Data processing agreement
Template. Have it reviewed by a lawyer before relying on it.
This data processing agreement ("DPA") forms part of the agreement between the firm that signs up for MonthDue ("Controller") and the operator of MonthDue ("Processor"). It applies whenever the Processor handles personal data on the Controller's behalf.
1. Subject and duration
The Processor collects, stores, checks and makes available documents and information the Controller requests from its own clients, for as long as the Controller uses the service, plus the deletion periods below.
2. Types of data
Contact details of the Controller's clients (name, email); financial documents those clients upload (for example bank, card and loan statements, payroll reports, receipts) and the personal data they contain; written answers; and usage logs.
3. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are given through the settings and actions in the service, unless the law requires otherwise. The Processor will tell the Controller if it believes an instruction breaks data protection law.
4. Confidentiality
Everyone at the Processor with access to personal data is bound by confidentiality.
5. Security
The Processor maintains the technical and organisational measures described on its security page, including encryption in transit and at rest, firm-level access isolation, two-factor authentication for firm users, malware scanning, audit logging and automatic deletion.
6. Subprocessors
The Controller authorises the subprocessors listed on the security page. The Processor will give at least 30 days' notice by email before adding or replacing a subprocessor, and the Controller may object and terminate. The Processor imposes data protection terms on each subprocessor that are at least as protective as this DPA.
7. International transfers
Where personal data is transferred to a country without an adequacy decision, the Processor relies on the Standard Contractual Clauses or an equivalent lawful transfer mechanism.
8. Data subject requests
The Processor will help the Controller respond to requests from individuals to access, correct or delete their data, mainly through the features of the service.
9. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Controller's data, with the information reasonably available.
10. Deletion
Uploaded files are deleted automatically after the retention period the Controller sets. On termination, the Processor deletes all of the Controller's personal data within 30 days, except where the law requires it to be kept.
11. Audits
The Processor will make available the information reasonably needed to show compliance with this DPA, and respond to reasonable written audit questions once a year.
12. AI-assisted checks
Document text or images are sent to an AI model provider only to classify the document and extract the fields used for checks. The provider may not use the data to train models. Only the extracted fields are stored.
To get a countersigned copy, email hello@localhost with your firm's legal name.