Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the agreement between Zyro Books (Processor) and each business customer (Controller) for the processing of personal data under UK GDPR Article 28.

1. Scope and roles

Zyro Books processes personal data (account holder, employee, end-customer details) solely to provide the cloud accounting service on documented instructions from the Controller.

2. Sub-processors

A current list is published at /subprocessors.html. The Controller may object to new sub-processors within 30 days of notice.

3. Security

TLS 1.3 in transit, AES-256 at rest, role-based access, audit logging, daily encrypted backups. See /security.html.

4. International transfers

Where data leaves the UK/EEA, transfers are protected by UK IDTA or EU SCCs as applicable.

5. Data subject rights and deletion

We assist the Controller in responding to data subject access, erasure, and portability requests. On termination, customer data is deleted within 30 days per the Privacy Policy.

6. Contact

DPA enquiries: [email protected]