Data Processing Agreement

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Supervisory Authority” have the meanings given in the EU General Data Protection Regulation (“GDPR”). “Applicable Data Protection Law” means the GDPR, the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), the Gramm-Leach-Bliley Act (“GLBA”) and any other privacy or financial-data law applicable to a party.

The Customer is the Controller and Liqod is the Processor with respect to Personal Data submitted to the Service. Under the CCPA/CPRA, Liqod acts as a “service provider” and does not sell or share Personal Data.

• Liqod processes Personal Data only on the Customer’s documented instructions, which comprise these Terms, this DPA, the configuration of the Customer’s account, and any instruction the Customer gives through the Service.
• Liqod will not process Personal Data for its own purposes, and will not sell, rent, or share it, or use it for advertising or profiling.
• Liqod will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend processing of that instruction.
• The Customer is responsible for having a lawful basis for the processing and for issuing all required notices to Data Subjects, including the Customer’s own clients.

The subject matter is the provision of bookkeeping, statement extraction, categorisation, financial reporting and tax-line mapping functionality. Processing continues for the duration of the Customer’s subscription and for the retention period described in Section 9. The nature of processing includes collection, storage, structuring, automated extraction and categorisation, reporting, transmission, retention, anonymisation and deletion.

Categories of Data Subjects:

• The Customer’s Authorised Users (employees, bookkeepers, accountants, invited clients);
• The Customer’s own clients and their representatives, where the Customer uses the Service on their behalf;
• Payees, customers, vendors and other counterparties named in uploaded statements and documents.

Categories of Personal Data:

• Account and contact data: name, email address, role, workspace and company membership;
• Financial transaction data: bank and credit-card statement lines, dates, amounts, running balances, descriptions, reference and cheque numbers, and cheque or receipt images contained in uploaded documents;
• Counterparty identity data: payee, customer and vendor names, mailing addresses and contact details entered or extracted;
• Ledger and reporting data: journal entries, invoices, bills, payments, reconciliations, generated reports, tax-line mappings and tax-preparation worksheets;
• Support and correspondence data: support tickets, contact enquiries, client queries and their replies, and any attachments;
• Usage and diagnostic data: statement processing logs, audit trails and plan usage counters.

Liqod does not require and asks the Customer not to submit special-category data, payment card numbers, or government identification numbers beyond what is inherently present in a bank statement.

The Customer authorises Liqod to engage the sub-processors listed below. Each is bound by a written agreement imposing data protection obligations no less protective than this DPA. Liqod remains responsible for their performance.

• Base44 — application hosting, authentication, database and file storage, and the AI models used for categorisation and validation.
• DocuPipe — automated extraction of transaction data from uploaded bank and credit-card statement documents.
• Base44 Payments (Wix) — subscription checkout and billing. Liqod does not receive or store full payment card numbers.
• Resend — delivery of transactional email such as invitations, client queries and invoices.

Liqod will give the Customer notice before adding or replacing a sub-processor. If the Customer reasonably objects on data protection grounds within fifteen (15) days, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.

Personal Data is stored and processed on infrastructure operated by the sub-processors named above, which is located in the United States. Where Personal Data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to the United States, the transfer is made on the basis of the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), together with the UK International Data Transfer Addendum where applicable, which are incorporated into this DPA by reference and apply to that transfer.

• Liqod limits access to Personal Data to personnel who need it to deliver, secure or support the Service.
• Personnel with access are bound by written confidentiality obligations that survive the end of their engagement.
• Access is granted on a least-privilege basis and is revoked when no longer required.

Liqod maintains technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, per-record row-level access controls that isolate each workspace and company, role-based permissions, signed and time-limited URLs for private document access, authenticated and signature-verified integration endpoints, and audit trails recording changes to transactions and ledger records. Further detail is published in our Security Safeguards.

Liqod handles non-public personal financial information consistent with the safeguards expected under the GLBA Safeguards Rule. Because subscription payments are processed entirely by Base44 Payments, Liqod does not receive, transmit or store cardholder data and is therefore outside the scope of PCI DSS.

• Financial records are retained for seven (7) years from the record date, reflecting common statutory retention periods for accounting and tax records. Retained records are purged automatically once that period has elapsed.
• On a verified erasure request, Liqod redacts the personal identifiers associated with the requester while preserving the underlying financial records for the remainder of the retention period, as permitted by Applicable Data Protection Law where deletion would conflict with a legal retention obligation.
• The Customer can export its data at any time from the Settings area of the account, in a structured, machine-readable format.
• On termination, the Customer should export its data before cancelling. Liqod will delete or anonymise Customer Data after the retention period, except where longer retention is required by law.

Liqod provides self-service export and erasure tooling inside the Service so the Customer can respond to requests for access, portability, correction and erasure without Liqod’s involvement. Where a Data Subject contacts Liqod directly, Liqod will refer them to the Customer and will not respond on the Customer’s behalf except on the Customer’s instruction. Liqod will provide reasonable assistance with data protection impact assessments and with consultations with a Supervisory Authority, at the Customer’s cost where the assistance requires material effort.

Liqod will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data breach affecting Customer Data. The notification will describe the nature of the breach, the categories and approximate volume of data and Data Subjects affected so far as known, the likely consequences, and the measures taken or proposed. Liqod will cooperate with the Customer in investigating and remediating the breach. Notification is not an acknowledgement of fault or liability.

On reasonable written request, and not more than once in any twelve-month period unless required by a Supervisory Authority, Liqod will make available information necessary to demonstrate compliance with this DPA, including available third-party audit reports or certifications held by its sub-processors. On-site audits are conducted only where such documentation is insufficient, on at least thirty (30) days’ notice, during business hours, subject to confidentiality, and without disrupting the Service or the data of other customers.

This DPA takes effect when the Customer accepts the Terms of Service or first uses the Service, whichever is earlier, and no separate signature is required for it to be binding. A Customer who requires a countersigned copy may request one at legal@liqod.com. This DPA remains in force for as long as Liqod processes Personal Data on the Customer’s behalf and terminates automatically, save for the retention and deletion obligations in Section 9, when that processing ends.

In the event of a conflict between this DPA and the Terms of Service or the Privacy Policy on the subject of data protection, this DPA prevails. Data protection enquiries and requests under this DPA: privacy@liqod.com. Legal notices: legal@liqod.com.