Data Processing Agreement

Version 1.0 · August 2026 · Westbrook Receipts Limited trading as Acceptum

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Acceptum (the "Processor") and the customer ("Controller") and applies where Acceptum processes personal data on behalf of the customer in connection with the Acceptum service.

1. Definitions

In this DPA the following terms have the meanings given below:

"Controller" means the customer who determines the purposes and means of processing personal data
"Processor" means Westbrook Receipts Limited trading as Acceptum, which processes personal data on behalf of the Controller
"Personal Data" means any information relating to an identified or identifiable natural person
"Processing" means any operation performed on personal data including collection, storage, use, disclosure or deletion
"Data Protection Law" means the GDPR, the Data Protection Act 2018 and any applicable national implementing legislation
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council
"Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller

2. Scope and Purpose

This DPA applies to the processing of personal data by Acceptum in connection with providing the receipt capture, expense management and accounting integration service described in the Terms of Service.

Acceptum processes personal data only on documented instructions from the Controller, which are set out in Schedule 1 of this DPA and as updated from time to time through the customer's use of the service.

3. Processor Obligations

Acceptum shall, in relation to personal data processed on behalf of the Controller:

Process personal data only on documented instructions from the Controller
Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations
Implement appropriate technical and organisational security measures as described in Schedule 2
Not engage sub-processors without prior written authorisation from the Controller, except as listed in Schedule 3
Assist the Controller in responding to requests from data subjects exercising their rights under Data Protection Law
Assist the Controller in ensuring compliance with obligations relating to security, breach notification and data protection impact assessments
Delete or return all personal data to the Controller upon termination of the service, at the Controller's choice
Make available to the Controller all information necessary to demonstrate compliance with this DPA
Notify the Controller without undue delay upon becoming aware of a personal data breach

4. Controller Obligations

The Controller shall:

Ensure there is a lawful basis for processing personal data through the Acceptum service
Provide appropriate privacy notices to data subjects whose data is processed through the service
Ensure that any instructions given to Acceptum comply with Data Protection Law
Be responsible for the accuracy and legality of personal data uploaded to the service

5. Sub-processors

The Controller grants general authorisation to Acceptum to engage the sub-processors listed in Schedule 3. Acceptum will notify the Controller of any intended changes to sub-processors by updating Schedule 3 and providing at least 30 days notice before any new sub-processor begins processing personal data.

Acceptum shall impose data protection obligations on sub-processors that are equivalent to those set out in this DPA.

6. International Transfers

Personal data is stored and processed within the European Economic Area (EEA). Where any transfer of personal data to a country outside the EEA is required, Acceptum will ensure that appropriate safeguards are in place in accordance with Data Protection Law, including Standard Contractual Clauses where applicable.

7. Security

Acceptum implements and maintains the technical and organisational security measures described in Schedule 2, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

8. Data Breach Notification

In the event of a personal data breach affecting data processed under this DPA, Acceptum will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include, to the extent available:

A description of the nature of the breach
The categories and approximate number of data subjects affected
The categories and approximate number of personal data records affected
The likely consequences of the breach
The measures taken or proposed to address the breach

9. Data Subject Rights

Acceptum will assist the Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under Data Protection Law, including rights of access, rectification, erasure, restriction, portability and objection. Where Acceptum receives a request directly from a data subject, it will forward the request to the Controller without undue delay.

10. Audit Rights

Acceptum will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. Acceptum will allow for and contribute to audits conducted by the Controller or a mandated auditor, subject to reasonable notice and agreement on scope and confidentiality.

11. Term and Termination

This DPA remains in force for the duration of the Terms of Service. Upon termination, Acceptum will, at the Controller's election, delete or return all personal data processed under this DPA within 30 days, unless applicable law requires continued storage.

12. Governing Law

This DPA is governed by the laws of Ireland and is subject to the exclusive jurisdiction of the Irish courts.

13. Contact

For any queries relating to this DPA please contact hello@acceptum.app.

SCHEDULE 1 — Details of Processing

Item	Details
Subject matter	Receipt capture, expense management and accounting integration
Duration	For the term of the customer's subscription to Acceptum
Nature of processing	Collection, storage, analysis, categorisation, export and deletion of receipt and expense data
Purpose of processing	To provide the Acceptum receipt management and accounting integration service
Types of personal data	Email addresses, business names, receipt images, transaction amounts, merchant names, expense categories, VAT amounts, dates
Categories of data subjects	The Controller's employees, owners and any individuals whose receipts are processed through the service

SCHEDULE 2 — Technical and Organisational Security Measures

Encryption of personal data in transit using TLS 1.2 or higher
Encryption of personal data at rest using AES-256
Row-level security ensuring users can only access their own data
Secure authentication with password hashing using bcrypt
Access controls limiting employee access to personal data on a need-to-know basis
Regular security updates and patch management
Data stored within the European Economic Area (Frankfurt, Germany)
Incident response procedures including breach notification protocols
Regular backups of personal data

SCHEDULE 3 — Authorised Sub-processors

Sub-processor	Purpose	Location
Supabase Inc.	Database, authentication and file storage	EU (Frankfurt, Germany)
Anthropic PBC	AI analysis of receipt images	United States (SCCs in place)
Xero Limited	Accounting software integration (where enabled by customer)	New Zealand / EU