Data Processing Addendum

Scope

This addendum applies when you use Statement Compass to process bank statements belonging to your clients or other third parties. In that use you are the controller of their personal data and Statement Compass is your processor. It forms part of the Terms of Use. The legal entity operating the Service will be named here once incorporated; until then the operator is the independent developer identified on the contact page.

Processing

• Subject matter: extraction, categorisation and storage of transactions from statement pages you approve.
• Duration: for as long as you keep the data in your account, and no longer than 30 days after you delete it or close the account.
• Nature and purpose: providing the Service to you, on your documented instructions, which are the settings and actions you take in the app.
• Data: names, account identifiers, transaction descriptions, dates and amounts that appear on the pages you approve; anything you redact is never processed.
• Data subjects: your clients and the counterparties named on their statements.

Our obligations

• Process personal data only on your instructions, and tell you if an instruction appears to break the law.
• Keep anyone with access bound by confidentiality.
• Apply the measures described on the Security page.
• Use only the listed sub-processors, under written terms no weaker than these, and give you 15 days’ notice before adding one that handles approved statement content, during which you may object by closing your account.
• Help you answer data-subject requests, and help you meet your own security, breach-notification and impact-assessment obligations, at reasonable cost.
• Delete or return the data at the end of the service, subject to the retention above.
• Make available the information needed to demonstrate compliance, and allow audits on reasonable notice.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data.

International transfers

Where a sub-processor is outside the country in which the data was collected, transfers rely on that provider’s standard contractual clauses or an equivalent recognised mechanism. Our database and file storage are hosted in South Korea, which holds a European Commission adequacy decision.

Your obligations

You confirm you have a lawful basis to process your clients’ statements and to instruct us to do so, and that you will redact or omit anything you are not entitled to share.