Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Fibby Ninja Terms of Service between the customer accounting firm ("Customer") and Fibby Ninja, and applies where Fibby Ninja processes personal data contained in a Customer's clients' accounting data ("Client Personal Data") on Customer's behalf.

For purposes of this DPA and applicable data protection law (e.g., the GDPR), the parties agree that: Customer is the data controller (or, under the CCPA/CPRA, the "business") with respect to Client Personal Data, since Customer determines which client companies are connected and who at Customer's firm may access them; and Fibby Ninja is the data processor (or "service provider"/"contractor"), processing Client Personal Data only on Customer's documented instructions as set out in this DPA and the Terms.

Subject matter: Fibby Ninja's provision of a connectivity and access-control layer between Customer's connected accounting platform(s) and the AI client(s) Customer's authorized users choose to use.

Duration: for as long as Customer maintains an active connection and account with Fibby Ninja, plus any retention period described in Section 8.

Nature and purpose of processing: retrieving accounting data via the connected platform's API in response to queries from Customer's authorized users' AI clients; generating reports and summaries; temporary caching to support performance; storing uploaded supporting documents; and maintaining audit and access logs.

Categories of data: financial and accounting records available through the connected platform (e.g., transactions, invoices, vendor/customer names, balances), and any personal data they contain (e.g., names and contact details of a Customer's client's employees, customers, or vendors).

Categories of data subjects: individuals whose personal data appears in the connected accounting records — e.g., Customer's client's employees, customers, vendors, and contacts.

Customer represents that it has all rights and consents necessary to connect its clients' accounting data to the Service and to instruct Fibby Ninja to process Client Personal Data as described in this DPA, including any permissions required under Customer's own engagement terms or professional obligations.

Customer provides general authorization for Fibby Ninja to engage sub-processors to provide the Service. Fibby Ninja's current sub-processors are listed on our Sub-processors page, which we will keep reasonably up to date. Fibby Ninja remains responsible for each sub-processor's compliance with data-protection obligations equivalent to those in this DPA.

Fibby Ninja implements appropriate technical and organizational measures to protect Client Personal Data, including AES-256-GCM encryption of stored accounting-platform credentials, TLS encryption in transit, Postgres row-level security enforcing per-firm data isolation, optional/administrator-enforced multi-factor authentication, rate limiting, and audit logging of access and tool-call activity. Further detail is available on our Security page.

Taking into account the nature of the processing, Fibby Ninja will provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights under applicable data protection law, to the extent Customer cannot reasonably fulfill the request itself through the Service's own functionality.

Fibby Ninja will notify Customer without undue delay, and in any case within 72 hours of becoming aware, of any confirmed unauthorized access to, or disclosure of, Client Personal Data processed on Customer's behalf, and will provide reasonably available information to help Customer meet its own notification obligations.

Upon termination of Customer's account, Fibby Ninja will delete or disconnect access to Client Personal Data within a reasonable period, except to the extent retention is required by law or for legitimate audit purposes, in which case it will remain subject to the confidentiality and security obligations of this DPA.

On reasonable request, no more than once per year (or more frequently if required following a security incident or by applicable law), Fibby Ninja will make available information reasonably necessary to demonstrate compliance with this DPA, and will reasonably cooperate with audits conducted by Customer or an independent third-party auditor mutually agreed upon, subject to reasonable confidentiality, scheduling, and scope limitations.

Where Client Personal Data is transferred outside the jurisdiction in which it originated, the parties will rely on an appropriate transfer mechanism recognized under applicable law, such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, [Transfer Mechanism Details — to be finalized by counsel].

This DPA takes effect when Customer first connects an accounting company to the Service and remains in effect for as long as Fibby Ninja processes Client Personal Data on Customer's behalf under the Terms. Either party may terminate this DPA by terminating the underlying Terms of Service in accordance with their terms.

Questions about this DPA, or requests to execute a signed/countersigned version, can be sent to hello@fibby.ninja.