Practice Data Processing Agreement
1. Roles
For client records it manages, the accountancy practice ("Practice") is the data controller and Filed is its data processor under GDPR Article 28 and the Data Protection Act 2018. Where a client uses Filed directly, Filed remains controller of that client's own account and the client decides whether to share it with the Practice.
2. Instructions and purpose
Filed processes client data only to provide bookkeeping, tax estimation and filing preparation features to the Practice, and only on the Practice's documented instructions given through the app.
3. Lawful basis and transparency
The Practice confirms it has a lawful basis for every client it adds. For invited clients this is the client's recorded consent. For managed profiles it is the Practice's engagement contract, recorded with its date. The Practice is responsible for providing its own privacy notice to its clients.
4. Confidentiality and security
Personnel with access are bound by confidentiality. Data is encrypted in transit and at rest, and access is limited to the Practice owner by database-level access rules. Every view, change, export and erasure is recorded in an audit log that cannot be edited.
5. Sub-processors
Filed uses the sub-processors listed on our Data Processing page (hosting and database, payment processing, and document text recognition). We will give notice of changes, and the Practice may object.
6. Data subject rights
Filed provides export and erasure tools. Erasure respects Revenue's requirement to keep business records for six years from the end of the relevant tax year (Taxes Consolidation Act 1997, s.886). Records still inside that period are retained and deleted once it ends.
7. Breaches
Filed will notify the Practice without undue delay, and within 48 hours of becoming aware of a personal data breach affecting its clients, so the Practice can meet its 72-hour notification duty to the Data Protection Commission.
8. Termination
When the Practice leaves, client access ends. Invited clients keep their own accounts. Managed profiles are exported to the Practice on request and then erased, subject to the retention rule above.
9. Audits
On reasonable notice, Filed will provide the information needed to show compliance with Article 28.