Data processing agreement

This agreement forms part of the Terms of Service between Clout Capital Limited, 12 St Peter's Terrace, Glenageary, Dublin, A96 N6F2, CRO 804790 ("Processor", "we"), and the customer company named in the order or sign-up ("Controller", "you"), for the mytaxcredits.ie service (the "Service"). You enter into it for yourself and for any of your affiliates you authorise to use your workspace. It meets Article 28(3) of the GDPR.

1. Roles

1.1 For Customer Data (Annex 1), you are the controller and we are your processor.

1.2 For our own account, billing, security-log and website enquiry data, we are an independent controller under our privacy notice.

1.3 Tax adviser users. Your tax adviser acts as an independent data controller in providing professional tax advisory and claim review services under its separate terms of engagement with you. The adviser accesses Customer Data solely on your invitation. You remain responsible for having an appropriate legal basis to share that data with the adviser, and for managing or revoking the adviser's workspace permissions. In making workspace features and data available to the adviser, we act as your processor on your documented instructions; the adviser is not our sub-processor.

2. Instructions

2.1 We process Customer Data only on your documented instructions. These are this agreement, the Terms of Service, and your use and configuration of the Service: which integrations you connect, which documents you select, who you invite, and what you approve. That includes transfers (section 8).

2.2 If we believe an instruction breaches data protection law, we will tell you and may suspend that processing.

2.3 We do not use Customer Data to train AI models, sell it, or use it for our own purposes beyond operating, securing and supporting the Service.

3. Confidentiality and staff access

Everyone we authorise to process Customer Data is bound by confidentiality. Access to production databases is restricted to designated engineering and support personnel using hardware-backed multi-factor authentication and just-in-time access controls. All access sessions are logged and periodically audited. VERIFY: these controls must be in place before launch.

4. Security (Article 32)

We apply the measures in Annex 2 and may improve them, but will not materially reduce their protection.

5. Sub-processors

5.1 You give general authorisation for the sub-processors in Annex 3, as published at /subprocessors.

5.2 We will give you at least 30 calendar days' written notice before adding or replacing a sub-processor. Where an urgent replacement is necessary to protect system security, respond to an immediate outage, or comply with law, we will notify you as soon as reasonably practicable, and in any event within 5 business days of the appointment.

5.3 You may object to a new sub-processor only on objective, reasonable data protection grounds, for example that it cannot offer adequate guarantees under the GDPR. If we cannot resolve the objection, you can terminate the affected Service and receive a pro-rata refund of prepaid fees.

5.4 We impose data protection terms on each sub-processor that are no less protective than these, and we remain liable for their performance.

5.5 Integrations you connect (GitHub, Jira, Confluence, Google Drive, Slack, Xero, payroll exports) are your own providers, not our sub-processors. We access them read-only through the OAuth tokens you grant, on your instruction.

6. Assistance

6.1 Data subject requests. The Service lets you export all of your data (owners: Settings > Export) and correct records. We will forward any request we receive directly to you, and help with requests you cannot fulfil yourself.

6.2 DPIAs. We will provide reasonable information for your DPIAs. Our DPIA of the time-suggestion feature is available on request.

7. Personal data breaches

7.1 We will notify you without undue delay, and in any case within 48 hours of confirming a personal data breach affecting Customer Data. This leaves you time to meet your 72-hour obligation to the Data Protection Commission under Article 33 GDPR. The clock runs from confirmation of an actual breach, not from an unverified alert while it is being investigated.

7.2 The notice will set out what we know of the nature of the breach, the categories and approximate volumes involved, the likely consequences, and the measures taken. We will update it as we learn more.

8. Transfers

8.1 Customer Data is stored in the EU: the database and files in Supabase eu-west-1 (Ireland), and the application in Vercel dub1 (Dublin).

8.2 Some sub-processors are US companies, and some processing (for example AI inference, support access or telemetry) may take place outside the EEA. Each such transfer relies on one of these:

• the EU-US Data Privacy Framework (Commission Implementing Decision of 10 July 2023), where the recipient is actively certified; or
• the Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module 3: processor to sub-processor), supported by a transfer impact assessment.

Annex 3 sets out the mechanism for each sub-processor. AI inference providers must also contractually commit to zero data retention and to not using inputs or outputs for model training.

9. Deletion and return

9.1 Owners can download a full export at any time.

9.2 Subject to section 9.1, when the Service ends we keep Customer Data for a grace period of 30 days so that you can retrieve final exports. After that we securely delete all Customer Data, including signed claim snapshots, unless mandatory EU or Irish law requires us to keep copies. The same 30-day period applies when you ask us to delete your organisation during the term.

9.3 While your subscription is active, claim records are retained for 6 years after the end of the accounting period they relate to, in line with section 886(4)(a) TCA 1997, then deleted automatically. You may instruct a longer period. Retention is extended while:

• a Revenue audit, inquiry or litigation concerning the records is active (a legal hold, which you or we can set); or
• credits from the claim are still being carried forward under section 766C or 766D TCA 1997.

The primary obligation to keep records for Revenue rests with you. We meet our part by letting you export everything before the Service ends. We have no obligation to store Customer Data after termination unless you subscribe to an archival service. [Archival tier: commercial decision.]

9.4 Backups are rolling database snapshots held encrypted by our hosting provider and overwritten automatically: daily snapshots are kept for 7 days, or 30 days where point-in-time recovery is enabled. VERIFY: the Supabase plan and backup setting at launch.

10. Audits

10.1 We will make available the information needed to demonstrate compliance with Article 28. You agree to accept recent independent SOC 2 Type II or ISO 27001 reports, or a third-party penetration test executive summary, in place of an on-site inspection wherever that is reasonably sufficient.

10.2 Otherwise, you or an independent auditor bound by confidentiality may audit us:

• on at least 30 days' written notice;
• during normal business hours, without disrupting our operations;
• at most once per calendar year, unless there is a breach or a regulator requires it;
• at your sole expense.

11. Liability

11.1 Each party's total aggregate liability arising out of or in connection with this agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise under data protection law, is subject to the liability caps, exclusions and limitations in the Terms of Service. Nothing in this agreement limits or excludes liability that cannot be limited or excluded under Irish law.

11.2 As between the parties, where both are responsible for damage under Article 82 GDPR, each is liable to the other only to the extent of its actual responsibility for that damage, subject to the caps in section 11.1.

11.3 This agreement lasts as long as we process Customer Data.

---

Annex 1: Processing details

Subject matter	Preparing Irish R&D corporation tax credit (s766C TCA 1997) claim files and CT1 figures for review by the Controller and its tax adviser.
Duration	The term of the Service, plus the retention and grace periods in section 9.
Nature	Collection from integrations and uploads, storage, organisation, AI-assisted classification and drafting (with human review), calculation, export, deletion.
Data subjects	The Controller's employees, directors and contractors whose work or pay appears in claim evidence. The Controller's users and invited advisers. Individuals named in tickets, documents or ledger lines (e.g. supplier contacts).
Categories of data	Identity and contact: names, work emails, job titles, qualifications, roles, and author aliases in connected tools. Work activity: commit messages and changed file names (no source code), pull requests, tickets and comments, Confluence pages from chosen spaces, documents you select or upload, messages in public Slack channels you choose (grouped by day; never direct messages or private channels), AI assistant transcripts you upload (prompts and replies only, secrets redacted, the file deleted after parsing), and monthly R&D notes written by staff or by contractor contacts through a private link (with the contact's name and email), with authors and timestamps. (Sources added after the 4 November 2026 sign-off are pending counsel approval: see DPIA section 9.) Time allocations: monthly R&D time shares, whether suggested, confirmed by the employee, or approved. Pay: salary, bonus, employer pension, health insurance and employer PRSI for staff whose time is claimed. Finance: ledger lines, which may name individuals as suppliers. Audit: who changed what and when.
Special categories	None permitted. The Service is not intended for special categories of personal data (Article 9 GDPR) or criminal convictions data (Article 10 GDPR). The Controller warrants that it will not upload or connect data sources containing such data, and will indemnify the Processor for any breach of this warranty.
Frequency	Continuous while integrations are connected (webhooks and hourly syncs).

Annex 2: Technical and organisational measures

Each of these is implemented in the Service unless marked otherwise.

Isolation and access

• Every customer table is scoped to an organisation and protected by Postgres row-level security. Cross-organisation references are prevented by composite foreign keys.
• The row-level security policies are covered by regression tests that run in CI on every change. They also run against the staging Supabase project, alongside an automated pen-test suite run against the deployed staging app.
• Role-based access (owner, finance, engineer, viewer, adviser):
  • Pay, claim figures and claim blockers are visible only to owners, finance users and the adviser.
  • Engineers and viewers cannot read pay, the ledger, claim figures or the audit log.
  • An employee's time percentages and confirmations are visible only to owners, finance, the adviser and that employee.
• Two-factor authentication (TOTP) is enforced in the database for adviser sign-off and for organisation deletion requests.
• Storage is in private buckets with per-organisation path prefixes. Client roles cannot write signed claim snapshots.

Minimisation

• Source code is not ingested, only commit messages and file names.
• Google Drive access uses the drive.file scope, so only files the user picks.
• All integrations are read-only.
• Slack: public channels only (no permission for DMs or private channels), opt-in per channel, bot messages and files excluded, secrets redacted.
• AI transcripts: only prompts and prose replies are kept; tool output, reasoning and the uploaded file are discarded; secrets redacted.
• Monthly confirmation emails go only to the employee concerned. They show that employee's own time percentages and link to their own time page. They contain no pay or tax figures, in the email body or in the link.

Secrets and encryption

• Encryption in transit (TLS) and at rest (provider-managed).
• Integration tokens are kept in Supabase Vault, and only the service role can read them.

Integrity

• Append-only audit log of changes, written by database triggers.
• Signed claim files are locked, and a SHA-256 manifest is checked when they are downloaded.
• Legal hold flag per organisation suspends automated deletion.

Application security

• Rate limits on heavy and abuse-prone routes.
• Security headers and a content security policy.
• Webhooks are verified by signature and replay-protected.

AI

• Statuses and figures are computed in code.
• Model output is advisory. Exported AI text must cite evidence.
• Nothing is filed automatically.
• Inputs are not used for training, and zero data retention applies. VERIFY: Anthropic zero-retention terms executed.

Monitoring and retention

• No third-party error monitoring at launch. If one is added later, it becomes a sub-processor: accept its DPA, use an EU region, strip request bodies, cookies, headers and user identity, and give 30 days' notice (section 5.2).
• Retention and deletion jobs run automatically: claim records after 6 years, organisation deletions after the 30-day grace period, enquiries after 2 years.

Organisational: to be in place before launch [VERIFY]

• Production access controls (section 3).
• Staff confidentiality undertakings.
• Incident response procedure (runbook s3).
• Independent penetration test, then annually; tracked as a launch gate.
• Yearly sub-processor review.

Annex 3: Sub-processors

Kept in step with /subprocessors. VERIFY each vendor's DPF status on the US Department of Commerce list, and execute the SCCs and DPAs noted, before launch.

Sub-processor	Purpose	Location	Transfer mechanism
Supabase Inc.	Database, authentication, file storage	Data at rest in AWS eu-west-1 (Ireland); remote support and engineering access may be from outside the EEA	SCCs, Module 3, via the Supabase DPA
Vercel Inc.	Application hosting	Functions in dub1 (Dublin); builds, telemetry and global routing may pass through the US	EU-US DPF, with the fallback SCCs (Module 3) in the Vercel DPA
Anthropic PBC	AI classification and drafting from linked evidence	US inference unless an EU endpoint is contracted	SCCs, Module 3, with TIA; zero data retention and no-training terms required
Voyage AI Inc. (only if enabled)	Text embeddings for evidence search	US	SCCs, Module 3. If zero retention can't be agreed, use an EU-hosted embedding model or leave disabled (it is optional).
Resend Inc. (only if enabled)	Monthly "confirm your R&D time" emails	US	EU-US DPF / SCCs, Module 3
Stripe Payments Europe Ltd (only if billing enabled)	Invoicing and payments	Ireland	Irish entity, Stripe DPA. Stripe is an independent controller for payment processing and fraud prevention.