ClearingHouse

Data Processing Agreement

Last updated: 3rd July 2026

This Data Processing Agreement ("DPA") is an addendum to our Terms of Service and applies where you, the customer ("Data Controller"), use ClearingHouse to process personal data on behalf of your clients.

This is most relevant if you are an accountant or bookkeeper using ClearingHouse to sync your clients' financial data. In that case, you are the data controller and Double Three Digital Limited ("Data Processor", "we", "us") processes data on your behalf.

This DPA is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Definitions

  • Personal Data — any information relating to an identified or identifiable natural person, as defined in the UK GDPR.
  • Processing — any operation performed on personal data, including collection, storage, retrieval, use, and deletion.
  • Data Controller — you, the customer, who determines the purposes and means of processing personal data.
  • Data Processor — Double Three Digital Limited, who processes personal data on behalf of the Data Controller.
  • Sub-processor — a third party engaged by us to process personal data on your behalf.

What Data We Process

When you connect your clients' accounts, we process the following categories of personal data from their payment processor:

  • Customer names and email addresses (as they appear on invoices and charges).
  • Transaction data (invoices, payments, refunds, fees, and payouts).

This data is processed solely to sync it into the connected accounting software.

Our Obligations as Data Processor

  1. We will only process personal data in accordance with your instructions and as necessary to provide the Services. We will not process personal data for any other purpose.
  2. We will maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These are described in our Privacy Policy and Security page.
  3. We will ensure that any person authorised to process personal data is bound by obligations of confidentiality.
  4. We will assist you, where reasonably possible, in responding to data subject requests (such as access, correction, or deletion requests).
  5. We will assist you in meeting your obligations regarding data protection impact assessments and prior consultation with supervisory authorities, where applicable.
  6. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach that affects data processed on your behalf.
  7. We will delete or return all personal data upon termination of the Services, unless retention is required by law. Backups containing personal data may persist for up to 30 days after deletion.

Sub-processors

We use the following sub-processors to provide the Services:

  • Hetzner (Nuremberg, Germany) — infrastructure and hosting.
  • Laravel Forge — server provisioning and management.
  • Amazon Web Services (AWS S3, London) — encrypted offsite backups.
  • Stripe — we connect to your clients' Stripe accounts to retrieve transaction data.
  • FreeAgent — we connect to your FreeAgent account to create and update accounting records.
  • Bento — transactional email delivery.

We will notify you before adding or replacing a sub-processor. If you object to a new sub-processor, you may terminate the Services by cancelling your subscription.

Your Obligations as Data Controller

  1. You are responsible for ensuring that you have a lawful basis for processing your clients' personal data and for sharing it with us.
  2. You are responsible for providing appropriate privacy notices to your clients, informing them that their data will be processed by ClearingHouse.
  3. You are responsible for responding to data subject requests from your clients. We will assist you where reasonably possible.
  4. You must notify us promptly if you become aware of any data breach or suspected breach involving data shared with us.

Data Retention and Deletion

We retain personal data only for as long as necessary to provide the Services. Activity logs are automatically deleted after 90 days. Webhook data is automatically deleted after 7 days.

When you delete your account or disconnect a client's accounts, we will delete the associated personal data. Backups may persist for up to 30 days. Data already synced to your accounting software will remain there — we do not automatically remove it as part of account deletion.

Audits

Upon reasonable request, we will provide you with the information necessary to demonstrate our compliance with this DPA. This may include a summary of our security measures, data processing activities, and sub-processor arrangements.

Liability

Each party's liability under this DPA is subject to the limitations set out in our Terms of Service.

Governing Law

This DPA is governed by the laws of Scotland, consistent with our Terms of Service.

Contact

If you have questions about this DPA, email us at [email protected].