1. Parties and scope
This addendum is between the practice that uses Yeardesk (the controller) and [Operator’s legal name], [sole trader, or company registered in England and Wales with its number] (the processor, “we”). It forms part of our terms of service, and the practice accepts it when it accepts those terms. Where the two conflict on data protection, this addendum wins.
It covers the personal data the practice puts into its workspace (“practice data”). Account holders’ own account data is covered by our privacy notice instead. Words like “personal data”, “processing” and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Hosting and running Yeardesk for the practice. |
| Duration | For as long as the practice uses the service, and until its data is deleted under section 9. |
| Nature and purpose | Storing, organising, displaying, searching, exporting, backing up and deleting the practice’s data, and sending the emails the service needs, so the practice can track its clients’ returns and its team’s work. |
| Types of personal data | Clients’ names, references, email addresses, phone numbers, client type, year-ends, due dates and notes; work items, comments, checklists, time estimates and the activity history; the practice’s team members’ names, email addresses, roles, job titles and working hours; email addresses of people the practice invites. |
| Categories of data subjects | The practice’s clients, and people connected with them (such as directors, partners and trustees); the practice’s staff and anyone else it invites. |
| Special category data | None is expected. The practice shouldn’t enter it unless it is necessary and lawful. |
3. Instructions
We process practice data only on the controller’s documented instructions. Our terms of service, this addendum, and the way the practice uses and configures Yeardesk are those instructions. We don’t use practice data for any other purpose, including our own. The only exception is where UK law requires us to process it; then we’ll tell the controller first, unless the law forbids that.
If we think an instruction breaks data protection law, we’ll tell the controller straight away.
4. Confidentiality
Anyone we allow to process practice data is bound to keep it confidential, and only looks at it when that’s needed to run the service, to fix a fault, or because the controller asked us to.
5. Security
We take appropriate technical and organisational measures to protect practice data, as Article 32 requires. They include encryption in transit and at rest, two-factor sign-in, role-based access, separation between workspaces, backups and monitoring. Our security page summarises them. We review the measures as the service and the risks change, and won’t reduce the overall level of protection.
6. Sub-processors
- The controller gives us general authorisation to use the sub-processors on our sub-processors page.
- We’ll email the practice’s workspace owners at least 30 days before adding or replacing one. The controller may object, on reasonable data protection grounds, before the change takes effect. If we can’t resolve the objection, the controller may delete its workspace and end the agreement.
- Each sub-processor is bound by a written contract with data protection obligations at least as protective as these. We remain responsible to the controller for what our sub-processors do.
7. International transfers
We transfer practice data outside the UK only with the protection UK law requires: to a country covered by UK adequacy regulations (including the EU), to a US company certified under the UK extension to the EU–US Data Privacy Framework, or under the ICO’s international data transfer agreement or addendum. The sub-processors page says where each one processes data.
8. Helping the controller
- People’s rights. Yeardesk lets the practice find, correct, export and delete practice data itself. If someone sends us a request about practice data, we’ll pass it to the controller without delay and won’t answer it ourselves unless the controller asks us to. We’ll give any other reasonable help the controller needs to respond.
- Breaches. If we become aware of a personal data breach affecting practice data, we’ll tell the practice’s owners without undue delay, and within 48 hours. We’ll explain what happened, the data and people likely to be affected, the likely consequences and what we’re doing about it, and send more details as we learn them, so the controller can meet its own duty to tell the ICO within 72 hours.
- Impact assessments. We’ll give reasonable help with data protection impact assessments and any consultation with the ICO that relate to Yeardesk.
9. Deletion at the end
The practice’s owners can export all practice data at any time, from Settings → Workspace. When an owner deletes the workspace, it’s hidden straight away, and every owner is emailed. It can be restored within 30 days. After that, we permanently delete the practice data, and it ages out of our backups within a further 30 days. We keep nothing after that unless UK law requires us to.
10. Information and audits
We’ll make available the information the controller reasonably needs to show that we meet these obligations. We’ll answer reasonable written questions first, which usually settles things. If more is needed, we’ll allow an audit by the controller or an auditor it appoints, bound by confidentiality, with at least 30 days’ notice, at the controller’s cost, and no more than once a year unless there has been a personal data breach or the ICO requires it.
11. The controller’s responsibilities
The controller is responsible for:
- having a lawful basis for the practice data it puts into Yeardesk, and telling the people concerned how it uses it;
- making sure its instructions to us are lawful;
- deciding who in the practice has access, and with which role.
12. Liability and contact
Each party’s liability under this addendum is subject to the limits in our terms of service, except where the law doesn’t allow that. Questions about this addendum go to [privacy contact email].