Data processing addendum

This addendum forms part of the terms of service between NORTHLIGHT MEDIA LTD, trading as VexLedger, registered in England and Wales, company no. 16897842, registered office 86-90 Paul Street, London EC2A 4NE, ICO registration ZC264384 (“VexLedger”, the “processor”), and the business that uses VexLedger (the “customer”, the “controller”). It applies automatically while VexLedger processes personal data on the customer’s behalf. It is intended to meet Article 28 of the UK GDPR.

1. Roles

For the personal data in the accounting records the customer enters into VexLedger (“customer data”), the customer is the controller and VexLedger is the processor. VexLedger is a separate controller of its own account, security and service records, as described in the privacy notice.

2. What is processed

The details of the processing are in Annex 1. VexLedger processes customer data only to provide, secure and support the service, and otherwise only on the customer’s documented instructions. The customer’s instructions are this addendum, the terms, and the customer’s use of the features of the service. If VexLedger believes an instruction breaks data protection law, it will tell the customer.

3. Confidentiality

VexLedger makes sure that everyone it authorises to process customer data is bound by a duty of confidentiality and has access only where they need it.

4. Security

VexLedger takes appropriate technical and organisational measures to protect customer data, including those in Annex 2. It may update them provided it does not reduce the overall level of protection.

5. Sub-processors

The customer gives general authorisation for VexLedger to use the sub-processors on its sub-processors page, which is also summarised in Annex 3. VexLedger will give the customer at least 30 days’ notice of any new or replacement sub-processor, by email to the customer’s organisation owners and by updating that page. The customer may object, on reasonable grounds relating to data protection, within 14 days of the notice. If the parties cannot resolve the objection, the customer may stop using the affected service by giving written notice. VexLedger puts in place with each sub-processor obligations that offer an equivalent level of protection, and remains responsible for their performance.

6. International transfers

Customer data, including uploaded files, is stored in the European Union, which is covered by UK adequacy regulations, and the application code that processes it runs in the EU. Connections reach VexLedger through Cloudflare’s global network, and some sub-processors process data outside the UK. VexLedger will transfer customer data outside the UK only where a lawful transfer mechanism applies, such as UK adequacy regulations or the UK addendum to the international data transfer agreement or standard contractual clauses, and will take any additional measures the law requires.

7. Helping the customer

Taking into account the nature of the processing, VexLedger will give the customer reasonable help to respond to requests from people exercising their rights, and to meet its obligations about security, breach notification, data protection impact assessments and consulting the regulator. Where a request cannot be dealt with using the features of the service, help beyond that may be at the customer’s reasonable cost. If VexLedger receives a request directly from a person about customer data, it will pass it to the customer and will not respond other than to refer the person to the customer, unless the law requires otherwise.

8. Personal data breaches

VexLedger will tell the customer without undue delay after becoming aware of a personal data breach affecting customer data, and will give the information the customer reasonably needs to meet its own obligations to report to the regulator and to the people affected, and will cooperate with the customer in dealing with the breach.

9. Returning and deleting data

While the customer’s account is active, it can export its reports and records using the features of the service. When the agreement ends, VexLedger keeps the customer data for 12 months so the customer can reopen the account or ask for a copy, and then deletes it (or returns it, if the customer asks). The customer can ask for earlier deletion at any time. Copies held in backups are removed within 90 days after the live data is deleted. VexLedger will not delete data it is required by law to keep. Because accounting records must often be kept by law, the customer remains responsible for keeping the records it is required to keep.

10. Information and audits

VexLedger will give the customer the information reasonably needed to show that it is complying with this addendum, and will allow and contribute to reasonable audits, including inspections, carried out by the customer or an auditor it appoints, at the customer’s cost, on reasonable notice, during normal hours, and without disrupting the service or other customers.

11. The customer’s responsibilities

The customer is responsible for having a lawful basis for the customer data, for giving any notices to the people it is about, for the accuracy of the data, for the access it gives to its users, and for not entering special categories of personal data unless it has agreed otherwise with VexLedger in writing.

12. Liability, term and law

Liability under this addendum is subject to the limits in the terms. The competent supervisory authority is the Information Commissioner’s Office (ICO). This addendum lasts as long as VexLedger processes customer data. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Subject matter	Providing the VexLedger online accounting service to the customer
Duration	The term of the agreement, then up to 12 months as described in section 9
Nature and purpose	Hosting, storing, organising, displaying, reporting on and securing the customer’s accounting records; producing and sending documents such as invoices and quotes on the customer’s instructions; reconciling bank transactions; reading uploaded documents where the customer uses that feature; and exchanging information with services the customer connects
Types of personal data	Names and business contact details (such as email address, phone number, address and tax reference) of the customer’s customers and suppliers; names and email addresses of the customer’s users; references and notes on invoices, bills and payments; descriptions in bank transactions; other business and financial information the customer chooses to enter
People the data is about	The customer’s users and administrators; the customer’s customers and suppliers and their staff; other people whose details the customer chooses to enter
Special categories	None are needed for the service. The customer should not enter them unless agreed in writing

Annex 2: Security measures

• Access control. Access is limited by role and by brand. Owners and admins manage who can do what. Each customer’s data is kept separate from every other customer’s.
• Sign-in. Passwords are stored only in a hashed form. Two-step sign-in using an authenticator app is available and strongly recommended for administrators. Sign-in sessions expire, and a user can end all other sessions. Sign-in and the contact form are protected against automated abuse and repeated attempts.
• Encryption. Connections to VexLedger are encrypted in transit. Keys that customers give us to connect other services are stored encrypted and are never displayed again.
• Integrity and audit. Posted entries are never edited or deleted in place; corrections are made by linked reversal entries. Changes to the books and administrative actions are recorded in an append-only audit trail. Closed periods can be locked.
• Resilience. The service runs on a major cloud provider’s infrastructure with regular backups.
• People. Access by VexLedger personnel to customer data is restricted to what is needed to run and support the service.

Annex 3: Sub-processors

The sub-processors VexLedger uses to provide the service are below. The current list, with its change notices, is always on the sub-processors page.

Sub-processor	What it does for VexLedger	Notes
Cloudflare	Hosts VexLedger, stores customer data and files, delivers the website, and protects the service and its forms from attack and abuse	Records, files and application code in the European Union; connections enter through the global network
Amazon Web Services	Delivers the emails VexLedger sends, including invitations, password resets and invoices sent on the customer’s instructions	London region
Anthropic	Reads the content of documents such as receipts when the customer uses that feature	Used only when the feature is used

The customer may also choose to connect services such as Stripe, GoCardless, a bank-data provider for bank feeds, HMRC and Companies House. When it does, VexLedger exchanges data with those services on the customer’s instructions. They are the customer’s own providers or independent organisations and are not VexLedger’s sub-processors.