Data processing agreement

This agreement is between Graaph Technologies (Pty) Ltd (“we”) and the practice or business that holds a Tallied Books workspace (“you”). It applies to the personal information we process for you through Tallied Books: what is in the documents, statements, requests, messages and records in your workspace, about your clients, their staff, suppliers and customers, and your own staff. The Protection of Personal Information Act (POPIA) protects juristic persons as well as natural persons, and so does this agreement.

You are the responsible party for your practice’s memberships and its own records. A membership holds a person’s role, client access, active and owner status, email preferences and last sign-in at your practice. For your clients’ documents you usually process their information under your engagement with them. Either way, you decide why and how that information is processed, and we act only for you, as your operator or as your sub-operator.

Each person’s shared Tallied Books login is separate from those memberships. We are the responsible party for its email address, name, password hash and sign-in records, and for our practice account and billing information, as our privacy notice describes. One login and password serve all the person’s practices. You manage access through your own memberships; you cannot change a person’s login name, email or password, or lift its lockout. You may correct an invitation address only for a login that has never been accepted.

We process your personal information only to provide, secure and support Tallied Books as you set it up and use it, as the terms of service and this agreement say, and as you otherwise instruct us in writing (section 20(a)). Using a feature is an instruction: connecting Xero or Sage, for example, instructs us to send the records you approve there.

If we believe an instruction would break POPIA, we will tell you and need not follow it. We do not use your personal information for our own purposes, sell it, use it for advertising, or use it to train machine-learning models.

We treat your personal information as confidential (section 20(b)). We disclose it only to sub-operators under this agreement, or where the law requires us to; then we tell you first, unless the law forbids it. Everyone who works for us and can reach it is bound to confidentiality.

Our support team opens your workspace only through a support session that one of your administrators grants, for the time granted, and what they do there is recorded in your audit log. People who run our infrastructure do not open your documents or records, except to restore or secure the service or where the law requires it.

We maintain the technical and organisational measures in Annex A. We identify the foreseeable risks to your personal information, check regularly that the measures work, and update them as risks change (section 19). We may change a measure, but never so that it protects your information less.

• You authorise us to use the sub-operators on the sub-operator register, for the purposes it lists.
• Each is bound by a written agreement that requires it to protect your personal information with security measures as section 19 requires, to process it only for us, and to limit any further transfer (sections 21 and 72).
• We email your workspace’s administrators at least 30 days before we add or replace a sub-operator, and update the register. Within that time you may object on reasonable grounds of data protection. We will try to resolve the objection, for example by not sending your workspace’s information to that sub-operator. If we cannot, you may end your subscription before the change applies, and we will refund fees paid for the time after it.
• We remain responsible to you for what our sub-operators do with your personal information.

Your workspace’s records and files are stored in South Africa. We send personal information outside South Africa only to the sub-operators that the register lists for it, only what that purpose needs, and only to a recipient bound by an agreement that gives it an adequate level of protection, substantially similar to POPIA’s conditions and including rules on any further transfer (section 72(1)(a)). The register names each country.

Files and bank statements are never sent outside South Africa. The reader abroad receives only text read from a receipt or invoice, with card numbers, long numbers, email addresses and contact details masked first. The app’s notifications reach your client’s phone through Apple or Google, once your client turns them on: each carries the phone’s notification token, your practice’s name and a short line, which for a new request or a reminder is the request’s title. Keep a request’s title to what the document is, because it shows on your client’s lock screen.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we notify you immediately (section 21(2)), by email to your workspace’s administrators. We tell you what happened, which information and which of your clients are affected as far as we know, what we have done about it, and whom to contact, and we keep you updated as we learn more.

We help you notify the Information Regulator and the people affected, as section 22 requires of you. We do not notify your clients ourselves unless you ask us to or the law requires it.

Your staff can find, correct and export the records in your workspace, which answers most requests for access or correction under sections 23 and 24. If we receive a request about your memberships or workspace records directly, we pass it to you without delay and do not answer it ourselves unless you ask us to. We help you with other requests, and with questions from the Information Regulator, as far as is reasonable.

We handle requests about a person’s shared login ourselves under our privacy notice.

Tallied Books is made for business financial documents, not for recording health, religious, biometric or criminal information, or information about children. A document may show such details by chance, as a pharmacy receipt can. We process them only as part of that document, with the same protection as everything else. Do not upload documents whose purpose is to record special personal information or information about children.

We keep your personal information while your workspace is open. When it closes, its staff and clients lose access straight away and you have 90 days to export everything. We then delete your personal information and files from Tallied Books; copies in our backups are deleted as those backups expire. We keep our tax invoices to you, which carry your practice’s details, for as long as tax law requires.

Deleting a person’s shared login at their request ends its sessions, deactivates its memberships in every practice and anonymises its identity, including the name shown in your records. It does not delete your documents, client records or audit history; those remain your practice’s records under this agreement. Deactivating a membership or closing your workspace does not delete the person’s shared login.

Once a year, or after a security compromise, you may ask us for information that shows we meet this agreement: the measures in force, the sub-operator register and the agreements we rely on, and our sub-operators’ independent audit reports where they make them available. Write to privacy@talliedbooks.co.za. An inspection on our premises needs our agreement on its scope and timing, and is at your cost.

This agreement lasts for as long as we process your personal information, including after your subscription ends. Where it deals with personal information and the terms of service say something different, this agreement applies. The terms of service’s liability section applies to this agreement too.

• Location. The application, its database, files, queues, keys and logs run in Google Cloud’s Johannesburg region. Email is sent from Cape Town. Every document is read there by our own reader, and files never leave South Africa: when the reader cannot settle a receipt or invoice, only the text it read, masked, goes to the reader abroad the register names. The app’s notifications go to a client’s phone through Apple or Google, and expire after a day.
• Separation between workspaces. Every practice record carries its workspace. The application filters every query by it and refuses to save a record into another workspace, and the database’s row-level security refuses any read or write outside the signed-in workspace.
• Encryption. Information is encrypted in transit and at rest. PDF passwords and accounting connection tokens are encrypted again by the application before they are stored.
• Signing in. One login and password serve a person’s practices, with a separate session for each workspace. Access tokens last ten minutes and sessions can be ended at once. Session cookies cannot be read by scripts, and changes are protected against cross-site requests. Five wrong passwords at either sign-in address lock the shared login for fifteen minutes. A password change or reset ends its sessions everywhere.
• Roles. Every request is authorised on the server by the person’s role. Clients see only their own documents and requests.
• Our access. Support works only through sessions your administrators grant, recorded in your audit log. Our own console sees workspace totals, never documents or figures.
• Records of activity. An audit log of significant actions, which your administrators can read and export. Our application logs hold identifiers only: never document contents, amounts, account or ID numbers, passwords or tokens.
• A person decides. Nothing is posted to accounting software until someone in your workspace approves it.
• Testing. Changes are tested before release, including automated tests that one workspace cannot reach another’s records.