These processing terms form part of your agreement with us where you use QuarterLink to process personal data on behalf of clients. The customer is the controller, or a processor authorised by the controller; Haetora Software Ltd is the processor or subprocessor for those client records. The customer is responsible for a lawful basis, accurate privacy information, authority to instruct us and the accuracy of supplied records. Our separate controller activities are described in the Privacy notice.
The subject matter is the provision of the QuarterLink workspace and supported spreadsheet and HMRC workflows for the duration of your service and any instructed return or deletion period. Processing includes receiving, organising, storing, retrieving, checking, transmitting, exporting and deleting client records. Data subjects include taxpayers, clients, authorised users and people identified in their business records. Data includes names, contact details, taxpayer and business identifiers, income and expense records, spreadsheets, HMRC correspondence and workflow evidence. Do not upload special-category or criminal-offence information unless separately agreed and necessary for an authorised purpose.
We process client records only on your documented instructions, including instructions about international transfers, unless UK law requires otherwise. We will inform you of that requirement before processing unless the law prohibits us from doing so. Your authorised use of account functions constitutes an instruction within the agreed service. We will inform you immediately if we consider an instruction to infringe applicable data-protection law.
We require people authorised to handle client records to be subject to confidentiality obligations. We maintain technical and organisational measures appropriate to the risk, including access controls, encryption of sensitive identifiers and tokens, upload checks and recorded support access described on our Security page. We assist with security obligations, data-protection impact assessments and prior consultation, taking account of the information available to us and the nature of the processing.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting their client records. We provide available information about its nature, affected records, likely consequences and mitigation, with further information in phases where necessary. We assist the customer with rights requests and regulatory or data-subject notifications; we do not independently determine a client's request unless the law requires it.
At the end of the processing service, we return or delete client data at the customer's choice and delete copies unless UK law requires retention. Retained data remains protected and is used only for the required purpose. Contact [email protected] to arrange export, return or deletion; stopping a subscription alone does not give an instruction to delete records. We identify any legal retention requirement and its scope rather than treating every record as a tax record.
We make information needed to demonstrate compliance available to the customer and allow and contribute to audits and inspections by the customer or an authorised auditor, with reasonable arrangements to protect other customers' information and service security. These arrangements do not prevent a legally required audit. Nothing in these terms removes either party's direct obligations under data-protection law.