Data processing agreement

• Subject. Matching and reconciling the customer's financial records.
• Duration. For as long as the customer's workspace exists, plus the deletion period below.
• Purpose. Reading files, matching lines, producing match suggestions, exceptions, reports and journal entry files, and providing support.

• Types of data. Names of payees, customers, vendors and employees, account numbers and IBANs, payment references, amounts, dates, invoice numbers, email addresses of workspace members.
• Data subjects. The customer's customers, vendors, employees and other counterparties, and members of the customer's workspace.
• Special categories of data are not needed for the service and the customer should not upload them.

• We process personal data only on the customer's documented instructions, which are these terms, this agreement and the customer's settings in the workspace.
• Everyone at Reconciles with access to customer data is bound by confidentiality.
• We protect data with appropriate technical and organizational measures, listed below.
• We help the customer respond to data subject requests and meet its obligations on security, breach notification and impact assessments, as far as the service allows.
• We notify the customer without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting its data.
• We do not use customer files or results to train AI models.

The customer authorizes us to use subprocessors in these categories: hosting and encrypted storage, email delivery, AI model processing for match suggestions and PDF reading, and payment processing for billing.

Each subprocessor is bound by written terms that give at least the same protection as this agreement. The current list of subprocessors is available in the account. We give at least 30 days notice by email before adding or replacing a subprocessor, and the customer may object on reasonable grounds and cancel if we cannot address the objection.

Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or on the standard contractual clauses approved by the European Commission, which are incorporated into this agreement by reference. Scale workspaces can choose to keep data in the US or in the EU.

• Encryption of data in transit and at rest.
• Separation of workspaces and access limited to workspace members.
• Roles and permissions on Growth, single sign-on (SAML), SCIM provisioning and an audit log on Scale.
• Staff access limited to what is needed for support and operations, and logged.
• Demo files processed in the browser and never stored on our servers.
• Regular backups and tested recovery.

More detail on the security page.

Files in a paid workspace are deleted at the end of the retention period chosen by the customer. When the workspace is closed, the customer can export results first, and we delete remaining customer data within 30 days, except where the law requires us to keep it.

We make available the information needed to show compliance with this agreement, including the security questionnaire pack in the account. The customer may request an audit with 30 days written notice, at its own cost, no more than once a year, unless a breach requires otherwise.

Questions about this agreement and data protection go to [email protected].