This Data Processing Addendum (“DPA”) forms part of the agreement between your Agency (“Customer,” acting as data controller for its clients’ personal data) and EnDevSols (Pvt) Ltd(“FirmSuit,” acting as data processor) and applies whenever FirmSuit processes personal data on Customer’s behalf through the platform.
1. Subject matter & duration
FirmSuit processes personal data contained in documents Customer uploads (bank statements, land records, tax certificates) solely to provide the extraction, verification, search, and reporting features of the service, for the duration of the Customer’s subscription.
2. Nature and purpose of processing
Automated extraction, classification, and structuring of financial records; secure storage and retrieval of extracted client data; cross-client search and client financial intelligence generation; creation of reports and briefs requested by Customer.
3. Categories of data subjects
Customer’s own clients (the individuals or entities named in uploaded documents) and Customer’s own staff users.
4. Categories of personal data
Names, national identification numbers (e.g. CNIC/SSN-equivalents where present in a document), contact details, financial account and transaction information, property records, and tax filing information, as contained in the documents Customer uploads; plus staff account details (name, email, role).
5. Processor obligations
FirmSuit will:
- Process personal data only on Customer’s documented instructions (including as set out in the Terms of Service);
- Ensure personnel with access to personal data are bound by confidentiality obligations;
- Implement appropriate technical and organizational security measures (see Section 8);
- Not engage a new sub-processor without providing notice and an opportunity to object (see our Subprocessors page for the current list);
- Assist Customer, to a commercially reasonable extent, in responding to data subject access, correction, or deletion requests, and in complying with its own data protection obligations;
- Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer’s data;
- Delete or return personal data at the end of the relationship, as described in our Privacy Policy.
6. International data transfers
FirmSuit’s infrastructure runs on secure cloud providers in the United States. Where Customer is located in the United Kingdom or European Economic Area, the parties agree that:
- For transfers subject to UK GDPR, the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses as modified by the UK Addendum) is incorporated into this DPA by reference, with FirmSuit as data importer;
- For transfers subject to EU GDPR, the European Commission’s Standard Contractual Clauses (Controller-to-Processor, Module 2) are incorporated into this DPA by reference;
- These are supplemented by our cloud infrastructure provider’s own Data Processing Addendum and Data Privacy Framework certification.
A copy of the executed clauses is available on request from support@firmsuit.com.
7. Sub-processors
Customer authorizes FirmSuit’s use of the sub-processors listed on our Subprocessorspage. We will update that page and provide notice before adding a new sub-processor that will process Customer’s data.
8. Security measures
- Encryption in transit and at rest;
- Multi-tenant data isolation and access controls preventing cross-organization access;
- Role-based permissions and optional two-factor authentication for staff accounts;
- Audit logging of sensitive data access and modifications.
9. Audits
On reasonable notice, FirmSuit will make available information reasonably necessary to demonstrate compliance with this DPA, and will cooperate with audits conducted by Customer or an appointed auditor, subject to confidentiality obligations and reasonable scheduling.
10. Contact
Questions about this DPA: support@firmsuit.com.