Data Processing Agreement

This is the proposed Data Processing Agreement ("DPA") for the planned external-customer ReceiptTidy service. It will form part of the Terms & Conditions between JnDee Tech Limited ("Processor", "we") and a business customer ("Controller", "you") only when an effective version is expressly incorporated into the customer agreement before customer processing begins. Publication or linking alone does not make this preview binding. The effective DPA is intended to satisfy Article 28 of the UK GDPR.

1. Roles and instructions

You are the controller of personal data in the documents, communications and bookkeeping records you submit. We act as processor for that data. We act as controller for our own account, billing, security, business-administration and service-improvement data, including the AI feedback described in the Privacy Policy.

We process customer personal data only on your documented instructions, including instructions in the Terms, your configured use of the Service and instructions concerning international transfers. If UK law requires other processing, we will inform you before processing unless the law prohibits notice on important grounds of public interest. We will immediately inform you if, in our opinion, an instruction infringes applicable UK data-protection law.

2. Processing details

• Subject matter and nature: capture, transmission, hosting, OCR, AI-assisted extraction and classification, storage, review, optional automated approval, support and publishing to accounting systems you connect.
• Purpose: to provide, secure and support the Service on your instructions.
• Duration: from the first processing until customer personal data is returned or deleted in accordance with this DPA, including any restricted backup-retention period.
• Data subjects: your suppliers, customers, workers, representatives and other people appearing in records or communications.
• Data types: names, contact information, financial/transaction information, tax identifiers, employment-related context and other information contained in submitted records.

Financial information is not automatically special-category data, but a receipt or communication may incidentally reveal health, religious or other sensitive information or information about children. You must minimise such data and ensure an appropriate lawful basis and, where required, Article 9 condition before submitting it.

3. Confidentiality and security

We ensure people authorised to process customer personal data are bound by confidentiality. Measures appropriate to the risk include TLS in transit, encryption of accounting connection credentials, protected document storage, tenant isolation using database row-level security, role-based and least-privilege access controls, secrets management, audit logging, monitoring and restricted backups. Measures may evolve while maintaining an appropriate level of protection.

4. Assistance

Taking account of the nature of processing and information available to us, we will reasonably assist you with:

• data-subject requests;
• security and personal-data breach obligations;
• data-protection impact assessments and prior consultation under Articles 35 and 36; and
• information needed to demonstrate compliance with Article 28.

If we receive a request about customer personal data, we will refer it to you where legally permitted and assist your response.

5. Sub-processors

The following is the planned sub-processor register for the external-customer service. A provider becomes active for external-customer data only after the supplier gate described in section 6 is passed. You give general written authorisation for providers active under that register:

Accounting platforms you choose to connect receive data at your direction and may act as separate controllers under their own terms.

We require each active sub-processor to protect customer personal data through written terms meeting applicable Article 28 requirements and remain responsible for its processing to the extent required by law. Before adding or replacing a sub-processor for external-customer data, we will provide reasonable prior notice directly through the Service or email; a silent register update alone is not notice. You may object on reasonable data-protection grounds; we will work in good faith on a solution, which may include disabling the affected feature.

6. International transfers

We do not approve a provider for external-customer personal data until its processing locations and contractual position have been assessed. Restricted transfers use applicable UK adequacy regulations or appropriate safeguards, such as a UK IDTA or EU Standard Contractual Clauses with the UK Addendum, plus any required transfer assessment and additional safeguards. Information about the applicable mechanism is available from [email protected], subject to necessary redactions.

7. Personal-data breaches

We will notify you without undue delay after becoming aware of a personal-data breach affecting customer personal data and provide available information reasonably needed for your notification and investigation duties.

8. Return and deletion

At the end of processing services, we will, at your choice, return or delete customer personal data and delete existing copies unless UK law requires retention. Data-protection obligations continue for as long as we retain the data. Backups placed beyond ordinary use are protected and removed under the verified schedule in Data Deletion & Retention.

9. Audit

We will make information reasonably necessary to demonstrate compliance available and allow for and contribute to proportionate audits by you or your mandated independent auditor. Audits require reasonable notice, must protect other customers and confidential systems, and should use current independent reports or remote evidence first where they adequately address the request.

10. Customer obligations

You are responsible for the lawfulness, accuracy and minimisation of customer personal data and your instructions; providing required privacy information to data subjects; responding to their rights; and configuring access and automated-publishing settings appropriately. You must not use the Service for unlawful monitoring, profiling or decisions with legal or similarly significant effects.

11. General

This DPA is governed by the laws of England and Wales. If it conflicts with the Terms on processing customer personal data, this DPA prevails.

Revision 2026-09-22.2, published 22 September 2026.