PARTIES TO THIS AGREEMENT
CONTROLLER: The Client engaging Rowville Consulting for accounting services, as detailed in the Master Services Agreement (the "Client").
PROCESSOR: Rowville Consulting (Pty) Ltd, a company registered in Botswana with its principal place of business at Gaborone, Botswana, operating through its website at https://rowvilleconsulting.co.bw (the "Processor").
This DPA is incorporated into and forms part of the Master Services Agreement between the Parties. In case of conflict, this DPA prevails regarding data protection matters.
DEFINITIONS
| Term | Definition |
|---|---|
| UK GDPR | The General Data Protection Regulation as incorporated into UK law by the Data Protection Act 2018. |
| Irish GDPR | The General Data Protection Regulation as applied in Ireland under the Data Protection Act 2018. |
| Personal Data | Any information relating to an identified or identifiable natural person processed under the Agreement. |
| Processing | Any operation performed on Personal Data (collection, recording, storage, etc.). |
| Sub-processor | A third party engaged by Processor to process Personal Data. |
| Data Subject | An individual whose Personal Data is processed (employees, customers, etc. of Controller). |
| Security Incident | Breach of security leading to accidental or unlawful destruction, loss, alteration, or access to Personal Data. |
DETAILS OF PROCESSING
Subject Matter & Duration
Processing of Personal Data necessary to provide the accounting and finance services described in the Master Services Agreement. Duration matches the term of the Agreement plus applicable statutory retention periods.
Nature & Purpose
Processing includes: preparation of management accounts, financial statements, tax computations, payroll processing, bookkeeping, and related advisory services as instructed by Controller.
Types of Personal Data
May include: Employee details (name, salary, contact info), customer/vendor information, financial transaction data, and any other data provided by Controller for accounting purposes.
Categories of Data Subjects
Controller's employees, directors, shareholders, customers, suppliers, and other individuals whose data is included in financial records provided to Processor.
PROCESSOR OBLIGATIONS
Instructions & Compliance
Processor shall only process Personal Data on documented instructions from Controller, unless required by applicable law. Processor shall immediately inform Controller if, in its opinion, an instruction infringes UK/Irish GDPR.
Confidentiality
Processor ensures persons authorised to process Personal Data are subject to confidentiality obligations (contractual or statutory) that survive termination of their engagement.
Security Measures
Processor implements and maintains technical and organisational measures detailed in Appendix 1 to ensure a level of security appropriate to the risk.
Sub-processing
Controller grants general authorisation for Processor to engage Sub-processors listed in Appendix 2. Processor shall provide 30 days' notice of intended changes, giving Controller opportunity to object.
Data Subject Rights
Processor shall assist Controller in responding to Data Subject requests by appropriate technical and organisational measures.
Security Incident Notification
Processor shall notify Controller without undue delay (and in any event within 48 hours) upon becoming aware of a Security Incident. Notifications shall include available details and proposed mitigation steps.
Deletion/Return of Data
At Controller's choice, Processor shall delete or return all Personal Data after termination of services, and delete existing copies unless applicable law requires storage.
Audit Rights
Upon reasonable notice, Processor shall make available to Controller (or its independent auditor) information necessary to demonstrate compliance. Audits shall be conducted at Controller's expense, no more than annually, and subject to confidentiality agreements.
CONTROLLER OBLIGATIONS
Controller warrants that it has lawful basis for processing and necessary notices/consents for Processor to process Personal Data as described herein.
Controller shall provide clear instructions and any necessary cooperation for Processor to perform its obligations.
Controller is responsible for responding to Data Subject requests regarding data processed by Processor.
INTERNATIONAL TRANSFERS
Controller acknowledges that Processor's primary processing operations are in Botswana.
Where UK/Irish Personal Data is transferred to Botswana, such transfer shall be governed by:
- UK International Data Transfer Agreement or Addendum
- EU Standard Contractual Clauses (Module Two: Controller to Processor)
- Supplementary technical measures as detailed in Appendix 1
Processor shall not transfer Personal Data to any third country not covered by adequacy regulations without Controller's prior written consent.
APPENDICES
APPENDIX 1: TECHNICAL AND ORGANISATIONAL MEASURES
| Security Area | Measures Implemented |
|---|---|
| Access Control | Role-based access, Multi-factor authentication, Unique user IDs, Regular access reviews, Principle of least privilege |
| Encryption | AES-256 at rest, TLS 1.3 in transit, Encrypted backups, Key management procedures |
| Physical Security | Secure data centers (via cloud providers), Visitor logs, Access control systems |
| Network Security | Firewalls, Intrusion detection, VPN for remote access, Regular vulnerability scans |
| Incident Response | Documented response plan, 24/7 monitoring, Escalation procedures, Breach notification within 48 hours |
| Business Continuity | Daily encrypted backups, Disaster recovery plan, Regular testing |
| Personnel Security | Background checks, Confidentiality agreements, Security training, Clear desk policy |
APPENDIX 2: AUTHORISED SUB-PROCESSORS
| Sub-processor | Service | Location | Purpose |
|---|---|---|---|
| Microsoft Corporation | Microsoft 365 / Azure | UK/EEA Data Centers | Email, document storage, collaboration |
| Xero (UK) Limited | Xero Accounting Platform | United Kingdom | Cloud accounting software |
| QuickBooks (Intuit) | QuickBooks Online | United Kingdom | Cloud accounting software |
| [Your Cloud Provider] | Infrastructure | [Location] | Data processing infrastructure |
Note: Controller will be notified 30 days before engaging new Sub-processors.
AGREED AND ACCEPTED
FOR AND ON BEHALF OF CONTROLLER
Company Name: ________________________________
Signature: ____________________________________
Name (Print): _______________________________
Title: _______________________________________
Date: ________________________________________
FOR AND ON BEHALF OF PROCESSOR
Rowville Consulting (Pty) Ltd
Gaborone, Botswana
Signature: ____________________________________
Name (Print): _______________________________
Title: _______________________________________
Date: ________________________________________