Data Processing Agreement
ExpensePlus Ltd (company number 09404009)
Effective from the date your organisation accepts the Terms of Service
Last updated: October 2026
1. Background and scope
1.1 This Data Processing Agreement (DPA) forms part of the ExpensePlus Terms of Service (the Terms) between ExpensePlus Ltd, registered office Headingley Enterprise & Arts Centre, Bennett Road, Leeds, England, LS6 3HN (ExpensePlus, we, us), and the organisation that has opened an ExpensePlus account (the Customer, you).
1.2 It applies whenever we process Customer Personal Data on your behalf in providing the Service. For that processing, you are the controller and we are the processor.
1.3 This DPA does not cover personal data that we process as a controller for our own purposes, such as billing your subscription, our own marketing and our internal administration. That processing is described in our Privacy Policy.
1.4 If there is a conflict between this DPA and the Terms on a data protection matter, this DPA prevails.
1.5 You accept this DPA when you accept the Terms. No separate signature is needed. A copy is available at https://expenseplus.co.uk/legal/dpa and we will supply a copy confirming your acceptance on request.
2. Definitions
In this DPA:
Applicable Data Production Law means the UK GDPR, the Data Protection Act 2018, and any other UK data protection legislation that applies to the processing, each as amended or replaced from time to time.
Customer Personal Data means personal data that you (or your users) enter into or upload to the Service, and that we process on your behalf.
Service, Organisation and Terms have the meanings given in the Terms.
Sub-processor means a third party engaged by us to process Customer Personal Data.
Restricted Transfermeans a transfer of Customer Personal Data to a country or organisation outside the UK that is subject to Chapter V of the UK GDPR.
The terms controller, processor, personal data, personal data breach, processing, data subject, special category data and Information Commissioner have the meanings given in the UK GDPR.
3. Processing on your instructions
3.1 We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If the law requires us to process it in another way, we will tell you before we do so unless the law forbids that.
3.2 You instruct us to process Customer Personal Data to provide the Service as described in the Terms and in Annex 1. Your instructions also include how you use and configure the Service, including whether you enable or disable our access to your data in your account settings, and any further written or verbal instructions from your authorised users that are consistent with the Terms.
3.3 Our support team views Customer Personal Data only when needed to answer a support request started by one of your active users. You can switch this access off in the Service. If you do, we can give only general support, such as advice and links to our help guide. All user activity, including that of our support team, is logged.
3.4 We will not use Customer Personal Data for our own purposes, sell it, or pass it to third parties except as set out in this DPA or on your instructions.
3.5 If we think an instruction infringes Applicable Data Protection Law, we will tell you promptly. We may pause the instruction until you confirm or change it.
4. Your responsibilities
4.1 You are responsible for the lawfulness of your use of the Service, including having a lawful basis for the personal data you enter, giving data subjects the information they are entitled to, and keeping the data accurate.
4.2 You must make sure your instructions comply with Applicable Data Protection Law, and that your users keep their login details secure and use the Service in line with the Terms.
4.3 Nothing in this DPA relieves you of your own obligations as a controller.
5. Special category and criminal offence data
5.1 The Service does not require you to enter special category data or criminal offence data. However, some fields (such as notes) accept free text, so this kind of data could be entered.
5.2 You are solely responsible for deciding whether to enter this kind of data into the Service. You are also responsible for identifying a valid condition under Article 9 of the UK GDPR (and, where needed, a condition in Schedule 1 of the Data Protection Act 2018), and for making sure the data is necessary and proportionate. We recommend you do not enter it into free-text fields unless you need to.
5.3 We do not review the content of the fields you complete, and we are not responsible for the lawfulness of your decision to enter special category or criminal offence data.
5.4 If such data is held in the Service, we will protect it using the security measures in Annex 2 like all other Customer Personal Data. Nothing in this clause reduces our own obligations as a processor under this DPA.
6. Confidentiality
6.1 We will make sure everyone who has access to Customer Personal Data on our behalf is bound by a duty of confidence and has authority to process it. Access is limited to staff who need it to provide, secure or support the Service.
7. Security
7.1 We will put in place appropriate technical and organisational measures to protect Customer Personal Data, in line with Article 32 of the UK GDPR, taking into account the nature of the data and the risks. Our measures at the date of this DPA are in Annex 2.
7.2 We may update those measures over time, but we will not make changes that reduce the overall level of security.
8. Sub-processors
8.1 You give us general written authorisation to use the Sub-processors listed at https://expenseplus.co.uk/legal/sub-processors, as updated under clause 8.4.
8.2 We will have a written contract with each Sub-processor that imposes data protection obligations that are no less protective than those in this DPA. We remain responsible to you for how each Sub-processor carries out its obligations.
8.3 Some Sub-processors are used only if you choose a particular feature.
- Stripe is used only if you enable card payments from your payees
The Sub-processors listed at https://expenseplus.co.uk/legal/sub-processors states when each is used.
8.4 We will give you at least 30 days’ notice before we add or replace a Sub-processor. We will do this by updating our Sub-Processors page and emailing your account contact.
8.5 You may object on reasonable data protection grounds by writing to us within that 30-day period. We will talk with you in good faith to resolve your concern. If we cannot, you may cancel your subscription before the change takes effect, without penalty.
8.6 If we need to replace a Sub-processor urgently for security or service continuity reasons, we may do so with shorter notice. We will tell you as soon as we can, and clause 8.5 still applies.
9. International transfers
9.1 The core Service is hosted in the UK. Our primary servers are with Linode Akamai, and our backup servers are with Amazon Web Services (AWS), in a separate UK data centre.
9.2 We will not make a Restricted Transfer except to the Sub-processors in Annex 3 that process data outside the UK, and only where there is a lawful transfer mechanism in place. That means UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Annex 3 gives the location and mechanism for each Sub-processor.
9.3 If a transfer mechanism stops being valid, we will work with the Sub-processor to put an alternative in place. If we cannot, we will stop using that Sub-processor for the affected feature and tell you.
10. Data subject rights
10.1 Taking into account the nature of the processing, we will help you respond to requests from data subjects exercising their rights under Applicable Data Protection Law. The Service includes functions to find, correct, export and delete data, and we will provide reasonable additional help where those functions are not enough, within 14 working days of your request. For erasure requests, we will delete or anonymise the individual’s personal data in the live system. Where you must keep a record for legal or accounting reasons, we can redact the personal fields and keep the underlying record. Erased data may remain in our backups until they expire (see Annex 2).
10.2 If a data subject contacts us directly about Customer Personal Data, we will not respond except to say that we will pass the request on. We will send it to you within 5 working days.
11. Assistance with your other obligations
11.1 We will give you reasonable assistance with your obligations on security of processing, data protection impact assessments and prior consultation with the Information Commissioner (Articles 32 to 36 of the UK GDPR), taking into account the nature of the processing and the information available to us. This includes the information in this DPA and Annex 2.
11.2 Routine assistance is part of the Service. If a request needs a significant amount of extra work, we may charge reasonable costs, and we will tell you before we start.
12. Personal data breaches
12.1 We will tell you without undue delay, and in any event within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data.
12.2 We will send the notification to your system administrator contact. It will include, as far as we know it: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and what we have done or propose to do. If we cannot provide everything at once, we will provide it in stages.
12.3 We will take reasonable steps to contain the breach, investigate it, and help you meet your obligations to notify the Information Commissioner and data subjects.
12.4 You decide whether to notify the regulator or data subjects. We will not do so on your behalf unless the law requires it.
13. Return and deletion
13.1 Before you cancel, you can download your data using the Service’s export functions. If you ask during the cancellation process, we will also send you copies of the documents you have uploaded, such as receipts and invoices.
13.2 When your subscription ends, for any reason, we will delete all Customer Personal Data, including copies in our backups, after 30 days.
13.3 We may keep Customer Personal Data after that only if the law requires it. If so, we will tell you what we keep and why, keep it secure, and use it only for that purpose.
13.4 We will confirm in writing that deletion is complete if you ask.
14. Audit and information
14.1 We will give you the information reasonably needed to show that we comply with this DPA. On request, we will share our current Cyber Essentials certificate and the attestation from our most recent annual independent penetration test.
14.2 We will answer reasonable security questionnaires from you, up to once every 12 months.
14.3 If that information is not enough, or if there has been a personal data breach, or a regulator requires it, you (or an independent auditor you appoint) may audit our compliance with this DPA. You must give us at least 30 days’ written notice, carry out the audit during working hours with as little disruption as possible, keep what you learn confidential, and bear the costs. Audits may take place once every 12 months, except where a regulator requires otherwise or following a personal data breach. They do not extend to other customers’ data or to our Sub-processors’ own premises. For Sub-processors, we will share the audit reports and certifications that they make available to us.
15. Liability
15.1 Each party’s liability under or in connection with this DPA is subject to the limits and exclusions in the Limitation of Liability section of the Terms.
15.2 Nothing in this DPA limits any liability that cannot be limited by law, or any right a data subject has against either party under Article 82 of the UK GDPR.
16. Term, changes and contact
16.1 This DPA lasts for as long as we process Customer Personal Data on your behalf, including the deletion period in clause 13.2.
16.2 We may update this DPA to reflect changes in law, in the Service or in our Sub-processors. We will give you at least 30 days’ notice of material changes, and no change will reduce the protection of Customer Personal Data.
16.3 This DPA, and any dispute arising from it, is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
16.4 For data protection questions, data subject requests and personal data breach matters, contact dpo-contact@expenseplus.co.uk. For general support, contact support@expenseplus.co.uk.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing ExpensePlus, a cloud-based fund accounting service, to the Customer |
| Duration | For the life of the Customer’s account, plus up to 30 days for deletion (clause 13.2) |
| Nature of processing | Hosting, storage, backup, retrieval, display and organisation of data; processing needed to run accounting and reporting functions; sending emails from the Service; payment and bank-feed processing where the Customer enables them; support and troubleshooting where the Customer allows access; deletion |
| Purpose | To let the Customer manage its accounts, donations, payments, suppliers and reporting |
| Frequency | Continuous, for as long as the account is active |
| Categories of data subjects | The Customer’s users; donors; payees; suppliers; the Customer’s own customers; the Customer’s employees (for payments and payroll records) |
| Types of personal data | Users: name, email address, name of organisation. Donors: name, email address, postal address, phone number, donations given, gift declaration. Payees: name, email address, sort code, account number, payments made. Suppliers: name, email address, sort code, account number, payments made. Customers: name of organisation, name of point of contact, email address, address (personal or company), invoices issued, phone number. Employees: name, email address, sort code, account number, payroll data, payments made. Uploaded documents (for example receipts and invoices) and free-text notes may contain further personal data. |
| Special category data | Not required by the Service. May appear in free-text fields at the Customer’s choice, in which case clause 5 applies. |
| Retention | Controlled by the Customer during the term. Daily backups are kept for 30 days and monthly backups for 7 years. When a subscription ends, all data, including backups, is deleted after 30 days (clause 13). |
Annex 2: Security measures
Certification and testing
- Cyber Essentials certified, covering the whole organisation and all systems used to deliver ExpensePlus.
- Annual independent penetration testing of the web application and external infrastructure. Attestation is available on request.
- Regular scanning for common vulnerabilities, such as SQL injection and cross-site scripting. Critical security updates are applied within 48 hours, and other security updates weekly (occasionally fortnightly).
Hosting and resilience
- Data is hosted in UK Tier 3 data centres run by our hosting providers, which hold ISO 27001 certification.
- Redundant servers, power and network connections.
- Daily and monthly backups, encrypted and held with a different provider (AWS) in a separate UK data centre from the primary server, and isolated from production with separate credentials. Daily backups are kept for 30 days and monthly backups for 7 years, except that on cancellation all data, including backups, is deleted after 30 days (clause 13).
- Server access is limited to authorised ExpensePlus employees. The data centres have 24/7 physical access control and fire suppression.
Encryption
- All connections to the Service are encrypted in transit using TLS 1.2 or higher.
- Sensitive data fields, such as bank details, are encrypted at rest. The wider database and uploaded documents are not encrypted at rest, and are protected by the other controls in this Annex. Backups are encrypted.
- Data sent to third parties is encrypted before it is sent.
Access control
- Each user has a unique username and password. Passwords must meet minimum length and strength requirements and are stored using a one-way hashing algorithm. Accounts are locked after 10 failed sign-in attempts.
- Role-based access control within the Service.
- Two-factor authentication is available through an authenticator app or Touch ID (WebAuthn). Customer administrators can set it as enforced, encouraged or optional for each user role.
- Customer-controlled setting that enables or disables our support team’s access to Customer data. Support staff view Customer data only when responding to a support request from one of your active users.
- Staff access to Customer data follows least privilege and is limited to those who need it. Staff are screened before employment, sign confidentiality agreements that continue after they leave, and receive data protection and security training when they join and annually. Access is removed on the last working day under a documented leaver process. Contractors are not given access to Customer data.
- Each Customer organisation has its own database, so data is kept separate.
Internal practices
- New code is reviewed before release and tested in a separate test environment with the same security measures as production. Testing typically uses dummy data. Where live data is needed to reproduce a fault, encrypted data is anonymised, and all data is deleted from the test environment once testing is complete.
- Sessions end on sign-out, and expire if the user does not sign out.
- All user activity is logged, including sign-ins, approvals, edits to transactions (with previous and new values), changes to supplier bank details and user permissions, and viewing and exporting of data. Logs are kept for 6 months and are available to the Customer on request.
- A documented business continuity and disaster recovery plan is reviewed and tested annually.
Annex 3: Sub-processors
The Sub-processors we use, with their purpose, location and international transfer mechanism, are listed at https://expenseplus.co.uk/legal/sub-processors.
That list forms part of this DPA. We keep the page up to date and record the date of the last change. Changes are notified under clause 8.4.