PLAIN ACCOUNTS LEGAL CENTRE
Data processing terms
These terms apply when Plain Accounts processes personal data for a customer business.
1. Roles and instructions
The customer acts as controller or business and Plain acts as processor or service provider for workspace data. Processing is limited to providing, securing and supporting the contracted service on documented instructions.
2. Confidentiality and security
Authorised personnel are subject to confidentiality. Plain applies appropriate technical and organisational safeguards and provides notice of a confirmed personal-data breach without undue delay as required by law.
3. Assistance
Taking account of the processing, Plain assists with rights requests, security assessments, breach duties, impact assessments and regulator enquiries.
4. Subprocessors and transfers
Published subprocessors are bound by written obligations. Applicable EU or UK standard contractual clauses and supplementary safeguards support restricted international transfers where required.
5. Return, deletion and audit
Available export tools support return of data. Deletion follows termination, legal retention and backup-expiry requirements. Plain provides information reasonably necessary to demonstrate compliance under proportionate confidentiality controls.
6. Jurisdiction and local rights
These documents are governed by the law stated in the Terms of service, subject to mandatory privacy, consumer and data-protection rights in the customer’s country. Customers operating outside Australia should obtain advice about obligations specific to their activity and location.