Data processing agreement

ReckonOS is provided by Digital Elixir Ltd, a company incorporated in Nigeria with the Corporate Affairs Commission (RC 1482355), whose address is Suite A2, Saham Plaza, Alexandria Crescent, Wuse II, Abuja, Nigeria (“ReckonOS”, “we”, “us”).

When your business puts personal data about clients, contractors and teammates into ReckonOS, your business is the controller and we process that data for you. This agreement covers that processing. It meets Article 28 of the EU GDPR and the UK GDPR and the processor duties in the Nigeria Data Protection Act 2023, and it forms part of the terms of service.

How to get a signed copy

The terms below apply to every workspace without signature. If you need a countersigned copy, email [email protected] with “DPA” in the subject, your company’s legal name and address, and your workspace name. We send this agreement back with the details filled in and signed for Digital Elixir Ltd.

1. What is processed

• Purpose: providing ReckonOS: invoicing, payment records, expenses, time, projects, tax estimates and the client portal.
• People concerned: your clients and their contacts, your contractors, and your team members.
• Types of data: names, business and email addresses, phone numbers, VAT and tax IDs (contractor tax IDs encrypted), invoice and payment details, receipt images, time entries and notes you write.
• Duration: for as long as your workspace exists, then as set out in section 7.

2. Your instructions

We process the data only to provide ReckonOS as you use and configure it, and on your other documented instructions, unless the law requires otherwise; in that case we tell you first unless the law forbids it.

3. Confidentiality

Everyone at ReckonOS who can access the data is bound to keep it confidential.

4. Security

We keep the measures described on the security page, including encryption of credentials and contractor tax IDs with AES-256-GCM, workspace isolation, two-step sign-in, role-based access and an audit log of changes.

5. Sub-processors

You authorise the sub-processors on the sub-processor list. We tell workspace admins before adding or replacing one, and you can object; if we cannot reasonably meet the objection, you can end the agreement and delete your workspace. We put the same data protection duties on each sub-processor and remain responsible for them.

6. Helping you

We help you answer requests from the people concerned: you can export the workspace and delete records yourself, and we assist with anything those tools do not cover. We also help with security, breach notification and data protection impact assessments as far as our role allows. We tell you without undue delay after we become aware of a personal data breach affecting your data.

7. At the end

You can download all workspace data at any time from Settings > Data. When you delete the workspace, it is erased 30 days later, as described in the privacy policy, unless the law requires us to keep a copy.

8. Audits

We give you the information needed to show we meet these duties, and allow and contribute to reasonable audits, with notice and at a time that does not disrupt the service.

9. International transfers

Where data leaves Nigeria, we rely on a basis the NDPA allows. Where data of people in the EU or UK is transferred to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (module 2 or 3) or the UK International Data Transfer Addendum apply between us, and are incorporated by reference.