Data Processing Agreement

Roles

For the personal data of a firm's clients, the firm is the controller and TaxElita is the processor. TaxElita processes it only on the firm's documented instructions, which are given by using the service.

What TaxElita does

• Keeps the data confidential; only staff who need to, under confidentiality, can access systems, and they cannot open client records through the product.
• Protects it with encryption, separation between firms, access controls and logging.
• Uses only the listed sub-processors, under terms at least as protective, and gives notice before adding one.
• Helps the firm answer requests from its clients and authorities.
• Tells the firm without undue delay about a breach affecting its data.
• On closing, returns the data by export and then deletes it.

AI

When the firm turns on AI document reading, the content of the documents staff choose is sent to the AI provider to produce a suggestion, which a person checks. Providers process it to answer the request and are not allowed to use it to train models where they offer that choice.