Data processing agreement

This agreement is between you, the business using Fenquist (the controller), and Fenquist Ltd (the processor). It forms part of our terms of service and meets Article 28 of the UK GDPR. It applies automatically when you use Fenquist; nothing needs signing.

• Subject matter: providing Fenquist: invoicing, quotes, payments, reminders, expenses, mileage and tax estimates.
• People concerned: your clients and their contacts, your team members, suppliers on your receipts, and anyone you add.
• Types of data: names, email and postal addresses, phone numbers, company and VAT numbers, invoice, quote and payment details, and receipt images.
• Special category data: none is needed. Please don't add any.
• Duration: while you use Fenquist, then 30 days after you close your account, and up to 90 days in backups.

• We process your data only on your documented instructions, which are these terms and how you use Fenquist, unless the law requires otherwise (we'll tell you first if the law allows).
• Everyone who can access it is bound by confidentiality, and staff access is limited, logged and only for support you ask for.
• We keep it secure with the measures on our security page: encryption in transit and at rest, isolation between businesses in the database, two-factor sign-in, access logging and locked nightly backups.
• We help you answer people's data rights requests (export, correction and deletion are built into Fenquist) and with any data protection impact assessment or ICO consultation.
• We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we're doing about it.
• At the end, we delete your data (30 days after closing, and from backups within 90 days). You can download it first.
• We give you the information you need to show we meet these commitments, and answer reasonable audit questions in writing.

You authorise us to use the providers listed on our sub-processors page, each under a contract with protections at least as strong as these. We'll email the account owner at least 30 days before adding or replacing one; if you object on reasonable data protection grounds and we can't resolve it, you can close your account with a refund of any unused time.

Your data is stored in the EU (Stockholm), which the UK recognises as adequate. Where a sub-processor handles data outside the UK and EU, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the ICO's International Data Transfer Agreement or Addendum.

You make sure you have a lawful basis to give us your clients' data, that it's accurate, and that you tell them how you use it (for example in your own privacy notice).

Data protection questions: privacy@fenquist.com.