Data Processing Agreement
Terms under which INVICTT AI processes personal data on behalf of an accounting firm (UK GDPR Article 28 outline).
1. Roles
The accounting firm is the controller of personal data about its clients and staff placed in COHESORA; INVICTT AI is the processor. Processor: INVICTT AI. The legal entity name, registration number and registered address are not yet published and must be added before these documents can take effect.
2. Subject matter and duration
Hosting and operating COHESORA for the firm for as long as the firm has an account (including a suspended trial account), until deletion under the retention policy.
3. Nature and purpose; data and subjects
Storage, retrieval, text/OCR extraction, display, export and deletion of client records, tasks, documents and related data. Data subjects: the firm's clients and their contacts, suppliers named on documents, and the firm's staff. Data categories depend on what the firm uploads (names, contact details, invoice and accounting data); special-category data is not intended.
4. Processor commitments the product supports
- Processing only on the firm's documented instructions (the firm's use of the application).
- Confidentiality: administrators and support access are limited; platform support access requires a time-limited grant by the firm and is audited.
- Security measures: per-firm isolation enforced in the database (row-level security), role-based access, multi-factor authentication for administrators, encrypted secrets, short-lived signed download links, rate limiting, tamper-evident audit log. See Security and incident information.
- Assistance: the firm can export all data and can start offboarding, which deletes tenant data after the retention period.
- Subprocessors: listed in the Subprocessors document; the mechanism for notifying changes requires approval.
5. Personal data breach
INVICTT AI will notify the controller without undue delay after becoming aware of a breach affecting the controller's data. The notification period and content require approval.
6. Return and deletion
On request or offboarding, data is exported and then deleted as described in the retention policy. Copies in backups are addressed in that policy.
Decisions required before this can take effect
Matters for professional legal approval or for INVICTT AI to determine. They are deliberately not answered here.
- Whether to use the ICO's standard clauses or a bespoke DPA; signature and acceptance mechanism.
- Sub-processor change notice and objection process.
- Audit and inspection rights; breach-notification deadline.
- Treatment of international transfers inside the DPA (IDTA/Addendum annexes).