Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the EULA & Terms of Service between Statim and the Customer, and applies to personal data contained in Customer Data that Statim processes on the Customer’s behalf in providing the Service. Terms defined in the EULA have the same meaning here; “data protection law” means the UK GDPR and the Data Protection Act 2018.

For this personal data the Customer is the controller (or, where the Customer is a Practice or Group acting for Clients or Portfolio Entities, a processor authorised by the relevant controller) and Statim is the Customer’s processor. The Customer warrants that its instructions to Statim comply with data protection law and that it has the authority described in clause 5 of the EULA.

Subject matter and duration: hosting and processing of Customer Data to provide the Service, for the Term plus the post-termination export and deletion period in clause 19.4 of the EULA.

Nature and purpose:ingestion, storage, transformation, consolidation, analysis (including AI-assisted classification and commentary), reporting and controlled sharing of financial management data at the Customer’s instruction.

Categories of data subjects:the Customer’s (and its Clients’ and Portfolio Entities’) personnel, customers, suppliers and other business contacts appearing in accounting records.

Categories of personal data: names, business contact details, job roles, and personal data appearing in financial records (for example supplier or employee names in transactions, invoices and payroll summary lines). The Service is not designed for special-category data, and the Customer must not submit it.

Statim will:

1. process the personal data only on the Customer’s documented instructions (including as set out in the EULA and the Customer’s configuration of the Service), unless required by law to do otherwise, in which case Statim will inform the Customer unless prohibited;
2. ensure persons authorised to process the data are bound by confidentiality obligations;
3. implement the technical and organisational measures in section 6, appropriate to the risk;
4. assist the Customer, taking into account the nature of the processing, in responding to data subject rights requests and in meeting its obligations on security, breach notification, and data protection impact assessments;
5. notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to enable the Customer to meet its own notification duties;
6. at the end of the Term, delete or return the personal data in accordance with clause 19.4 of the EULA, except where law requires retention; and
7. make available information reasonably necessary to demonstrate compliance with this DPA, and allow and contribute to audits (no more than once per 12 months, on reasonable notice, without disrupting the Service or exposing other customers’ data; written responses and third-party attestations satisfy this where reasonably sufficient).

The Customer gives general written authorisation for Statim to engage sub-processors for hosting, infrastructure, payment, email delivery, monitoring and AI model services. The current list is below (also published on the sub-processors page). Bank-connection providers process Customer Data only if the Customer connects a bank.

Statim will give at least 30 days’ notice of any intended addition or replacement (by email or in-product notice). If the Customer reasonably objects on data protection grounds and no resolution is found, the Customer may terminate the affected subscription with a pro-rata refund of prepaid fees for the unexpired period.

Statim will impose data protection obligations on each sub-processor materially equivalent to those in this DPA, and remains liable for its sub-processors’ performance. AI model providers are not permitted to use Customer Data to train their generalised models.

Customer Data is hosted in Germany (EU) by Hetzner Online GmbH. Where processing by Statim or a sub-processor takes place outside the UK, Statim will ensure the transfer is covered by UK adequacy regulations or an appropriate safeguard — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures needed for the transfer to be lawful.

Statim maintains, as a minimum:

1. logical tenant isolation, enforced with role-based access control and database row-level security policies scoped to tenant and entity;
2. encryption of data in transit (TLS) and encrypted backups;
3. hashed and salted credential storage, with multi-factor authentication required for privileged and administrative roles;
4. scoped, revocable, expiring share tokens for any externally shared Output, with view auditing;
5. least-privilege internal access, with production access limited to authorised personnel;
6. routine automated backups with tested restoration; and
7. audit logging of privileged and destructive actions.

Statim may update these measures from time to time provided the overall level of protection is not materially reduced.

This DPA is subject to the limitations and exclusions of liability in clause 17 of the EULA. If this DPA conflicts with the EULA on the processing of personal data, this DPA prevails.