Data processing agreement
In force from 12 October 2026. Approved by Rob Duncan, director of Get My Books Ltd. It meets UK GDPR Article 28(3) and forms part of the terms of service.
This agreement is between the customer ("controller") and Get My Books Ltd ("processor"). It applies to personal data in the controller's books that GetMy Books processes when the controller uses it.
1. Subject matter, duration, nature and purpose
| Subject matter | Running the GetMy Books software for the controller |
| Duration | While the terms of service are in force, then as clause 9 says |
| Nature | Reading the controller's Xero organisation and the statement files it supplies; comparing them; showing findings in the controller's Claude account; writing to Xero only the changes the controller approves; keeping an audit record of those changes |
| Purpose | Letting the controller find and correct problems in its own books |
| Personal data | Names, and where present contact details, bank references and amounts, of the controller's customers, suppliers, employees, directors and bank counterparties, as they appear in the books and statements |
| Data subjects | As above |
| Special category data | Not intended. The controller should not put it in descriptions or references |
2. Instructions
2.1 The processor processes the personal data only on the controller's documented instructions. Using the software (asking for a check, approving a change) is an instruction. If the processor thinks an instruction breaks data protection law, it tells the controller.
2.2 The processor's support never views the controller's books data, for any purpose. Its staff do not view, review, prepare, correct or analyse the books (ADR 0036, terms of service 1.2), even if the controller asks or permits it. Support diagnoses a problem from the controller's description of it and from service logs, which hold no books data; it does not ask for or use screenshots of the books or of findings, and it never opens the books.
3. Confidentiality
Everyone the processor authorises to process the data is bound by confidentiality. Production access is limited to named people with multi-factor authentication.
4. Security (Article 32)
The processor keeps at least these measures, and may improve them:
- Every request authenticated before it reaches the application; the application checks the sign-in token itself and refuses anyone without a grant for the company.
- Row-level security in the database by company, tested in CI.
- Xero tokens encrypted at rest (AES-256-GCM), never logged.
- Statement text processed in memory and never stored or logged; bank line IDs in logs only as keyed hashes.
- No change to Xero without the controller's Approve in an approval card the model cannot press; every change logged append-only.
- Nightly database backups in a root-only folder, the last 14 kept, with a restore test; Xero tokens stay encrypted in them, and the key is never in the backups.
- Secret scanning, dependency auditing and static analysis on every change.
Details: SECURITY.md and the threat model.
5. Subprocessors
5.1 The controller gives general authorisation for the subprocessors in subprocessors.
5.2 The processor gives at least 30 days' notice by email of a new or replacement subprocessor. The controller may object on reasonable data protection grounds; if the parties cannot resolve it, the controller may end the terms and is refunded any prepaid fees for the unused period.
5.3 The processor puts data protection terms in place with each subprocessor that are no less protective than these, and stays responsible for them.
6. Data subject rights
The processor helps the controller answer requests from data subjects, so far as the software allows. Most data in the books is held in Xero, where the controller answers directly.
7. Breaches and assistance
7.1 The processor tells the controller without undue delay and within 24 hours of becoming aware, of a personal data breach affecting the controller's data, with what it knows then and updates as it learns more.
7.2 The processor helps the controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing.
8. International transfers
The processor transfers personal data outside the UK only to the subprocessors listed, under the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge.
9. Deletion or return
When the terms end: Xero tokens are deleted and the connection revoked at once; all other personal data, including the activity log, is deleted within 90 days (UK GDPR Article 28(3)(g)). When the controller deletes its account, this happens at once for each company only it uses (SPEC-017): everything is deleted, including the activity log. Only backups remain (below). The changes themselves are in the controller's Xero. The controller can download its account data first; its books data stays in Xero. Statement text is never stored, so there is none to return. Backups, kept on the same server in the UK, roll off within 14 days.
10. Audits
The processor makes available the information needed to show it meets Article 28, including this agreement, the security measures and its subprocessor list, and allows for and contributes to audits by the controller or its auditor, on reasonable notice, no more than once a year unless after a breach, at the controller's cost.
11. Liability
Liability under this agreement is subject to the limits in the terms of service.