Data processing agreement
Last updated 14 November 2026
This agreement (“DPA”) forms part of the Terms of service. It applies whenever personal data is processed in SasoBooks on behalf of a customer, and meets Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Cyprus Law 125(I)/2018.
1. Parties and roles
- The Customer (the company that uses SasoBooks) is the controller: it decides why and how the personal data in its books is processed.
- SASOMOR CONSULTING LTD, a company registered in Cyprus ([HE number], [registered address]), which runs SasoBooks, is the processor: it processes that data only to provide SasoBooks to the Customer.
- On the Accountant plan, the accounting firm uses SasoBooks for its client companies. The firm confirms it is authorised by each client to put the client’s data into SasoBooks and to give us instructions for it.
This DPA starts when the Customer accepts the Terms and ends when we no longer hold any Customer personal data (section 7). If it conflicts with the Terms, this DPA prevails on data protection.
2. What we process (Annex 1)
| Purpose | Providing SasoBooks: bookkeeping, statement import and matching, invoicing, receipts inbox, payroll, VAT and tax workings, reminders, reports, exports, and support the Customer asks for |
|---|---|
| Nature | Storing, organising, importing, matching, calculating, displaying, exporting, backing up and deleting |
| People concerned | The Customer’s customers, suppliers, employees, directors and shareholders, and other people named in its bank lines, invoices, receipts and documents |
| Data | Names, company names, addresses, email addresses, phone numbers, VAT and tax numbers, IBANs, payment amounts, dates and references, invoice and receipt contents; for employees also ID or passport number, social insurance number, tax ID, bank account and pay details |
| Special categories | None intended. The Customer should not upload health or other special-category data (GDPR Art. 9) or criminal-record data. Anything that appears incidentally, for example on a receipt, is protected like all other data |
| Duration | The life of the Customer’s companies in SasoBooks, plus the deletion and backup periods in section 7 |
3. Our obligations
- Instructions. We process Customer personal data only on the Customer’s documented instructions, including for transfers outside the EEA. The Terms, this DPA and the Customer’s use and settings of SasoBooks are those instructions. If EU or Cyprus law requires us to process the data otherwise, we tell the Customer first, unless that law forbids it. If we think an instruction breaks data protection law, we tell the Customer.
- Confidentiality. Everyone we authorise to access Customer data is bound by confidentiality. Our staff access Customer data only to provide support the Customer asks for, to keep the service running and secure, or where the law requires it.
- Security. We apply the measures in Annex 2 and keep them up to date (GDPR Art. 32).
- Breaches. We tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data. We give what we know (what happened, the data and people affected, likely consequences, steps taken) and update the Customer as we learn more, so it can meet its own 72-hour duty to notify the Commissioner for Personal Data Protection and, where needed, the people affected.
- Requests from people. We help the Customer answer requests to access, correct, export, restrict or delete data, mainly through SasoBooks’ own edit, export and delete tools. If a person contacts us directly, we pass the request to the Customer and do not answer it ourselves unless the Customer asks us to.
- Other help. Taking into account the nature of the processing and the information we have, we give reasonable help with the Customer’s obligations under GDPR Articles 32 to 36: security, breach notifications, data protection impact assessments and prior consultation with the Commissioner.
4. Sub-processors
The Customer gives general authorisation for us to use the sub-processors below. Each is bound by a written agreement with data protection obligations at least as protective as this DPA, and we remain responsible to the Customer for their work.
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | EU (Paris, France) | Stored in the EU; Standard Contractual Clauses (SCCs) cover any access from the US |
| Render Services, Inc. | Runs the SasoBooks application | EU (Frankfurt, Germany) | Processed in the EU; SCCs cover any access from the US |
| GitHub, Inc. | Source code and nightly encrypted database backups | United States | EU–US Data Privacy Framework and SCCs; backups are stored encrypted |
| Cloudflare, Inc. | Domain names, content delivery and protection against attacks | Global network | EU–US Data Privacy Framework and SCCs |
| Postmark (ActiveCampaign, LLC) | Service emails (sign-up, sign-in, invitations) and the receipts inbox (emails you send to your SasoBooks inbox address) | United States | EU–US Data Privacy Framework and SCCs |
Stripe Payments Europe, Ltd handles payments for SasoBooks subscriptions. It receives only the Customer’s billing details, for which we are controller (see the Privacy policy), not bookkeeping data. Direct bank connections through Enable Banking Oy (Finland), a licensed account information service provider, are not active at launch; we will update this DPA before switching them on.
- Changes. We give at least 30 days’ notice by email before adding or replacing a sub-processor that handles Customer personal data. If the Customer objects on reasonable data protection grounds and we cannot resolve it, the Customer may end its subscription and we refund any prepaid period that remains.
5. International transfers
Customer data is stored in the EU (Paris, France; the application runs in Frankfurt, Germany). Some sub-processors are US companies or copy data to the US, as the table shows: in particular, nightly encrypted database backups are stored with GitHub, Inc. in the US, and emails to and from SasoBooks pass through Postmark in the US. Any transfer outside the EEA relies on an adequacy decision (the EU–US Data Privacy Framework, for providers certified under it) or the European Commission’s Standard Contractual Clauses, with supplementary measures such as encryption where appropriate. The Customer can ask us for copies at dor@sasomor.com.
6. Audits
On request we provide the information needed to show we meet this DPA, including a description of our security measures and our sub-processors’ certifications and reports. If that is not enough, the Customer may audit us, or appoint an independent auditor bound by confidentiality to do so, once a year (or after a breach affecting its data), at its own cost, with 30 days’ notice, during business hours and without access to other customers’ data.
7. End of processing: return and deletion
- Return. Owners and admins can download all of a company’s data at any time in Settings › Data, as one JSON file with every record; uploaded documents are listed in it and can be downloaded from the app. This is how we return data.
- Deletion. When an owner asks to delete a company in Settings › Data, all its data is deleted from our live systems on or after 30 days (the owner can cancel until then). Deleted data then disappears from our encrypted backups as they expire, at most [backup retention, e.g. 35 days] later.
- Ending the subscription. If the Customer stops paying but does not delete a company, the company stays read-only so the Customer can still read and export it. We do not delete it without at least 30 days’ notice by email.
- We keep Customer personal data after this only where EU or Cyprus law requires it, and protect it under this DPA while we do. Keeping the Customer’s own accounting records for the period the law requires (at least 6 years in Cyprus) is the Customer’s responsibility: it should download the export before deleting.
8. Liability and law
- Liability. Each party’s liability under this DPA is subject to the limits in the Terms, except where the GDPR or other law does not allow a limit. This does not limit either party’s liability to the people whose data is processed under GDPR Article 82.
- Law and courts. Cyprus law applies, and the courts of [Limassol / Nicosia], Cyprus, decide disputes.
Privacy contact: dor@sasomor.com.
Annex 2: Security measures
| Sign-in | Two-step verification with an authenticator app is required for every user; the database itself refuses access to books without it. Passwords are at least 12 characters and stored only as hashes |
|---|---|
| Separation | Each company’s data is kept apart by database row-level security, checked on every request |
| Roles | Owners, admins, accountants and members have different rights; sensitive employee identifiers are visible only to owners, admins and accountants |
| Encryption | TLS for all traffic; databases and files encrypted at rest by the hosting providers; database backups encrypted before they are stored |
| Audit trail | Changes to the books and important actions (such as deletion requests) are recorded in an audit log; posted entries and filed VAT returns cannot be deleted by users |
| Staff access | Limited to the people who run SasoBooks, through provider accounts protected by two-step verification; secrets are kept out of the code |
| Backups | Nightly encrypted database backups, kept for at most [backup retention, e.g. 35 days] |
| Hosting | EU data centres (Paris and Frankfurt) run by providers with recognised security certifications |
| Incidents | A written plan for handling breaches, with the notification steps in section 3 |