Data processing agreement
The processor terms that apply when we handle personal data inside your workspace on your instructions. A signed copy is available on request.
Last updated 1 September 2026 · Softieons, operator of Accountieons1. Roles
For personal data inside your workspace — your customers, vendors, employees and their contact and payment details — you are the controller and Softieons is the processor. For account, billing and website data we act as controller under our privacy policy.
Accounting practices administering client workspaces are typically processors for their clients and remain the controller-facing party to us.
2. Subject matter and duration
| Item | Detail |
|---|---|
| Subject matter | Provision of the Accountieons accounting and tax platform |
| Duration | The subscription term, plus the retention window in section 8 |
| Nature and purpose | Storage, computation, transmission and display of accounting records |
| Categories of data subject | Your customers, vendors, employees, and your own users |
| Categories of personal data | Names, business and personal contact details, tax identifiers, bank and payroll details, transaction records |
| Special categories | Not required by the service; do not upload unless separately agreed |
3. Our obligations
- Process personal data only on your documented instructions and as needed to provide the service.
- Impose confidentiality on every person with access, and grant access on a least-privilege basis.
- Implement the technical and organisational measures in section 4.
- Assist you with data-subject requests, impact assessments and regulator queries.
- Make available the information needed to demonstrate compliance, including audit support once per year or after a material incident.
4. Security measures
- Encryption — TLS 1.3 in transit, AES-256 at rest, encrypted backups.
- Tenant isolation — separate tenant per company; no shared record tables.
- Access control — role-based permissions, two-factor authentication, SSO on group plans, no standing production access for our staff.
- Logging — tamper-evident audit trail of workspace changes; support sessions logged and time-boxed.
- Resilience — daily encrypted backups, point-in-time restore, tested recovery.
- Change control — reviewed releases with rollback; segregated environments.
5. Sub-processors
You authorise the sub-processors listed on our sub-processor page. We will give at least 30 days’ notice before adding or replacing one, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service without penalty. Each sub-processor is bound to equivalent obligations.
6. International transfers
You choose your data region at setup. Where support or engineering access from another country is required, transfers rely on the EU standard contractual clauses, the UK addendum, or another lawful mechanism applicable to your jurisdiction, together with the supplementary measures described in section 4.
7. Personal data breach
We notify you without undue delay and within 48 hours of becoming aware of a personal-data breach affecting your workspace, with the facts known at the time, the likely consequences and the measures taken. We assist with your own notification obligations and keep you updated as the investigation progresses.
8. Return and deletion
On termination the workspace is read-only for 60 days so you can export. We then delete production data; encrypted backups age out within a further 35 days. Written confirmation of deletion is provided on request. We do not retain copies except where law requires it, in which case the retained data stays protected by this agreement.
9. Getting it signed
Write to legal@accountieons.com with your entity details and we will send a countersigned DPA, plus any jurisdiction-specific annexe you need, within one working day.