Data processing
Data processing terms
For practices using The Finance Desk software: how we process the personal data you put into it, on your behalf.
Last updated [DATE OF PUBLICATION]. The Finance Desk is a trading name of The Developer Desk Ltd, a company registered in England and Wales, number [COMPANY NUMBER]. Contact: hello@thefinancedesk.co.uk.
What these terms cover
These data processing terms form part of our software subscription terms. They apply when your practice (the "controller") puts personal data into The Finance Desk software, and The Developer Desk Ltd, trading as The Finance Desk ("we", the "processor"), processes it to provide the service. They are intended to meet Article 28 of the UK GDPR.
The processing
| Subject matter | Providing The Finance Desk software to the controller. |
|---|---|
| Duration | The subscription, plus the 90-day read-only period and backup deletion set out in the terms. |
| Nature and purpose | Storing, displaying, calculating with and exporting the controller's data so its users can manage the practice and its work for clients. |
| Types of personal data | Names, contact details and roles of the controller's staff and of its clients and their directors, partners, owners and contacts; client references such as company and UTR numbers; records of identity checks, risk assessments, PEP and sanctions checks and due diligence; fees, time and billing records; complaints and notes the controller chooses to enter. |
| Data subjects | The controller's users, its clients and prospective clients, and the people connected to them that its records are about. |
| Special category data and criminal offence data | None is needed to use the service, and the controller should not enter special category data. Money laundering records (for example a PEP check or the outcome of due diligence) may relate to criminal offences; the controller decides what to record and is responsible for having a lawful basis and an appropriate policy document. The details of any suspicious activity report should be kept outside the app. |
What we will do
- Process the personal data only on the controller's documented instructions, which are these terms and the controller's use of the app, unless the law requires otherwise (in which case we will tell the controller first, if allowed).
- Make sure everyone who can access the data is bound to keep it confidential.
- Keep appropriate security measures in place, including encryption in transit and at rest, separation of each business's data by database rules, access only for named people, and regular backups.
- Use only the sub-processors listed below, and tell the controller at least 30 days before adding or replacing one, so it can object. We will put equivalent data protection terms in place with each.
- Help the controller respond to requests from data subjects and meet its duties on security, breach notification and data protection impact assessments, taking into account the information we hold.
- Tell the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data.
- At the end of the service, delete the data as set out in the terms, unless the law requires us to keep it. The controller can download it beforehand.
- Make available the information needed to show we meet these terms, and allow for and contribute to reasonable audits, on reasonable notice and no more than once a year unless there has been a breach.
Sub-processors
| Provider | What for | Where |
|---|---|---|
| Google Cloud (Firebase) | Sign-in, database, file storage, backups | London (europe-west2) |
| Cloudflare | Hosting the app and protecting it from attack | Global network; no customer data stored |
| Microsoft | Sign-in, only for users who choose "Sign in with Microsoft" | As set by the user's organisation |
Where a sub-processor may access data from outside the UK, the transfer is covered by the UK–US data bridge or the UK International Data Transfer Addendum.
What the controller will do
Make sure it has a lawful basis for the personal data it enters, give its clients and the people concerned the information the law requires, keep its user list up to date, only enter the personal data it needs, and keep money laundering records for the periods the regulations require.
Order of precedence
If these data processing terms conflict with anything else in our terms, these terms apply to the processing of personal data.