Data Processing Agreement

Version 1.1 · Effective from 10 October 2026

Previous versions

This Data Processing Agreement ("DPA") forms part of the Tuppin Terms of Service between TUPPIN LTD (company number 17469830, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ) and you. It applies whenever we process personal data on your behalf, and it exists to meet Article 28 of the UK GDPR.

You do not need to sign it. Accepting the Terms of Service accepts this DPA. If you need a signed copy for your own records, email legal@tuppin.uk.

Words defined in the Terms of Service have the same meaning here.

1. Definitions and roles

  1. Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any legislation replacing or amending them.
  2. Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the UK GDPR. The supervisory authority for this DPA is the Information Commissioner's Office (ICO).
  3. Customer Personal Data means personal data contained in Your Data that we process on your behalf under the Terms of Service.
  4. Sub-processor means any third party we engage to process Customer Personal Data.
  5. The roles are split as follows:
    1. For Customer Personal Data — information about your clients, customers, suppliers, employees and other third parties that you put into Tuppin — you are the controller and we are the processor.
    2. For your own account data — your name, email address, sign-in records, billing details and support correspondence — we are the controller, and our Privacy Policy governs that processing, not this DPA.
  6. Each of us is responsible for our own compliance with Data Protection Law in the role we hold.

2. Scope and your instructions

  1. We process Customer Personal Data only on your documented instructions, including in relation to transfers outside the United Kingdom, unless Data Protection Law requires otherwise. If it does, we will tell you before processing unless the law forbids us from doing so.
  2. Your instructions are: the Terms of Service, this DPA, the settings and actions you take within Tuppin, and any further written instruction you give us and we accept.
  3. Annex A sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject.
  4. We will tell you if, in our opinion, an instruction infringes Data Protection Law. We may decline to act on it until it is resolved.
  5. We will not sell Customer Personal Data, use it for our own marketing, or use it to train artificial intelligence models, whether ours or a third party's.
  6. You confirm that you have a lawful basis for the personal data you put into Tuppin, that you have given the necessary privacy information to the data subjects, and that your instructions to us comply with Data Protection Law.

3. Our obligations as processor

We will:

  1. process Customer Personal Data only as set out in clause 2;
  2. put in place and maintain the security measures described in clause 5 and Annex B;
  3. engage Sub-processors only as set out in clause 6;
  4. assist you as set out in clauses 7 and 8;
  5. delete or return Customer Personal Data as set out in clause 10;
  6. make available the information you reasonably need to demonstrate our compliance with Article 28, as set out in clause 11; and
  7. keep a record of the categories of processing we carry out on your behalf, as Article 30(2) requires.

4. Confidentiality

  1. We limit access to Customer Personal Data to those people who need it to provide or support Tuppin.
  2. Everyone with such access is bound by a duty of confidentiality, whether by contract of employment, a written confidentiality undertaking, or a statutory obligation.
  3. We keep a record of who has access and review it every six months, removing access that is no longer needed. We also revoke access promptly when a person's or a service's involvement ends, rather than waiting for the next review.

5. Security

  1. Taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects, we implement appropriate technical and organisational measures under Article 32. Annex B describes them.
  2. We review those measures at least annually and after any material change to Tuppin or to the risks it faces. We may update Annex B, provided the level of protection is not reduced.
  3. You are responsible for the security decisions within your own control: keeping your sign-in email secure, choosing who you give Agent access to, and removing access you no longer want.

6. Sub-processors

  1. You give us general authorisation to engage Sub-processors. Those engaged at the date of this DPA are listed in Annex C and at tuppin.uk/subprocessors.
  2. Before we add or replace a Sub-processor, we will give you at least 30 days' notice by email and by updating that page. Where a Sub-processor must be replaced urgently, for example after a security incident or a provider failure, we will give notice as soon as we reasonably can.
  3. You may object on reasonable data protection grounds within 14 days of the notice. We will work with you to find a solution. If we cannot, you may terminate your Account without penalty and receive a pro-rata refund of any prepaid fees for the period after termination.
  4. We impose on each Sub-processor data protection obligations no less protective than those in this DPA.
  5. We remain fully liable to you for the performance of each Sub-processor's obligations.

7. Assisting you

  1. Data subject rights. Tuppin's export, edit and delete functions are designed so that you can answer most access, rectification, erasure and portability requests yourself. Where a request cannot be handled through those functions, we will give you reasonable assistance, taking account of the nature of the processing and the information available to us.
  2. If a data subject contacts us directly about Customer Personal Data, we will not respond substantively. We will tell them to contact you and, where we can identify you, let you know without undue delay and in any event within ten business days.
  3. Impact assessments. We will give you reasonable assistance with data protection impact assessments and any prior consultation with the ICO, to the extent they relate to our processing and the information is available to us.
  4. Assistance under this clause is free of charge where the request is straightforward. For requests that need significant engineering work, we may charge at our standard hourly rate, told to you before we start.

8. Personal data breaches

  1. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
  2. The notification will describe, so far as we know at the time: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, the measures we have taken or propose to take, and a contact point for more information. Where we cannot provide all of it at once, we will provide it in stages without further undue delay.
  3. Reporting the breach to the ICO and, where required, to affected data subjects is your responsibility as controller. We will give you reasonable assistance.
  4. We will not make any public statement identifying you in connection with a breach without your prior written consent, unless the law requires it.

9. International transfers

  1. Customer Personal Data is stored in the United Kingdom.
  2. Some Sub-processors may process Customer Personal Data outside the United Kingdom. Annex C states the location for each.
  3. Where we transfer Customer Personal Data outside the United Kingdom, we will do so only where one of the following applies: the destination is covered by UK adequacy regulations; the International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum are in place; or another lawful transfer mechanism applies.
  4. We will carry out and keep under review a transfer risk assessment where one is required, and provide it to you on request.

10. Deletion and return

  1. You can export Customer Personal Data at any time while your Account is open, in the formats Tuppin provides.
  2. On termination, clause 16 of the Terms of Service applies: we keep the data for 30 days so you can export it, then delete it from our live systems within 30 days, with backups cycling out within a further 10 days.
  3. At your written request during the retention window we will delete Customer Personal Data earlier.
  4. We may retain Customer Personal Data to the extent required by law. Anything retained stays subject to this DPA for as long as we hold it.

11. Audit and information

  1. On written request, and no more than once a year unless a personal data breach or a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with Article 28 — a description of our security measures, our Sub-processor list, and answers to a reasonable security questionnaire.
  2. Where that information is not enough, you or an auditor you appoint may audit our processing. Audits are at your cost, on at least 30 days' written notice, during business hours, no more than once a year, and must not disrupt the Service or risk the confidentiality of other customers' data. Audits are carried out remotely unless we agree otherwise in writing.
  3. Any auditor must sign a confidentiality undertaking before the audit begins.
  4. Where we hold a current third-party certification or report covering the subject of the audit, providing it satisfies this clause.

12. General

  1. Liability. The limitations and exclusions in clause 14 of the Terms of Service apply to claims under this DPA, except where Data Protection Law does not permit them.
  2. Precedence. If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails.
  3. Duration. This DPA applies for as long as we process Customer Personal Data on your behalf, and its terms survive termination of the Terms of Service for as long as any such data remains in our possession.
  4. Changes. We may update this DPA where Data Protection Law, regulatory guidance or our processing changes. Material changes get at least 30 days' notice by email and in the app, and we will keep previous versions available at tuppin.uk/dpa/archive.
  5. Severability. If any provision is held unenforceable, the rest continues to apply.
  6. Governing law. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
  7. Contact. Data protection queries go to legal@tuppin.uk.

Annex A — Details of the processing
Subject matter Provision of the Tuppin bookkeeping service under the Terms of Service.
Duration For as long as your Account is open, plus the retention periods in clause 10.
Nature of the processing Collection, recording, organisation, structuring, storage, retrieval, adaptation, backup, transmission and erasure, by automated means.
Purpose Recording and categorising your business income and expenses, producing summaries and figures for MTD for Income Tax, and providing support.
Types of personal data Names; trading names; contact details including email addresses, telephone numbers and postal addresses; transaction descriptions, amounts and dates; invoice and receipt contents; payment references and bank details where you record them; any other personal data you choose to enter in free-text fields or attached documents.
Special category data None is required by Tuppin. You should not enter special category data. If you do, you remain responsible for having an Article 9 condition for it.
Categories of data subject Your customers and clients; your suppliers and contractors; your employees where you record payments to them; any other individual you record a transaction with.
Frequency Continuous, for as long as you use Tuppin.

Annex B — Technical and organisational measures

Encryption

  • Data in transit is encrypted using TLS 1.2 or higher.
  • Data at rest is encrypted by the database provider, using AES-256.

Access control

  • Sign-in uses one-time links sent to a verified email address; no shared passwords.
  • Administrative access to production systems is limited to named individuals and protected by multi-factor authentication.
  • Access rights are reviewed every six months and revoked promptly when no longer needed.
  • Each customer's data is logically separated, so one customer cannot access another's records.

Resilience and recovery

  • Our database provider takes continuous backups, giving a rolling 7-day point-in-time recovery window.
  • Restore procedures are tested annually.
  • Recovery point objective: 1 hour. Instant restore reaches any point in the 7-day history window with millisecond granularity, so actual loss should be far smaller.
  • Recovery time objective: 24 hours. The restore completes in seconds and does not change connection details; the objective allows for detection and response outside working hours.

Development and change control

  • Changes are version-controlled and reviewed before release.
  • Dependencies are monitored for known vulnerabilities and patched within 30 days for high severity.
  • Production data is not used in development or test environments.

Monitoring and governance

  • Application and infrastructure logs are retained for 30 days.
  • A documented incident response process covers detection, containment, notification and review.
  • Sub-processors are assessed for security before engagement and reviewed annually.

Annex C — Sub-processors

Sub-processor Purpose Location of processing
Neon Database hosting and storage of Your Data United Kingdom
Vercel Application hosting and delivery United Kingdom
Brevo Transactional and notification email European Union (France, Germany and Belgium)
Cloudflare DNS, network protection and inbound email routing Global (Cloudflare anycast network); Cloudflare, Inc. is US-incorporated and transfers run under its DPA with the UK Addendum

Only providers that process Customer Personal Data appear here, as clause 1.4 defines them. Our payment processor, Stripe, is not one: it handles your billing details, for which we are the controller under clause 1.5, and never receives Your Data.

The location column states where processing takes place. Some providers are incorporated outside the United Kingdom and may access data from their home jurisdiction, typically for support or engineering purposes. Clause 9.3 governs those transfers.