Data processing agreement

Where you enter personal data about your customers, suppliers or employees, you are the controller and Cytron Limited is the processor, acting through the AccuKash brand. This agreement forms part of our terms of service and applies automatically to every customer.

Subject matter: provision of cloud accounting, invoicing, banking, VAT and payroll functionality.

Duration: for the term of your subscription plus the 90-day retention window.

Categories of data subject: your customers, suppliers, employees and users.

Categories of data: contact details, financial transactions, and, where payroll is used, salary, NI number and pension data.

We process personal data only on your documented instructions; ensure staff with access are bound by confidentiality; implement the technical and organisational measures described on our security page; and assist you with data subject requests, breach notification and impact assessments.

We will notify you without undue delay, and in any event within 48 hours, of any personal data breach affecting your data.

We maintain a current list of sub-processors and will give 30 days' notice before adding a new one, during which you may object and, if unresolved, terminate without penalty.

Customer data is stored in the United Kingdom. Where a sub-processor requires a transfer outside the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum.

We will make available the information needed to demonstrate compliance and allow audits on reasonable notice, no more than once a year.

On termination we delete or return all personal data within 90 days, except where UK law requires retention.