Data Processing Agreement (accountants and bookkeepers)
This Data Processing Agreement ("DPA") forms part of the Terms of Use between KitFiler LLC ("KitFiler") and an accountant, bookkeeper or firm ("you") who creates client workspaces in KitFiler Money. You accept it by ticking the box when you create your first client workspace; we record the version and date.
1. Roles
For client workspaces you create, you decide what personal information about your clients is entered and who can see it: you are the controller (or "business"), and KitFiler processes that information on your behalf as your processor (or "service provider"). When you hand a workspace over to your client, the client becomes our customer and controller for it from that moment; we record the change.
2. Instructions
We process client personal information only to provide KitFiler Money as described in the Terms, the Privacy Policy and your use of its features (including bank connections, the AI Bookkeeper and its email inbox), and on your other documented instructions, unless the law requires otherwise (in which case we will tell you unless the law forbids it). We do not sell it, share it for cross-context behavioral advertising, use it for our own purposes, or combine it with other data except as needed to provide the service.
3. Confidentiality and security
People at KitFiler who can access client data are bound by confidentiality. We maintain the safeguards in our written information security program, including encryption in transit and of bank tokens and inbox files at rest, workspace-scoped access controls, two-step verification, audit logging of accountant access to client workspaces, and incident response.
4. Subprocessors
You authorize the subprocessors listed on our Subprocessors page. We impose data-protection obligations on them at least as protective as this DPA and remain responsible for them. We update that page before adding a subprocessor that receives client data; you may object by email within 14 days, and if we can't address the objection you may close the affected client workspaces.
5. Assistance
We help you respond to your clients' requests to access, correct, delete or export their information (the workspace tools let you do most of this directly), and with security, breach notification and data-protection assessments as reasonably needed.
6. Security incidents
We notify you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting client data in your workspaces, with the information you need to meet your own obligations.
7. Deletion and return
You can export or delete a client workspace at any time. When a workspace is deleted, its data is deleted from the live system straight away and from backups on our backup rotation.
8. Audits
On request (at most once a year, or after a breach) we provide information reasonably needed to show compliance with this DPA, such as a summary of our security program.
9. Transfers
Data is processed in the United States. Where the law requires, the parties agree to the applicable standard contractual clauses.
Draft for counsel review. Questions: admin@kitfiler.com.