Legal
Data processing agreement
Last updated 7 November 2026
Roles
Where you enter personal data about your customers, suppliers or employees, you are the controller and Cytron Limited is the processor, acting through the AccuKash brand. This agreement forms part of our terms of service and applies automatically to every customer.
Scope of processing
Subject matter: provision of cloud accounting, invoicing, banking, VAT and payroll functionality.
Duration: for the term of your subscription plus the 90-day retention window.
Categories of data subject: your customers, suppliers, employees and users.
Categories of data: contact details, financial transactions, and, where payroll is used, salary, NI number and pension data.
Our obligations
We process personal data only on your documented instructions; ensure staff with access are bound by confidentiality; implement the technical and organisational measures described on our security page; and assist you with data subject requests, breach notification and impact assessments.
We will notify you without undue delay, and in any event within 48 hours, of any personal data breach affecting your data.
Sub-processors
Sub-processors include our hosting, payment, Open Banking and email delivery providers, and Cloudflare when Turnstile is enabled on contact forms. We maintain a current list and will give 30 days' notice before adding a new sub-processor, during which you may object and, if unresolved, terminate without penalty. Contact privacy@accukash.com for the current list.
International transfers
Core customer data is stored in the United Kingdom. Where a sub-processor processes or accesses personal data outside the UK, we rely on UK adequacy regulations or put in place an appropriate safeguard, such as the UK International Data Transfer Agreement or Addendum. We will provide information about relevant transfers and safeguards on request.
Audit and deletion
We will make available the information needed to demonstrate compliance and allow audits on reasonable notice, no more than once a year.
On termination we delete or return all personal data within 90 days, except where UK law requires retention.
Questions? Email legal@accukash.com.