Data Processing Agreement — FinBaze

Status: Published
Version: 2026-09-29
Last updated: 29 September 2026

This Data Processing Agreement (DPA) forms part of the agreement for the FinBaze service between the customer identified in the applicable subscription or order form (Customer) and:

• FinBaze B.V., KvK 94934169, where FinBaze B.V. is the Customer's contracting entity; or
• FinBaze Limited, company number 16303685, where FinBaze Limited is the Customer's contracting entity,

in each case referred to as FinBaze.

The Customer is the controller and FinBaze is the processor of personal data contained in Customer Data. Where the Customer is itself a processor, FinBaze acts as its sub-processor and references to controller instructions include the relevant controller's lawful instructions.

---

1. Scope and priority

1. This DPA applies where FinBaze processes personal data in Customer Data on behalf of the Customer.
2. It is intended to satisfy Article 28 GDPR and Article 28 UK GDPR.
3. If this DPA conflicts with the Terms regarding personal-data processing, this DPA prevails.
4. The definitions in the GDPR or UK GDPR apply as relevant. Terms means FinBaze's applicable terms at /terms.

2. Processing details

3. Customer instructions and obligations

1. FinBaze will process personal data only on documented instructions from the Customer, including instructions given through use and configuration of the Service, unless applicable law requires otherwise.
2. The Customer instructs FinBaze to:
   • provide, secure, support and maintain the Service;
   • use the sub-processors and integrations described in the Privacy Policy;
   • transfer data as permitted by this DPA; and
   • process Customer Data to evaluate, improve and train FinBaze's own models and product features, subject to applicable law and the safeguards in the Privacy Policy.
3. FinBaze will inform the Customer if it believes an instruction infringes applicable data-protection law.
4. The Customer is responsible for:
   • having a lawful basis for the processing;
   • providing required privacy notices;
   • obtaining required consents;
   • ensuring its instructions and Customer Data are lawful, relevant and accurate;
   • handling its relationship with data subjects and any controller for which it acts; and
   • not providing children's data or unnecessary special-category data.

4. Confidentiality

FinBaze will ensure that persons authorised to process Customer Data are subject to confidentiality obligations and receive access only where needed for their duties.

5. Security

FinBaze will maintain measures appropriate to the risk, including:

• encryption in transit and at rest;
• hosting in France within the European Union;
• logical separation of customer environments;
• role-based access control and restricted administrative access;
• access, infrastructure and administrative logging;
• backup, recovery and availability measures;
• vulnerability, dependency and incident management measures;
• personnel confidentiality and access-management procedures; and
• periodic review of relevant safeguards.

Backups may be retained for up to three years and are restricted to continuity, recovery, security and legal purposes.

6. Sub-processors

1. The Customer gives general authorisation for FinBaze to use sub-processors.
2. The current list is published in the Privacy Policy and is incorporated into this DPA.
3. FinBaze will require sub-processors to provide data-protection obligations materially equivalent to those applicable to FinBaze.
4. FinBaze remains responsible for its sub-processors to the extent required by applicable law.
5. FinBaze will provide reasonable advance notice of a material new sub-processor, including by updating the Privacy Policy or notifying the Customer.
6. The Customer may object within 15 days on reasonable data-protection grounds. The parties will work in good faith on a reasonable solution. If none is available, either party may terminate the affected feature or Service without penalty for future, unused service.
7. Providers or recipients selected directly by the Customer, including external AI hosts, customer email providers, payment providers and shops, are used on the Customer's instruction. The Customer is responsible for its separate agreement with them.

7. International transfers

FinBaze may transfer personal data internationally where needed to provide the Service. Where applicable law requires a transfer mechanism, the parties will rely on:

• an adequacy decision or regulation;
• the European Commission Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum; or
• another lawful mechanism.

The relevant controller-to-processor or processor-to-processor module applies. This DPA constitutes the parties' instruction and authorisation to implement the applicable mechanism and supplementary measures.

8. Data-subject requests

1. Taking account of the nature of the processing, FinBaze will provide reasonable assistance for requests concerning access, correction, deletion, restriction, portability or objection.
2. If FinBaze receives a request relating to Customer Data, it will refer the requester to the Customer or notify the Customer unless prohibited by law.
3. FinBaze is not required to respond substantively on the Customer's behalf unless agreed. Reasonable costs may be charged for exceptional or disproportionate assistance.

9. Compliance assistance

Taking account of the nature of processing and information available to it, FinBaze will provide reasonable assistance with:

• security obligations;
• personal-data-breach assessments and notifications;
• data-protection impact assessments; and
• prior consultation with a supervisory authority.

10. Personal-data breaches

FinBaze will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data.

The notification will include available information about the nature of the breach, affected data and persons, likely consequences, mitigation and a contact point. FinBaze may provide information in phases as it becomes available.

Notification does not constitute an admission of fault or liability.

11. Deletion and return

1. During the Agreement, the Customer may use available export functions or request reasonable assistance with return of Customer Data.
2. After termination, FinBaze will delete or return Customer Data at the Customer's choice, unless law requires retention.
3. Data may first be made inaccessible or soft-deleted. Soft-deleted operational records that are not required for bookkeeping, tax or similar statutory archives may be purged from active systems after about one month. Remaining Customer Data will be purged from active systems no later than one year after termination, unless law or the Customer's instructions require longer retention.
4. Access-restricted backup copies may remain for the backup lifecycle of up to three years and will not be used for ordinary processing.
5. Where the Customer or its client has statutory bookkeeping, tax or payroll-administration obligations, retention may be longer on the Customer's instructions. Dutch bookkeeping records, for example, may need to be retained for seven years. Soft-deleted bookkeeping and tax records are not purged on the one-month operational schedule.
6. FinBaze may retain information needed for its own legal claims, security records and statutory administration as an independent controller.

12. Information and audits

1. FinBaze will make information reasonably necessary to demonstrate compliance with this DPA available to the Customer.
2. The Customer must first use documentation, questionnaires and remote review.
3. A further audit may be conducted no more than once per year, on at least 30 days' notice, during normal business hours and without unreasonable disruption.
4. Additional audits are permitted where required by a supervisory authority or where credible evidence indicates a material breach.
5. Auditors must be independent, suitably qualified, non-competitive and bound by confidentiality.
6. The Customer bears its audit costs and FinBaze may charge reasonable costs for assistance, unless the audit identifies a material breach by FinBaze.

13. Liability

Liability under this DPA is subject to the exclusions and limitations in the Terms. Without expanding any liability under the Terms, the applicable aggregate cap is the fees paid or payable for the two months preceding the event giving rise to liability. If the Customer is using a free trial and has paid no fees, no monetary liability arises except where liability cannot lawfully be excluded.

Nothing excludes liability that applicable law does not permit the parties to exclude.

14. Term and termination

This DPA starts when the Agreement starts or when FinBaze first processes Customer Data as processor, whichever is earlier. It continues until FinBaze has completed processing in accordance with this DPA.

15. Governing law

• If the contracting entity is FinBaze B.V., this DPA is governed by Dutch law and the courts of Amsterdam, the Netherlands, have exclusive jurisdiction.
• If the contracting entity is FinBaze Limited, this DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.

16. Contact

Privacy and DPA enquiries: info@finbaze.com