Hosting and sub-processing agreement
Agreed 12 October 2026. Approved for both parties by Rob Duncan, director of Get My Books Ltd and of FEAW Services Ltd. It settles ADR 0036 section 4 (hosting).
Between
- Get My Books Ltd, company number 16825792, registered office 128 City Road, London, EC1V 2NX ("GMB"); and
- FEAW Services Ltd, company number 10345690, registered office 93 Holly Hill, Southampton, SO16 7ET ("FEAW").
1. What this covers
1.1 GMB provides the GetMy Books software to its customers. For their books data GMB is their processor, under GMB's data processing agreement. FEAW hosts GetMy Books for GMB: the server (a NAS owned by FEAW, on FEAW's premises in the UK) runs GMB's application and database, and holds the nightly database backups.
1.2 That makes FEAW GMB's sub-processor. This agreement sets the terms UK GDPR Article 28(2) to (4) require, so GMB can list FEAW in its subprocessor list.
2. The processing
| Subject matter | Hosting the GetMy Books application, its database and its backups |
| Duration | Until this agreement ends (clause 8) |
| Nature and purpose | Storage and computing power only, so GMB can run GetMy Books. FEAW does not use the data for any purpose of its own |
| Personal data | Customers' account emails; company names; Xero connection tokens (encrypted); company profiles; bank account names; proposed and approved changes and the activity log; VAT treatment notes. Statement lines are held in memory only |
| Data subjects | GMB's customers' staff, and the contacts, suppliers and customers named in their books |
| Where | The UK only |
3. FEAW's obligations
FEAW will:
3.1 process the data only on GMB's documented instructions, which are: run the GetMy Books containers and database as deployed by GMB's pipeline, keep the nightly backups GMB's backup job makes, and nothing else; and tell GMB if it thinks an instruction breaks data protection law;
3.2 make sure everyone at FEAW who can reach the server is bound by confidentiality, and limit access to the people who run the server;
3.3 keep the security measures in place today, and not weaken them without telling GMB: the server is reachable from the internet only through the Cloudflare tunnel; administrative access is by key; the Xero tokens are encrypted with a key held in GMB's secrets store, not on the server; disks and the premises are FEAW's to secure (UK GDPR Article 32);
3.4 not engage another sub-processor for this data without GMB's prior written agreement;
3.5 help GMB answer data subjects' requests and meet its Articles 32 to 36 duties, so far as hosting allows;
3.6 tell GMB without undue delay, and within 24 hours, of becoming aware of a personal data breach affecting the server or the backups;
3.7 at the end of this agreement, delete the data and the backups (or hand them to GMB first, at GMB's choice) within 30 days, unless the law requires FEAW to keep them;
3.8 give GMB the information needed to show these obligations are met, and allow GMB, or an auditor it appoints, to inspect the hosting on reasonable notice.
4. GMB's obligations
4.1 GMB decides how GetMy Books processes the data, deploys and updates it, and is responsible to its customers under its own terms.
4.2 GMB keeps the application's own security: sign-in through Cloudflare Access, row-level security, encryption of tokens, and the deploy pipeline.
5. Cost
5.1 FEAW hosts free of charge until the parties agree otherwise in writing.
6. Liability
6.1 Each party is liable to the other for its own breach of this agreement and of data protection law, as the law provides.
7. Moving off FEAW's server
7.1 GMB may move hosting elsewhere at any time. FEAW will cooperate with the move and then delete the data under clause 3.7.
8. Term and ending
8.1 This agreement starts when both parties sign it and continues until either ends it with 90 days' written notice, or GMB moves hosting elsewhere.
9. Law
9.1 This agreement is governed by the law of England and Wales.
Approved for Get My Books Ltd by Rob Duncan, director, on 12 October 2026.
Approved for FEAW Services Ltd by Rob Duncan, director, on 12 October 2026.