Data processing agreement
This agreement applies whenever we process personal data on your behalf, and forms part of the terms. You are the controller and we are the processor.
1. What is being processed
| Subject matter | Matching payments against open items in your ledger and producing a journal. |
|---|---|
| Duration | As long as your account is open, plus the retention period below. |
| Nature and purpose | Reading, matching, storing and exporting the files and ledger extracts you provide. |
| Types of personal data | Chiefly the names of payers, where a bank statement carries them. Payment references, amounts, dates and document numbers, which may be linked to an individual. Names and email addresses of your own staff who use Kvitta. |
| Categories of data subject | Your customers, and your employees who use Kvitta. |
| Special categories | None. Kvitta is not designed to receive them and you should not send them. |
2. How little of it there is
Worth stating plainly, because it shapes the risk. Kvitta never matches on a person's name. Matching runs on references, amounts and dates. Payer names arrive only when a bank statement carries them, they are shown so a person can recognise a row that needs a decision, and nothing in the engine depends on them. Files from payment providers generally carry order references rather than names.
3. Our obligations
- Only on your instructions. We process personal data only as needed to provide the service and as you instruct. If we think an instruction breaks data protection law we will say so.
- Confidentiality. Everyone we let near it is bound to confidentiality.
- Security. The measures in section 7.
- Sub-processors. You give general authorisation for those listed on the sub-processors page. We give notice by email before adding or replacing one; you may object on reasonable data protection grounds, and if we cannot resolve it you may terminate the affected part of the service without penalty.
- Helping you. We will help you answer requests from data subjects, and help with impact assessments and consultations with the regulator, taking into account what we can see.
- Breaches. We will tell you without undue delay and in any case within 48 hours of becoming aware, with what we know and what we are doing.
- Deletion or return. On your request, or when the agreement ends, we delete or return the personal data, unless the law says we must keep it.
- Audits. We will give you the information you need to show compliance, and allow an audit on reasonable notice, no more than once a year unless a regulator or an incident requires it.
4. International transfers
Where a sub-processor is outside the EEA we rely on the European Commission's standard contractual clauses, together with any additional measures the transfer needs. The current location of every sub-processor is on the sub-processors page.
5. Retention
Uploaded files and match results are kept while your account is open so that a batch can be reopened, and deleted 90 days after account closure or on your earlier request. The audit trail is kept for seven years because it evidences accounting activity.
6. AI processing
Kvitta uses a large language model to draft matching rules and to explain why an entry did not settle. What is sent is the structure of your files and the shape of your references. The model never chooses which invoice a payment settles and never produces a figure in a journal. Data sent is not used to train models.
7. Security measures
- Encryption in transit (TLS 1.2 or better) and at rest.
- Sign-in through Microsoft work accounts. We hold no passwords.
- Access separated per organisation and per company, so one customer cannot reach another's data, and a person only reaches the companies they were granted.
- An append-only audit trail of the acts that leave the system.
- Least-privilege access for our own staff, granted for a reason and removed when it ends.
- Managed infrastructure with the provider's backup and recovery.
- Independent security reviews as the product matures; cadence published when a first test has been completed.
8. Liability
The liability provisions in the terms apply to this agreement too.