Data Processing Addendum

1. Parties and how this addendum applies

This addendum is between the firm that holds an ifatools.ai account ("you") and Cervello Financial Planning ("we", "us" and "our"), which runs ifatools.ai.

It forms part of our Terms of Service and applies automatically when you accept them. If this addendum and the Terms of Service conflict on how personal data is handled, this addendum takes priority.

Words such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given to them in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and any other UK law about personal data that applies, as amended from time to time.

2. Our roles

• Data we process for you: for the personal data your firm enters into its account (team members' details and your firm profile) and the device records the apps create, your firm is the controller and we are the processor.
• Our own records: for our own account, billing, payment and invoice records, and for how we run and secure ifatools.ai, we are the controller. Our privacy notice covers that data, not this addendum.
• Your clients' files: we don't hold them. The apps process documents on your firm's computer and send them to the AI provider your firm chooses (Anthropic Claude or OpenAI ChatGPT), under your firm's own account. The meeting apps connect to Fireflies under your firm's own account. Those providers are not our sub-processors, and your firm's arrangements with them are between your firm and them.

3. Details of the processing

4. Our obligations as your processor

In line with UK GDPR Article 28(3), we will:

Act on your instructions

Process the personal data only on your documented instructions, including on transfers outside the UK, unless the law requires otherwise. If it does, we'll tell you first, unless the law prevents us. Your instructions are these terms, this addendum and the way you use your account and the apps. We'll tell you straight away if we think an instruction breaks data protection law.

Keep it confidential

Make sure everyone we authorise to process the personal data is bound by confidentiality.

Keep it secure

Take appropriate technical and organisational measures to protect the personal data, as UK GDPR Article 32 requires. These include encrypted connections, access limited to named members of our team who need it, and limits that stop automated attacks on sign-in.

Use sub-processors only with notice

You give us general permission to use the sub-processors listed below. We'll give you at least 30 days' notice by email before we add or replace a sub-processor that will process this personal data. You can object on reasonable data protection grounds within that time. If we can't resolve your objection, you can cancel your subscription before the change takes effect. We'll put a written contract in place with each sub-processor that gives the personal data the same level of protection as this addendum, and we remain responsible to you for what they do.

Help you with rights requests

Help you, as far as we reasonably can, to respond to people who use their data protection rights. Account holders can export their data and request deletion from their account's Security page. If we receive a request directly that relates to your firm's data, we'll pass it to you without undue delay and won't respond to it ourselves unless you ask us to.

Help with security, breaches and assessments

Help you meet your obligations under UK GDPR Articles 32 to 36, taking into account what we process and the information we have. That includes data protection impact assessments and any consultation with the regulator.

Tell you about breaches

Tell you without undue delay after we become aware of a personal data breach affecting this personal data. We'll give you the information we have that you need to meet your own obligations, and keep you updated as we find out more.

Delete or return it at the end

When your account closes, delete the personal data or, if you ask before then, return it to you. You can export it yourself from your account's Security page at any time. Device records are deleted when a computer is signed out or the account closes. Other account data is deleted within 12 months of the account closing, unless the law requires us to keep it.

Give you information and allow audits

Make available the information you reasonably need to show that we're meeting Article 28, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits must be on reasonable notice, during normal working hours and must protect the confidentiality of our other customers and our security.

5. Your obligations

As controller, your firm is responsible for having a lawful basis for the personal data it enters into its account, for telling the people involved how their data is used, and for making sure the details are accurate and limited to what's needed.

6. Transfers outside the UK

Some of our sub-processors, including Stripe and Google, may process personal data outside the UK. Where they do, we make sure the transfer is protected as UK GDPR Chapter V requires. That means the destination is covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework, for certified US companies), or the transfer uses an approved safeguard such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

7. Sub-processors

These are the service providers we use for ifatools.ai. Some only handle data that we control ourselves, and we list them here so you can see the full picture.

8. Liability and how long this addendum lasts

The limits on liability in our Terms of Service apply to this addendum, except where data protection law does not allow them to. This addendum lasts for as long as we process personal data on your firm's behalf.

9. Changes and law

We may update this addendum if the law or the way we process data changes. We'll tell you about significant changes in the same way as changes to our Terms of Service. This addendum is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

10. Contact

For anything about this addendum, email hello@ifatools.ai or write to us at the address above.