Data Processing Addendum

This Addendum applies when an organisation (“Customer”) uses AccountFUN to process personal data on its behalf. “AccountFUN” means XOMG Limited, 50 Bonham Strand, Sheung Wan, Hong Kong. It supplements the Terms of Service and Privacy Policy. For processing covered by this Addendum, its data-protection provisions prevail over conflicting general Terms. A separately signed customer data-processing agreement controls where applicable. Mandatory privacy law and any applicable standard contractual clauses are not displaced by the Terms’ governing-law or liability provisions.

1. Roles, scope and instructions

The Customer is the controller of personal data in its User Data, or a processor acting on its own controller’s authority; AccountFUN is its processor or subprocessor respectively. The Customer determines the purposes, data submitted, authorised users and instructions, and is responsible for lawful collection, notices, permissions and its authority to give those instructions. AccountFUN acts separately as controller for its own account administration, subscription billing, security and legal records as described in the Privacy Policy.

• Subject matter and purpose: providing the Customer’s bookkeeping service, including imports, reconciliation, invoices, bills, reporting, storage, support, export and recovery.
• Nature of processing: receiving, organising, storing, retrieving, calculating, transmitting through enabled features, backing up, returning and deleting data.
• Duration: while the Customer instructs AccountFUN to retain and process the data, followed by return or deletion under section 6.
• People concerned: the Customer’s users, customers, suppliers, employees, contractors and other people identified in its bookkeeping records.
• Data types: names, contact details, business identifiers, transaction and bank-feed details, invoice and payment information, tax identifiers, and personal data in uploaded documents and correspondence. The Customer should minimise sensitive information and provide it only where necessary and lawful.

AccountFUN processes this data only on documented instructions in the agreement, the Customer’s configuration and authorised requests, including instructions about international transfers. If law requires other processing, AccountFUN will inform the Customer before processing unless legally prohibited. AccountFUN will inform the Customer immediately if, in its opinion, an instruction infringes applicable data-protection law.

2. Confidentiality and security

AccountFUN restricts access to authorised personnel subject to confidentiality obligations and maintains technical and organisational measures appropriate to the risk, including access control, encryption, logging, backups, recovery, incident response and assessment of safeguards. Where applicable, these measures must meet Article 32 of the EU or UK GDPR. Our security page summarises the controls; further relevant information is available on request.

3. Subprocessors and customer-directed connections

The Customer gives general written authorisation for subprocessors used to provide the agreed Service. AccountFUN may add or replace subprocessors and will make their identities, functions and processing locations available on request. Advance notice, an opportunity to object, or specific approval will be provided where required by applicable law or a separately signed customer agreement, in accordance with those requirements. Where an objection right applies, the parties will work to resolve a data-protection objection; if they cannot, the Customer may stop using the affected processing and request return or deletion of its data. This Addendum does not create an additional advance-notice or approval requirement for other changes.

AccountFUN will bind each subprocessor by written obligations offering the same level of data protection required by this Addendum and remains responsible to the Customer for the subprocessor’s performance. A provider acting as an independent controller for a customer-directed connection, such as a bank-feed or payment service, has responsibilities under its own applicable terms; it is not automatically an AccountFUN subprocessor for all its activities.

4. Assistance and personal data breaches

Taking account of the processing and information available, AccountFUN will assist the Customer through appropriate measures with individual rights requests, security, breach notifications, impact assessments and prior consultation with authorities. Requests about the Customer’s data will be referred to the Customer unless law requires otherwise.

AccountFUN will notify the Customer without undue delay after becoming aware of a personal data breach affecting its User Data. The notice will describe the nature of the breach, affected data and people where known, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in phases as it becomes available. The Customer remains responsible for its own regulatory and individual notifications; this does not remove AccountFUN’s independent legal duties.

5. International transfers

The current production application and database are hosted by OVHcloud in the United States. Live files and recovery backups use Cloudflare R2 buckets with the United States jurisdiction restriction. These storage arrangements do not restrict all processing or access to the United States: AccountFUN operates from Hong Kong, Cloudflare edge services operate globally, and other service providers and customer-directed connections may process data elsewhere.

The Service may use storage and processing locations in different countries, and these locations may change. No exclusive country-of-storage or processing commitment applies unless required by applicable law or expressly agreed in writing. Location changes remain subject to the Customer’s documented instructions, applicable law, agreed transfer safeguards and any applicable notice, objection or approval requirements.

AccountFUN will process data internationally only under documented instructions and applicable law. Before a restricted transfer, the parties must establish an applicable adequacy decision or valid transfer safeguards, including completed EU Standard Contractual Clauses and the UK addendum or International Data Transfer Agreement where needed, and assess supplementary measures. This public Addendum does not itself execute those instruments or represent that a particular transfer arrangement has been completed. Contact AccountFUN to confirm the arrangements required for your processing.

6. Return and deletion

At the end of the processing services, AccountFUN will, at the Customer’s choice, return or delete the personal data and delete existing copies unless applicable law requires retention. The Customer can export and request deletion through the Service or support. Subscription cancellation alone does not instruct deletion; the Customer must specify whether its organisation should remain available or be deleted.

Recovery copies are restricted from ordinary use and expire on the schedule in the Privacy Policy, including monthly database archives retained for about 12 months. These safeguards continue until deletion. If recovery requires restoring a backup, completed deletions must be reapplied. Data retained because of a legal requirement is limited to that purpose and protected until its retention requirement ends.

7. Demonstrating compliance

AccountFUN will make information necessary to demonstrate compliance with its applicable processor obligations available to the Customer. Routine assurance requests will normally be addressed through relevant certification details, security documentation and available independent assessment reports, subject to appropriate confidentiality arrangements. Where applicable law permits, an assessment by an independent qualified assessor and the resulting report may be used to satisfy an assessment requirement.

Additional assessments, audits or inspections will be supported where required by applicable law or separately agreed in writing. The parties will coordinate reasonable notice, scope, confidentiality and safeguards for service security and other customers’ information. A request does not itself authorise access to production systems, source code, credentials or other customers’ data, or authorise scanning or penetration testing. Any access or testing must be specifically authorised or legally required. These arrangements do not restrict mandatory verification or audit rights, required disclosures, or the powers of a competent authority, and an ISO certificate does not replace an assessment required by applicable law.

8. Contact

Data-protection requests, subprocessor information, objections and audit requests: support [at] accountfun [dot] com, XOMG Limited, 50 Bonham Strand, Sheung Wan, Hong Kong.