Data Processing Agreement (DPA)

The Controller is the company whose workspace the personal data belongs to. BankConnector processes personal data in Customer Data as Processor, on the Controller's behalf.

For Usage Data (technical logs, server error reports, metrics, requests for our service status, and de-identified aggregated data), BankConnector is an independent controller for the purposes of service operation, security, fraud and abuse prevention, and service improvement, as described in the Agreement. This includes technical facts about banks' file formats and behaviour that BankConnector observes while processing (for example which format variant a bank accepts); these carry no personal data and no attribution to the Controller, and BankConnector uses them to improve bank coverage for all customers.

Platforms and partners. Where the Controller's access is provided through a Platform, or where the Controller has chosen a BankConnector partner (Customer Agreement, Section 3.4), that Platform's or partner's access to the Controller's data takes place on the Controller's authorisation and under the Controller's own agreement with it. Making the data available to the Platform or partner is processing on the Controller's documented instruction; neither is a subprocessor of BankConnector.

Instructions. BankConnector processes personal data only on the Controller's documented instructions (the Agreement, this DPA, and the Controller's configuration and use of the Services), unless required by EU or Member State law, in which case BankConnector informs the Controller before processing unless that law prohibits it. BankConnector will inform the Controller if, in its opinion, an instruction infringes the GDPR.

Confidentiality. Persons authorised to process personal data are bound by confidentiality obligations and receive access only as needed for their role.

Security. BankConnector implements the technical and organisational measures in Annex II and the Security Policy, including field-level encryption at rest, TLS in transit, tenant isolation enforced at the database layer, role-based access control, multi-factor authentication, and a tamper-evident audit trail. Measures may be updated provided the overall level of protection is not materially reduced.

Assistance. Taking into account the nature of processing, BankConnector assists the Controller with appropriate technical and organisational measures in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection), through the built-in export and erasure functions; assistance beyond those functions is provided at BankConnector's then-current rates; and, insofar as information is available to BankConnector, with the Controller's obligations under Articles 32–36 GDPR (security, breach notification, DPIAs, prior consultation).

Personal-data breach. BankConnector notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Customer Data, providing (as information becomes available) the nature of the breach, categories and approximate numbers of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. BankConnector documents breaches and remediation.

Deletion and return. During the term, the Controller can export payment and statement records using the export functions in the Services. During the term, records are deleted on the retention schedule in the Service Description. After termination and the wind-down period, BankConnector deletes or anonymises personal data in Customer Data within a reasonable time, except: audit-trail and approval records, which BankConnector keeps for 5 years from their creation; copies in backups, which expire on the backups' normal cycle; data that EU or Member State law requires BankConnector to keep; and data under a legal hold. For audit-trail and approval records kept after termination, BankConnector acts as an independent controller, on the basis of its legitimate interest (Article 6(1)(f) GDPR) in documenting payment instructions and approvals and in establishing, exercising or defending legal claims, and deletes them 5 years after they were created.

Audits. BankConnector makes available the information reasonably necessary to demonstrate compliance with Article 28, including summaries of security assessments and any certification reports BankConnector holds (available on request under confidentiality), and allows and contributes to audits. Audits beyond documentation review (including on-site inspections) are limited to once per 12 months, on at least 30 days' notice, during business hours, at the Controller's cost, under confidentiality, and must not compromise the security or data of other customers; an additional audit is permitted where required by a supervisory authority or following a material breach.

The Controller gives a general authorisation for BankConnector to use subprocessors. The current list is Annex III, kept up to date at bankconnector.com/legal. BankConnector notifies the Controller by email or in the Services before a new subprocessor starts processing Customer Data: at least 14 days before, or, where an urgent replacement is needed for security or continuity of the Services, as early as possible and in any case before it starts. The Controller may object on reasonable data-protection grounds within 14 days of the notice; if the parties cannot resolve the objection, the Controller's remedy is to terminate the affected Services.

BankConnector imposes data-protection obligations on subprocessors equivalent to this DPA and remains fully liable for their performance.

This DPA lasts as long as BankConnector processes personal data in Customer Data. Liability under this DPA is subject to the Agreement's liability provisions. This DPA is governed by the law and venue of the Agreement.