: Any information relating to an identifiable individual.
• Processing: Any operation performed on personal data.
• Sub‑processor: A third party engaged by the Processor to assist in processing.

3. Subject Matter of Processing

ProfitLens UK processes personal data for the purpose of providing bookkeeping, financial analysis, and tax‑estimation tools, including:

• Transaction import and categorisation
• Financial dashboards and reporting
• Tax estimation and modelling
• Document and receipt storage
• Subscription and account management

4. Duration

This DPA remains in effect for the duration of your ProfitLens account and until all personal data has been deleted or returned to you.

5. Nature and Categories of Data Processed

5.1 Personal Data

• Name and contact details
• Email address
• Business information
• Financial transaction data
• Uploaded documents and receipts
• IP address and device data

5.2 Special Category Data

ProfitLens UK does not intentionally process special category data. Users must not upload such data unless strictly necessary.

6. Obligations of the Processor (ProfitLens UK)

6.1 Process Only on Documented Instructions

We will only process personal data as required to provide the Service and in accordance with your instructions.

6.2 Confidentiality

All staff and contractors with access to personal data are bound by strict confidentiality obligations.

6.3 Security Measures

We implement industry‑standard security measures, including:

• Encryption at rest and in transit
• Access controls and authentication
• Secure cloud infrastructure
• Regular audits and monitoring
• Backup and disaster recovery procedures

6.4 Assistance with GDPR Rights

We will assist you in responding to data subject requests, including access, correction, deletion, and portability.

6.5 Breach Notification

We will notify you without undue delay if we become aware of a personal data breach affecting your data.

6.6 Data Deletion or Return

Upon account closure, we will delete or return personal data unless retention is required by law.

7. Sub‑processors

ProfitLens UK uses trusted third‑party providers to deliver the Service, including:

• Cloud hosting providers
• Payment processors
• Analytics tools
• Customer support platforms

All sub‑processors are GDPR‑compliant and bound by written agreements. You authorise our use of sub‑processors.

8. International Transfers

If personal data is transferred outside the UK, we ensure appropriate safeguards, such as:

• Adequacy regulations
• Standard Contractual Clauses (SCCs)
• Equivalent protections

9. Obligations of the Controller (the User)

You agree to:

• Ensure you have a lawful basis for processing personal data
• Not upload unlawful or inappropriate data
• Keep login credentials secure
• Comply with all applicable data protection laws

10. Audit Rights

You may request information demonstrating our compliance with this DPA. Formal audits may be conducted with reasonable notice and at your expense.

11. Liability

Liability is governed by the Terms & Conditions. Nothing in this DPA limits rights that cannot be excluded under UK law.

12. Termination

This DPA terminates automatically when your ProfitLens account is closed and all personal data has been deleted or returned.