Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Agreement between Simple Financial Solutions Limited ("Processor", "Foxel") and the Customer ("Controller"). It applies when Foxel processes Personal Data on behalf of the Controller.

1. Definitions

Terms not defined here have the meaning given in the GDPR, UK Data Protection Act, and California CPRA as applicable.

2. Subject matter and duration

Foxel processes Personal Data for the duration of the Services and to fulfill the Services described in the Agreement.

3. Nature and purpose of processing

Bookkeeping, tax preparation, payroll administration, document storage, e-signatures, CRM, invoicing, and ancillary administrative services.

4. Categories of data subjects and personal data

Data subjects: Customer's employees, contractors, clients, vendors, representatives, and other individuals whose Personal Data is submitted to the Services.
Categories of data: Identity, contact, financial, tax, document contents, usage, and any Sensitive Personal Information uploaded by Customer (including SSNs for tax engagements, protected by §7216).

5. Foxel obligations

Foxel will:

Process Personal Data only on documented instructions from the Controller (including the Agreement).
Ensure persons authorized to process the Personal Data are under confidentiality obligations.
Implement the technical and organizational security measures described in Annex A.
Assist Controller in responding to data subject requests.
Delete or return Personal Data at the end of the Services, subject to statutory retention periods.
Make available information necessary to demonstrate compliance.

6. Sub-processors

Controller authorizes Foxel to engage the sub-processors listed at https://foxelfin.com/en/legal/sub-processors. Foxel will notify Controller of new or replacement sub-processors with 30 days' notice; Controller may object on reasonable data-protection grounds.

7. International transfers

Transfers from the EEA/UK/Switzerland rely on the Standard Contractual Clauses (Module Two: Controller to Processor) incorporated by reference. For US-recipient sub-processors, additional supplementary measures (encryption, access controls) are applied.

8. Audit rights

Controller may audit Foxel's compliance once per year on 30 days' written notice during business hours, limited to information strictly necessary. Foxel's current SOC 2 report (when available) will satisfy audit requirements.

9. Breach notification

Foxel will notify Controller without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data Breach affecting Controller's Personal Data.

10. Return / deletion

Within 30 days of termination, Foxel will delete or return all Personal Data at Controller's option, subject to any statutory retention obligations.

11. Annex A — Technical and organizational measures

Encryption at rest (AES-256) and in transit (TLS 1.2+)
Role-based access controls with least-privilege defaults
Multi-factor authentication for all staff
Written Information Security Program (WISP) under FTC Safeguards Rule
Vendor review and sub-processor DPAs
Immutable audit log of all mutations
Nightly encrypted backups, geographically redundant
Annual security and privacy training for all staff
Incident response plan with 24-hour internal escalation
Vulnerability scanning and dependency monitoring

12. Contact

Data Protection: privacy@foxelfin.com · Simple Financial Solutions Limited · 10101 S. Roberts Rd. STE 202 · Palos Hills, IL 60465 · EIN 86-2098028

This DPA is governed by Illinois law and the arbitration provisions of the Agreement.