Data processing schedule

This Data Processing Schedule (“Schedule”) is incorporated into and forms part of the BalanceTrace SaaS Terms (“Terms”) and takes effect when the Customer accepts the Terms. It applies between BALANCETRACE LTD, company number 17252905, whose registered office is at Flat 40 Eaton House, Vicarage Crescent, London, England, SW11 3LE (“BalanceTrace”), and the audit or accounting firm that accepts the Terms (“Customer”). A person accepting the Terms for the Customer warrants that they have authority to bind the Customer. If there is any conflict between this Schedule and the Terms concerning the Processing of Protected Data, this Schedule prevails to the extent of that conflict.

Under this Schedule, BalanceTrace acts as Processor when Processing Personal Data contained in Customer Data on the Customer’s behalf in connection with the hosting, provision, security, support and operation of the Platform and Services. This includes Personal Data in audit evidence, financial and business records, payroll and transaction data, communications, prompts, uploaded documents and Generated Outputs. The Customer determines the purposes and means of that Processing and is the Controller. This Schedule does not govern Personal Data for which BalanceTrace acts as an independent Controller, including account administration, authentication, billing, security, fraud prevention, service and legal communications, support, compliance, legal claims and appropriately configured analytics or marketing, as described in the BalanceTrace Privacy Policy.

Definitions

For the purposes of this Schedule, “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Processor” have the meanings given in Applicable Data Protection Law. “Special Category Personal Data” has the meaning given in Article 9 of the UK GDPR, and “Sub-processor” means a Processor engaged by BalanceTrace to Process Protected Data. The following additional terms have the meanings set out below:

Customer means the accounting or audit firm legal entity that accepts the Terms and subscribes for or uses the Platform, and acts as Controller of Protected Data. Its Authorised Users (as defined in the Terms, including invited end-client users) act on its behalf.

BalanceTrace means BALANCETRACE LTD, company number 17252905, whose registered office is at Flat 40 Eaton House, Vicarage Crescent, London, England, SW11 3LE.

Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other law relating to privacy or the Processing of Personal Data that applies to a party, in each case as amended or replaced from time to time, together with binding requirements of the Information Commissioner’s Office or another competent supervisory authority. Applicable Data Protection Law includes Data Protection Legislation as defined in the Terms.

Protected Data means the Personal Data described in Annex 1 that BalanceTrace Processes on the Customer’s behalf as part of Customer Data, including Personal Data in audit evidence, financial, transaction and payroll records, communications, prompts, documents and Generated Outputs. It excludes Personal Data for which BalanceTrace acts as an independent Controller.

Any other capitalised term not defined in this Schedule has the meaning given in the Terms.

1 Scope and roles

For the purposes of this Schedule and the Terms, the parties acknowledge and agree that:

• (a)This Schedule applies to all Protected Data Processed by BalanceTrace on the Customer’s behalf through the Platform, including data uploaded or submitted by the Customer, its Authorised Users and users invited by the Customer; data in prompts, files, documents, datasets, messages and other inputs; data generated through platform functionality; and data Processed through integrations and Sub-processors. BalanceTrace shall Process Protected Data only in accordance with Applicable Data Protection Law, the Customer’s documented instructions and Annex 1.
• (b)Independent Controllers. This Schedule does not apply where either party independently determines the purposes and means of Processing Personal Data. Each party remains separately responsible for its own Controller obligations. In particular, BalanceTrace acts as an independent Controller for the activities identified in the introductory provisions of this Schedule and its Privacy Policy. In addition:
  • (i)BalanceTrace shall not use Protected Data, prompts or Generated Outputs to train BalanceTrace models or any third-party foundation model unless the parties have separately and expressly agreed to that Processing in writing and it is lawful under Applicable Data Protection Law. BalanceTrace may use information that has been irreversibly anonymised so that it no longer constitutes Personal Data to maintain, secure and improve the Platform and Services, subject to the Terms and clause 12(b).
  • (ii)The Customer is responsible for ensuring that its collection and use of Protected Data, and its instructions to BalanceTrace, comply with Applicable Data Protection Law. The Customer shall provide all required privacy information, establish and document appropriate lawful bases and Article 9 or Article 10 conditions where relevant, obtain any required permissions, minimise the Personal Data submitted and ensure it has authority to permit Processing by BalanceTrace, authorised Sub-processors and any approved international recipients. The Customer remains responsible for its Authorised Users and users it invites to an audit engagement.
  • (iii)Each party shall comply with the Controller obligations that apply to any Personal Data for which it acts as an independent Controller.

2 Processing instructions

The parties agree that this Schedule applies only to Processing carried out by BalanceTrace on the Customer’s behalf. In relation to that Processing:

• (a)the Customer instructs BalanceTrace to Process Protected Data as necessary to provide, host, secure, maintain and support BalanceTrace, enable the Customer’s configured integrations and features, comply with the Terms and Annex 1, and follow any other documented instruction agreed by the parties;
• (b)BalanceTrace shall not Process Protected Data for its own purposes and shall immediately inform the Customer if, in BalanceTrace’s reasonable opinion, an instruction infringes Applicable Data Protection Law. BalanceTrace may suspend the affected Processing until the parties agree a lawful instruction, and shall not be liable for any resulting service unavailability or degradation to the extent caused by that suspension; and

if Applicable Data Protection Law requires BalanceTrace to Process Protected Data other than on the Customer’s documented instructions, BalanceTrace shall notify the Customer before doing so unless that law prohibits notification on important grounds of public interest. Nothing in this Schedule relieves either party of its responsibilities under Applicable Data Protection Law. BalanceTrace remains responsible for its Sub-processors to the extent required by Applicable Data Protection Law.

3 Customer compliance

The Customer shall at all times comply with Applicable Data Protection Law in relation to Protected Data and shall ensure that its instructions are lawful. Without limiting the preceding provisions, the Customer is responsible for: (a) establishing and documenting each required lawful basis, consent, authorisation and, where relevant, Article 9 or Article 10 condition; (b) providing required information to Data Subjects about BalanceTrace, authorised Sub-processors and relevant international transfers; (c) ensuring that its Authorised Users and invited users submit only Personal Data necessary for the relevant audit engagement; and (d) responding to complaints and Data Subject requests, with BalanceTrace’s assistance as described below.

4 BalanceTrace compliance

BalanceTrace shall comply with the obligations imposed on Processors by Applicable Data Protection Law. In particular, BalanceTrace shall: (a) Process Protected Data only on documented instructions from the Customer, including as to international transfers, unless required by law; (b) ensure that persons authorised to Process Protected Data are bound by confidentiality obligations; (c) implement and maintain the technical and organisational measures in Annex 2 and ensure a level of security appropriate to risk in accordance with Article 32 UK GDPR; (d) engage Sub-processors only in accordance with the subprocessing provisions below; (e) taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to Data Subject requests; (f) taking into account the nature of Processing and information available to BalanceTrace, assist the Customer with security, Personal Data Breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 UK GDPR; (g) at the Customer’s choice, return or delete Protected Data after the Services end in accordance with the retention provisions below, unless law requires storage; (h) maintain records required of it under Applicable Data Protection Law; and (i) make available information reasonably necessary to demonstrate compliance with this Schedule and permit proportionate audits as described below.

5 Documented instructions

BalanceTrace shall ensure that its personnel and Sub-processors Process Protected Data only in accordance with the Customer’s documented instructions in this Schedule, the Terms, Annex 1 and any additional written instruction agreed by BalanceTrace. BalanceTrace shall not disclose or transfer Protected Data to a third party except as authorised by this Schedule, required to provide the Services or otherwise instructed by the Customer. The Customer acknowledges that instructions outside the scope of the Services may require prior agreement on feasibility, timing and reasonable charges, and that BalanceTrace is not obliged to implement an instruction that falls outside the agreed scope of the Services. The unlawful-instruction notice, legal-requirement exception and no-training default above apply to all instructions.

6 Security

BalanceTrace shall implement and maintain the technical and organisational measures described in Annex 2 to protect Protected Data against accidental or unlawful destruction, loss or alteration, and unauthorised disclosure of, or access to, Protected Data. Those measures shall be appropriate to the risk, taking account of the state of the art, implementation costs and the nature, scope, context and purposes of Processing. BalanceTrace may update the measures to reflect technical and organisational developments, provided that the overall level of protection is not materially reduced in BalanceTrace’s reasonable assessment. BalanceTrace shall notify the Customer of any change that BalanceTrace reasonably considers material.

7 Subprocessing

The Customer gives BalanceTrace general written authorisation to engage the Sub-processors listed in Annex 3 and to add or replace Sub-processors. BalanceTrace shall maintain an up-to-date list and give the Customer at least 15 days’ advance written notice of an intended addition or replacement, including information reasonably necessary for the Customer to assess the change. The Customer may object in writing during that notice period on reasonable grounds relating to the protection of Protected Data. The parties shall work in good faith to resolve the objection within 30 days of the objection. If no reasonable resolution is available within that period, BalanceTrace shall either not appoint the proposed Sub-processor or offer a commercially reasonable change to the affected Services and, if the Customer does not accept that change, the Customer may terminate the affected Services without penalty before the Sub-processor begins Processing Protected Data, and shall receive a pro rata refund of any prepaid fees for the terminated period. BalanceTrace shall impose written data protection obligations on each Sub-processor that are no less protective than the relevant obligations in this Schedule and remains responsible for the Sub-processor’s performance to the extent required by Applicable Data Protection Law.

8 Data subject rights

• (a)Taking into account the nature of the Processing, BalanceTrace shall provide reasonable assistance through appropriate technical and organisational measures, insofar as possible, for the Customer to respond to requests under Chapter III UK GDPR or equivalent rights under Applicable Data Protection Law. If BalanceTrace receives a request relating to Protected Data, it shall promptly refer the request to the Customer and shall not respond except on the Customer’s documented instructions or as required by law. Assistance may include reasonable measures to locate, retrieve, correct, restrict, export or delete Protected Data from the Platform and relevant integrated systems. BalanceTrace may charge the Customer reasonable costs for assistance that requires effort beyond what is available through standard Platform functionality.
• (b)The Customer shall remain responsible for verifying and responding to Data Subject requests as Controller and shall give BalanceTrace the information and instructions reasonably required to provide assistance. BalanceTrace shall provide that assistance without undue delay, having regard to the applicable statutory response period.

9 International transfers

BalanceTrace shall not make a restricted transfer of Protected Data unless the transfer complies with Applicable Data Protection Law. Depending on the recipient and Processing location recorded for the applicable deployment, this may require UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful safeguard. BalanceTrace shall ensure that the applicable safeguard is in place before the restricted transfer, support any required transfer risk assessment carried out by the Customer, implement supplementary measures where reasonably required and provide information reasonably requested by the Customer about the transfer. Annex 3 identifies the authorised providers and incorporates the current contracting entities, Processing locations, supplier terms, retention settings and transfer safeguards recorded for BalanceTrace’s applicable accounts and deployments.

10 Records and audits

BalanceTrace shall maintain records required by Applicable Data Protection Law and, on request, provide information reasonably necessary to demonstrate compliance with this Schedule, including relevant security documentation and independent audit reports or certifications where available. If that information is insufficient, BalanceTrace shall allow the Customer or an independent auditor bound by confidentiality to conduct an audit on at least 20 business days’ notice, no more than once in any 12-month period, during normal business hours and without unreasonable disruption or access to another customer’s data. The notice and frequency limits do not apply where a competent authority requires an audit or the Customer reasonably believes a material breach of this Schedule or a Personal Data Breach has occurred. The Customer shall bear its audit costs and reimburse BalanceTrace’s reasonable costs unless the audit identifies a material breach by BalanceTrace that is substantiated and not remedied within a reasonable period after notification.

11 Personal data breach

BalanceTrace shall notify the Customer without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Protected Data, including a breach at a Sub-processor. To the extent known, the notice shall describe: (a) the nature of the breach; (b) the categories and approximate number of affected Data Subjects and Personal Data records; (c) the likely consequences; (d) measures taken or proposed to contain, investigate, mitigate and remedy the breach; and (e) a contact point for further information. BalanceTrace may provide information in phases as it becomes available, shall not delay initial notice pending a complete investigation and shall reasonably cooperate with the Customer’s notifications to Data Subjects and competent authorities. Notification is not an admission of fault or liability.

12 Return and deletion

• (a)Following cancellation, termination or expiry of the Customer’s Subscription or discontinuation of the Services, BalanceTrace shall make supported Customer Data and Generated Outputs available for export through available Platform functionality or another reasonable mechanism for 60 days, unless the Customer requests earlier deletion. The Customer is responsible for exporting its audit files and meeting its professional record-retention obligations. After that 60-day period, BalanceTrace shall delete or irreversibly anonymise active copies of Protected Data, unless retention is required by applicable law or is necessary to establish, exercise or defend legal claims. Protected Data remaining in isolated backups may be retained until overwritten in accordance with BalanceTrace’s documented backup cycles (and in any event for no longer than 180 days after deletion of active copies), shall remain protected under this Schedule and shall not be restored except for disaster recovery or continuity purposes. Any retained copy shall be isolated from further Processing except for the purpose for which it is retained. On written request, BalanceTrace shall confirm completion of deletion, subject to these exceptions.
• (b)BalanceTrace may retain information that has been irreversibly anonymised so that it no longer constitutes Personal Data. Such information may be used for security, service performance, analytics and internal reporting but shall not include identifiable Customer Data, and BalanceTrace shall not attempt to re-identify any individual from it or use it to train BalanceTrace models or third-party foundation models except in accordance with clause 1(b)(i).

13 Assistance and cooperation

• (a)Taking into account the nature of the Processing and information available to it, BalanceTrace shall provide reasonable information and assistance for the Customer’s data protection impact assessments, prior consultation with a competent supervisory authority, regulatory enquiries and other compliance obligations under Articles 32 to 36 UK GDPR. BalanceTrace may charge the Customer reasonable costs for assistance that exceeds the provision of standard documentation. The Customer remains responsible for its assessments, decisions and regulatory communications. Where BalanceTrace acts as an independent Controller for account administration, authentication, billing, security, fraud prevention, service and legal communications, support, compliance, legal claims or appropriately configured analytics or marketing, that Processing falls outside this Schedule and is governed by the BalanceTrace Privacy Policy and Applicable Data Protection Law. BalanceTrace shall not recharacterise identifiable Customer Data as Controller data merely to use it for a secondary purpose.
• (b)Each party shall provide any privacy information required of it for Processing carried out as an independent Controller. The Customer shall ensure that Data Subjects whose Personal Data is submitted to BalanceTrace receive appropriate information about the Customer’s use of the Services and its Processors.

14 Liability

Each party remains responsible for its compliance with Applicable Data Protection Law. Subject to any liability that cannot lawfully be limited or excluded, each party’s liability arising out of or in connection with this Schedule is subject to the exclusions and applicable caps in the Terms. For the avoidance of doubt, BalanceTrace’s aggregate liability for breach of its data-protection, confidentiality or security obligations shall not exceed the applicable cap set out in the Terms (or, if no specific cap is stated, the general liability cap in the Terms). Nothing in this Schedule limits a Data Subject’s rights or either party’s liability to a competent supervisory authority under Applicable Data Protection Law.

15 General

• (a)Confidentiality. The confidentiality provisions in the Terms apply to information Processed under this Schedule. BalanceTrace shall ensure that personnel authorised to access Protected Data are bound by appropriate confidentiality obligations and receive data protection and security training appropriate to their roles.
• (b)Notices. Notices and communications under this Schedule must be in writing and delivered in accordance with the notice provisions in the Terms.
• (c)Governing Law and Jurisdiction. This Schedule and any non-contractual obligations arising out of or in connection with it are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, without prejudice to the powers of the Information Commissioner’s Office or another competent supervisory authority under Applicable Data Protection Law.

Annex 1 – processing particulars

BalanceTrace shall Process Protected Data only for the subject matter, duration, nature and purposes, and in relation to the categories of Data Subjects and types of Personal Data, set out in this Annex 1.

Subject-matter of processing

Provision of the Platform and Services to the Customer for managing external audit engagements, including hosting, receiving, storing, organising, retrieving and displaying Customer Data; enabling audit workflows, questionnaires, document requests, templates, checklists and sample calculations; carrying out AI-assisted processing and producing draft Generated Outputs; maintaining Customer workspaces, configurations and engagement histories; enabling Customer-controlled access for Authorised Users and invited end-client users; and providing related security, support, maintenance and configured integrations.

Duration of the processing

For the duration of the Customer’s Subscription and use of the Services; then for the 60-day post-termination export period; then until active copies are deleted or irreversibly anonymised. Isolated backup copies may remain until overwritten under documented backup cycles, and copies required by applicable law or necessary for legal claims may be retained only for the applicable period, in each case subject to the protections in this Schedule.

Nature and purpose of the processing

Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, analysis, transmission to authorised recipients and Sub-processors, restriction, backup, deletion and other operations necessary to provide and secure the Platform and Services. Processing occurs continuously for hosting and security and otherwise on demand when the Customer or an Authorised User accesses a feature, submits data, runs a workflow, requests AI-assisted processing or obtains support. The purposes are to provide, secure, maintain and support the Services, operate Customer-configured workflows and integrations, generate draft outputs and preserve service continuity. No Processing for another purpose is permitted except on documented instructions or as required by law.

Type of Personal Data

Identity and contact details; employment, role and professional details; account and user identifiers; audit engagement and client records; financial statements and accounting records; transaction, bank, expense, invoice, tax and payroll data; employee, contractor, supplier and customer records; correspondence, questionnaires and responses; prompts, messages, uploaded documents, images and datasets; Generated Outputs; and relevant usage, log, device, connection and support data. Depending on Customer Data, incidental Special Category Personal Data may include health, trade-union membership, racial or ethnic origin, religious or philosophical beliefs, biometric identifiers, sex-life or sexual-orientation data, and data revealing political opinions. Customer Data may also incidentally include criminal-offence, allegation or conviction data. The Customer must use reasonable endeavours to exclude Special Category Personal Data unless strictly necessary for the relevant audit engagement, notify BalanceTrace when it is aware that such data has been submitted, identify the applicable Article 6 basis and any Article 9 or Article 10 condition and minimise such data.

Categories of Data Subjects

Customer personnel, partners, directors, contractors and Authorised Users; the Customer’s audit clients and their directors, officers, employees, workers, contractors, customers, suppliers, advisers, investors, beneficial owners and other stakeholders; invited end-client users; individuals named in audit evidence, financial records, transactions, payroll, communications or other Customer Data; and any other individual whose Personal Data the Customer submits to BalanceTrace.

Annex 2 – technical and organisational measures

BalanceTrace shall maintain measures appropriate to the risks of the Processing and comply with Article 32 of the UK GDPR.

Authentication: Email confirmation is required. Passwords must contain at least 12 characters and are checked against known breached passwords. Authenticator-app multi-factor authentication is available, and a Customer may require it for its firm users and invited client contacts. Sessions expire after eight hours of inactivity and, in all cases, after seven days.

Access restrictions: Row-level database and file-storage rules restrict access by firm, engagement membership and role. Invited client contacts may access only their permitted engagement requests, uploads and comments. Archived engagements and expired subscriptions are made read-only through database controls.

Encryption and application security: Data is protected in transit using TLS. Hosting providers supply encryption at rest using confirmed encryption standard and scope. Application protections include content security policies, HSTS, anti-framing headers and rate limits for authentication, support and AI requests.

Production access: Production access is restricted to authorised personnel on a least-privilege basis. As at the effective date, routine production administration is limited to the founder. Persons permitted access must be subject to confidentiality obligations.

AI processing: AI requests are routed through the authorised gateway and configured to prohibit training on Customer Data and to use verified zero-content-retention arrangements. A provider or endpoint shall not receive Protected Data unless its applicable retention terms, exceptions and configuration have been verified and recorded in Annex 3.

Recorded activity: The Platform records working-paper versions, preparer and reviewer sign-offs, archive events, legal acceptance records and AI usage metadata. It does not currently provide a comprehensive log of every read or edit event. This does not relieve BalanceTrace of its obligation to maintain logging and monitoring appropriate to the risks of the Processing.

Deletion: Working papers placed in the bin are not automatically purged. Deleting an engagement or firm is currently administered through BalanceTrace rather than a self-service function. End-of-service deletion is performed through a controlled manual process, with completion checks and records.

Backups and operational procedures: Before Processing live Customer Personal Data, BalanceTrace shall document its backup frequency, retention and restoration arrangements; test restoration to an extent appropriate to the risks; establish incident escalation, investigation and notification procedures; and document proportionate continuity arrangements. Thereafter, it shall review and test the effectiveness of its security measures at appropriate intervals.

These measures do not constitute a representation that BalanceTrace holds ISO 27001, ISO 42001 or any other certification. Changes must not materially reduce the overall protection of Protected Data.

Annex 3 – authorised subprocessors

The providers below are authorised only for the functions and data described. Each bracketed entry must be completed before the relevant provider receives live Protected Data. “Metadata only” excludes document contents, prompts, responses and extracts. User identifiers remain Personal Data where an individual is identifiable.

OpenAI and Google are standing fallback AI providers. Activation through the gateway does not require a further appointment notice where their Processing remains within the arrangements disclosed below. Subsequent additions or replacements are governed by the Subprocessing provisions.