Data Processing Terms

These Data Processing Terms apply when a customer uses DocStructa to process personal data for which that customer is the controller and DocStructa acts as processor. They form part of the customer's agreement for the DocStructa service.

Roles and instructions

The customer is the controller and DocStructa is the processor for personal data contained in statement conversion results processed on the customer's behalf. DocStructa shall process that data only to provide, secure and support the service and in accordance with the customer's documented use of the service, unless applicable law requires otherwise.

Subject matter and duration

The processing concerns browser-based extraction, review, export and optional retention of structured bank-statement data. Processing continues for the duration of the customer's use of the relevant service and any configured retention period, subject to legally required records.

Types of data and people

Data may include names or identifiers appearing in transaction descriptions, account references, dates, transaction values, balances and other information present in financial statements. Data subjects may include the customer's clients, customers, staff, suppliers, counterparties or other individuals whose information appears in a statement.

Confidentiality and security

DocStructa shall restrict processing to authorised systems and personnel and maintain proportionate technical and organisational safeguards, including access controls, ownership isolation, secure backend operations, local source-file extraction and retention controls.

Subprocessors

The customer authorises DocStructa to use infrastructure and payment subprocessors necessary to provide the service, including Base44 for application infrastructure and Stripe for billing where applicable. DocStructa remains responsible for imposing appropriate data-protection obligations on subprocessors to the extent required by law.

International transfers

Where a subprocessor processes personal data outside the United Kingdom, DocStructa shall rely on an applicable lawful transfer mechanism and contractual safeguards provided by that subprocessor where required.

Data-subject requests and regulatory assistance

Taking account of the nature of the processing, DocStructa shall provide reasonable assistance to the customer with data-subject rights, security obligations and regulator enquiries where the customer cannot reasonably fulfil the request without DocStructa's assistance.

Security incidents

DocStructa shall notify the affected customer without undue delay after becoming aware of a personal-data breach affecting data processed for that customer and shall provide information reasonably available to assist the customer's response obligations.

Deletion and return

Customers can export results and delete retained History. At the end of processing, retained structured results are deleted in accordance with the configured retention controls or account deletion process, except where law requires continued retention of specific records.

Audit information

DocStructa shall make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Any audit request shall be proportionate, protect other customers' confidentiality and avoid unnecessary disruption.