Data Processing Addendum.

1. Roles

1. 1.1For personal data in Client Files the Practice is the controller and we are the processor. This addendum sets the terms required by Article 28(3) of the UK GDPR.
2. 1.2For the Practice’s own account, billing and contact data we are the controller, as the Privacy policy describes.
3. 1.3Where a Client holds their own Swiftmore account, we are the controller of that account under our agreement with the Client, and this addendum does not apply to it.

2. Subject matter, duration, nature and purpose

1. 2.1We process Client File data to provide the service to the Practice: holding and organising records, reading uploaded documents, calculating tax positions, preparing returns, and, when switched on, sending returns to HMRC on the Practice’s instruction.
2. 2.2Processing continues for as long as the Practice Licence Agreement is in force and for the 30-day export period after it ends, then only as far as the law requires us to keep a record.
3. 2.3The nature of the processing is storage, structuring, retrieval, automated categorisation and calculation, transmission to HMRC, and deletion.

3. Personal data and data subjects

• Data subjects: the Practice’s Clients; spouses, civil partners and dependants of Clients where the Practice enters their details; the Practice’s own staff who use the service.
• Categories of data: names, addresses, dates of birth, National Insurance numbers, Unique Taxpayer References, bank account details for repayments, income and expense records, property and business details, receipt and statement images, and HMRC receipts.
• Government Gateway or agent sign-in details are used once to send a return and are never stored.
• No special-category data is sought. If a Client File contains such data, for example in a receipt description, we process it only as part of the file.

4. Our duties as processor

1. 4.1We process Client File data only on the Practice’s documented instructions, which are the actions the Practice and its staff take in the service and this agreement. If we believe an instruction breaks the law we tell the Practice.
2. 4.2Everyone we allow to access the data is bound by confidentiality. Access is limited to the people who need it to run and support the service, and is logged.
3. 4.3We keep the security measures in Annex 2 and review them as the service changes.
4. 4.4We help the Practice respond to requests from data subjects about their rights, by providing the export and deletion tools in the service and by answering within five working days where the tools are not enough.
5. 4.5We help the Practice with its own security, breach-notification and data-protection impact assessment duties, so far as the information is ours to give.
6. 4.6At the end of the agreement we delete the data after the 30-day export period, unless the law requires us to keep part of it. Deletion covers our backups within the rotation period in Annex 2.
7. 4.7We give the Practice the information it reasonably needs to show that these duties are met, and allow audits under section 8.

5. Sub-processors

1. 5.1The Practice authorises the sub-processors in Annex 3. Each is bound by written terms that protect the data at least as well as this addendum.
2. 5.2We give 30 days’ notice by email before adding or replacing a sub-processor. If the Practice objects on reasonable data-protection grounds and we cannot resolve the objection, the Practice may end the Practice Licence Agreement without penalty and we refund unused Filing Credits.
3. 5.3We remain responsible to the Practice for the sub-processors we use.

6. Personal data breaches

1. 6.1If we become aware of a personal data breach affecting Client File data we tell the Practice without undue delay and in any case within 48 hours, with what we know: what happened, the data and people affected as far as we can tell, the likely consequences, and what we are doing about it. We update the Practice as we learn more.
2. 6.2The Practice decides, as controller, whether to notify the Information Commissioner’s Office and the people affected. We help with the information they need.

7. Where data is processed and international transfers

1. 7.1Client File data is stored in the European Economic Area (Frankfurt) and backed up, encrypted, in the United Kingdom. Transfers from the UK to the EEA rely on the UK’s adequacy regulations.
2. 7.2Some sub-processors in Annex 3 are based in the United States and may process limited data there. Those transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, which each provider offers under its standard terms.

8. Audit

1. 8.1On request, no more than once a year, we give the Practice written information about how we meet this addendum, including the current list of sub-processors and a summary of our security measures.
2. 8.2Where that is not enough to meet a legal obligation of the Practice, the Practice or an independent auditor it appoints may audit our processing on 30 days’ notice, during working hours, at the Practice’s cost, under confidentiality, and without access to other customers’ data.

9. Term, precedence and liability

1. 9.1This addendum applies for as long as we process Client File data for the Practice.
2. 9.2Where this addendum and the Practice Licence Agreement conflict about personal data, this addendum prevails. The liability clause of the Practice Licence Agreement applies to this addendum.

Annex 1. Processing details

• Controller: the Practice. Processor: Prodro Group Limited, trading as Swiftmore.
• Purpose: providing the Swiftmore service to the Practice for its Clients’ UK tax affairs.
• Duration: the term of the Practice Licence Agreement plus 30 days, then legal retention only.
• Data and data subjects: as section 3.
• Location: EEA (Frankfurt) for the live service; United Kingdom for encrypted backups; United States for the limited processing by the sub-processors marked in Annex 3.

Annex 2. Security measures

• Encryption in transit (TLS) on every connection, and at rest for stored data; identifiers such as National Insurance numbers, Unique Taxpayer References and bank details are additionally encrypted at the field level under a key that can be rotated.
• Two-step sign-in with an authenticator app is required for every member of a practice account. Sign-in attempts are rate-limited and locked after repeated failure.
• Every change to a Client File, every submission and every administrative action is recorded in an audit log with who and when.
• Encrypted backups are taken every six hours and kept on a 7-daily, 4-weekly, 12-monthly rotation in a separate UK data centre; restores are rehearsed.
• Access to production systems is limited to the company’s two founders, uses separate credentials, and is reviewed when people or roles change.
• A web application firewall and request rate limits protect the public endpoints. Uploaded files are checked by type and size and stored privately.
• HMRC sign-in details are used once per submission in memory and never written to storage or logs.

Annex 3. Sub-processors

• Vercel Inc. (United States): hosting and running the application, with the application and its functions in the Frankfurt region; private storage of uploaded receipts and statements, Frankfurt region.
• Prisma Data Platform (Prisma Data Inc., United States): the production database, Frankfurt region.
• Microsoft Azure (Microsoft Ireland Operations Limited): encrypted backups, UK South region.
• Resend Inc. (United States): sending transactional email, such as receipts, reminders and sign-in messages, which carry names and email addresses.
• Anthropic PBC (United States): reading uploaded bank statements, receipts and transaction descriptions to suggest categories, only when the Practice uses those features; data is processed for the request and not used to train models.
• Cloudflare Inc. (United States): the bot check on the sign-in and sign-up pages, which sees the connection details of the person signing in.
• Stripe Payments UK Limited: taking the Practice’s own payments. Stripe is a controller of payment data in its own right and processes no Client File data.
• HMRC is the recipient of submissions the Practice instructs, acting as a public authority in its own right, not as a sub-processor.