Data Processing Agreement (DPA)

Last Updated: June 15, 2026

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between 4042 Solutions Group LLC, trading as PlatformTaxHub ("Processor," "we," "us"), and the accounting firm, bookkeeping practice, or business entity subscribing to our firm plan ("Controller," "you," "your").

This DPA applies where you use PlatformTaxHub to process personal data of your clients ("Data Subjects") and governs our obligations as a data processor acting on your behalf.

This DPA is governed by the UK GDPR, the UK Data Protection and Digital Information Act 2024 (DPDI Act), the EU GDPR, and applicable data protection legislation in the jurisdictions where you and your clients operate.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person processed through the PlatformTaxHub platform.
• Processing: Any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• Sub-processor: Any third party engaged by us to process Personal Data on your behalf.
• Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

3. Scope of Processing

We process Personal Data solely for the purpose of providing the PlatformTaxHub service to your clients, including:

• Income and expense record storage and aggregation
• Tax estimation calculations
• Compliance scoring and filing readiness assessments
• Bank statement reconciliation
• Financial report generation
• AI-assisted categorisation and recommendations

Categories of Data Subjects

• Your clients (platform earners, freelancers, gig workers, creators, online sellers)

Types of Personal Data Processed

• Identity data: name, business name, email address
• Financial data: income records, expense records, platform payout data, bank statement transactions
• Tax identifiers: VAT numbers, UTRs, TINs, SSNs, RC numbers
• Technical data: IP addresses, session tokens, usage logs

Duration of Processing

Processing continues for the duration of your subscription. Upon termination, data is handled per Section 10.

4. Controller Obligations

You confirm that:

• You have a lawful basis to share your clients' Personal Data with us (typically contractual necessity or legitimate interest in providing accounting services)
• You have provided appropriate privacy notices to your clients informing them that PlatformTaxHub processes their data on your behalf
• You will not instruct us to process data in a manner that would violate applicable data protection law

5. Processor Obligations

We shall:

• Process Personal Data only on your documented instructions, unless required by law
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see Section 6)
• Not engage another processor without your prior written authorisation (see Section 7)
• Assist you in responding to Data Subject rights requests where technically feasible
• Assist you in ensuring compliance with obligations relating to security, breach notification, and data protection impact assessments
• Delete or return all Personal Data upon termination of the agreement, at your choice (see Section 10)
• Make available all information necessary to demonstrate compliance and allow for audits

6. Security Measures

We implement the following technical and organisational measures:

• Encryption: AES-256 at rest, TLS 1.2+ in transit
• Access Control: Role-based access, principle of least privilege, multi-factor authentication for staff
• Infrastructure: Hosted on SOC 2 Type II compliant infrastructure (AWS/Vercel)
• Network Security: Private database networks, firewall protection, DDoS mitigation
• Monitoring: Automated intrusion detection, access logging, anomaly alerting
• Staff: Background checks, confidentiality agreements, annual security training
• Business Continuity: Automated backups, disaster recovery procedures, 99.9% uptime SLA

7. Sub-processors

We use the following sub-processors:

We will notify you of any intended changes to sub-processors at least 30 days in advance via email to your registered firm account. You may object to a new sub-processor within 14 days of notification. If we cannot reasonably accommodate your objection, either party may terminate the affected services.

We ensure that each sub-processor is bound by data protection obligations no less protective than those in this DPA.

8. International Transfers

Personal Data is transferred to and processed in the United States.

For UK-originating data: transfers are protected by the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.

For EU-originating data: transfers are protected by EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

Transfer Impact Assessments are conducted where required.

9. Data Breach Notification

In the event of a Data Breach affecting your clients' Personal Data, we will:

1. Notify you without undue delay and in any event within 72 hours of becoming aware of the breach
2. Provide sufficient information to enable you to meet your own breach reporting obligations to supervisory authorities and Data Subjects
3. Cooperate with you in investigating and remediating the breach
4. Document the breach, its effects, and remedial actions taken

Notification will include: nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

10. Data Retention and Deletion

Upon termination of your subscription:

• Your choice: You may request return of all client data in a structured, machine-readable format (CSV export) or request deletion.
• Deletion timeline: If deletion is requested, we will delete all Personal Data within 30 days of the request, except where retention is required by law.
• Legal retention: Where we are legally required to retain records (e.g., financial record-keeping obligations), we will inform you of the retention period and restrict processing to storage only.
• Backup purge: Data in automated backup systems will be purged within 90 days of deletion from primary systems.

11. Data Subject Rights

Where a Data Subject (your client) exercises their rights directly with us, we will:

1. Notify you within 5 business days
2. Not respond directly to the Data Subject without your instruction, unless legally required
3. Provide reasonable assistance to enable you to respond within statutory timeframes

Where technically feasible, we provide self-service data export and deletion tools within the platform that your clients can use directly.

12. Audits

You have the right to audit our compliance with this DPA, subject to:

• Reasonable advance notice (minimum 30 days)
• Audits conducted during normal business hours
• Scope limited to processing activities relevant to your data
• Confidentiality obligations on auditors regarding our proprietary systems

We may satisfy audit requests by providing relevant certifications, audit reports, or third-party assessment results where available.

13. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of data protection law to the extent such limitation is not permitted by applicable law.

14. Term and Termination

This DPA takes effect upon your acceptance of the Terms of Service for a firm plan and remains in effect for the duration of your subscription. It survives termination to the extent necessary to complete data return or deletion obligations.

15. Governing Law

This DPA is governed by the laws of England and Wales (for UK-based firms) or the State of Delaware, USA (for all other firms), consistent with the governing law of the Terms of Service.

16. Contact

For DPA-related queries:

Email: [email protected]

Data Controller (you): The firm entity subscribing to PlatformTaxHub's firm plan.

Data Processor (us): 4042 Solutions Group LLC, trading as PlatformTaxHub.