Data Processing Agreement

Last updated: October 2026

ExpensePlus Ltd (company number 09404009)

Effective from the date your organisation accepts the Terms of Service

1. Background and scope

1.1 This Data Processing Agreement (DPA) forms part of the ExpensePlus Terms of Service (the Terms) between ExpensePlus Ltd, registered office Headingley Enterprise & Arts Centre, Bennett Road, Leeds, England, LS6 3HN (ExpensePlus, we, us), and the organisation that has opened an ExpensePlus account (the Customer, you).

1.2 It applies whenever we process Customer Personal Data on your behalf in providing The Service. For that processing, you are the controller and we are the processor.

1.3 This DPA does not cover personal data that we process as a controller for our own purposes, such as billing your subscription, carrying out Plan Checks, our own marketing, our internal administration and the analysis of Service Usage Data described in clauses 3.5 and 3.6. That processing is described in our Privacy Policy.

1.4 If there is a conflict between this DPA and the Terms on a data protection matter, this DPA prevails.

1.5 You accept this DPA when you accept the Terms. No separate signature is needed. A copy is available at https://expenseplus.co.uk/legal/dpa and we will supply a copy confirming your acceptance on request.

3. Processing on your instructions

3.1 We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If the law requires us to process it in another way, we will tell you before we do so unless the law forbids that.

3.2 You instruct us to process Customer Personal Data to provide The Service as described in the Terms and in Annex 1. Your instructions also include how you use and configure The Service, including whether you enable or disable our access to your data in your account settings, and any further written or verbal instructions from your authorised users that are consistent with the Terms. Your instructions also include our monitoring of the health, performance and security of your account, as described in clause 3.8 and Annex 1.

3.3 Our support team views Customer Personal Data only when needed to answer a support request started by one of your active users, or to review a flagged Plan Check as described in clause 3.6. You can switch this access off in The Service. If you do, we can give only general support, such as advice and links to our help guide, and we will not review your records for a Plan Check. All user activity, including that of our support team, is logged.

3.4 We will not use Customer Personal Data for our own purposes, sell it, or pass it to third parties except as set out in this DPA or on your instructions (other than Service Usage Data and Plan Checks, which clauses 3.5 and 3.6 cover).

3.5 We analyse Service Usage Data for our own purposes, including to understand when and how The Service is used, plan capacity, improve The Service and its security, and support our customers. This includes aggregated statistics (for example, the number of active users in a period, the most common operating systems and weekly activity patterns) and internal reports that rank users or organisations by activity. For this analysis we act as a controller, as described in our Privacy Policy. In doing so we will:

1. use only Service Usage Data, and never the content of the records, files or notes you enter into The Service (other than for Plan Checks under clause 3.6);
2. not use it to market to your users, or to sell it or share it with third parties in a form that identifies you or your users; and
3. publish or share statistics outside ExpensePlus only in a form that cannot identify you, your users or any other individual.

3.6 We carry out Plan Checks for our own billing purposes, so for that processing we act as a controller, as described in our Privacy Policy. A Plan Check:

1. uses only the amounts and dates of the income you have recorded, and not the names or other details of donors, payees, suppliers or other individuals. We may also compare the totals with figures published on public charity registers;
2. is carried out automatically by The Service. If it shows that your income is above your plan, and you have enabled our support team’s access to your account, a member of our team may review the income records that make up the total, to see whether any have been recorded incorrectly (for example duplicated, wrongly dated or wrongly categorised entries). They will look only at what is needed for that purpose, and their access is logged. If you have not enabled that access, we will not review your records and will ask you to check them yourself. Our staff will also look at your records about a plan query if you ask us to;
3. produces totals, which we use only to decide whether your plan is correct, to tell you if it is not and to bill you correctly, and we keep those totals only as long as needed for that; and
4. is not used for any other purpose.

3.7 If we think an instruction infringes Applicable Data Protection Law, we will tell you promptly. We may pause the instruction until you confirm or change it.

3.8 Monitoring the health and security of your account is part of providing The Service to you. It includes processing Customer Personal Data to detect, investigate and prevent security incidents, unauthorised access, fraud and misuse; to identify and fix faults and performance problems; and to keep The Service available and working properly, including through automated logging and alerts. We use Customer Personal Data for this monitoring only for the benefit of your account and the security of The Service. We will not use it for marketing or profiling, or for any purpose other than this monitoring.

4. Your responsibilities

4.1 You are responsible for the lawfulness of your use of The Service, including having a lawful basis for the personal data you enter, giving data subjects the information they are entitled to, and keeping the data accurate.

4.2 You must make sure your instructions comply with Applicable Data Protection Law, and that your users keep their login details secure and use The Service in line with the Terms.

4.3 Nothing in this DPA relieves you of your own obligations as a controller.

5. Special category and criminal offence data

5.1 The Service does not require you to enter special category data or criminal offence data. However, some fields (such as notes) accept free text, so this kind of data could be entered.

5.2 You are solely responsible for deciding whether to enter this kind of data into The Service. You are also responsible for identifying a valid condition under Article 9 of the UK GDPR (and, where needed, a condition in Schedule 1 of the Data Protection Act 2018), and for making sure the data is necessary and proportionate. We recommend you do not enter it into free-text fields unless you need to.

5.3 We do not review the content of the fields you complete, and we are not responsible for the lawfulness of your decision to enter special category or criminal offence data.

5.4 If such data is held in The Service, we will protect it using the security measures in Annex 2 like all other Customer Personal Data. Nothing in this clause reduces our own obligations as a processor under this DPA.

6. Confidentiality

6.1 We will make sure everyone who has access to Customer Personal Data on our behalf is bound by a duty of confidence and has authority to process it. Access is limited to staff who need it to provide, secure or support The Service.

7. Security

7.1 We will put in place appropriate technical and organisational measures to protect Customer Personal Data, in line with Article 32 of the UK GDPR, taking into account the nature of the data and the risks. Our measures at the date of this DPA are in Annex 2.

7.2 We may update those measures over time, but we will not make changes that reduce the overall level of security.

8. Sub-processors

8.1 You give us general written authorisation to use the Sub-processors listed at https://expenseplus.co.uk/legal/sub-processors, as updated under clause 8.4.

8.2 We will have a written contract with each Sub-processor that imposes data protection obligations that are no less protective than those in this DPA. We remain responsible to you for how each Sub-processor carries out its obligations.

8.3 Some Sub-processors are used only if you choose a particular feature.

• Stripe is used only if you enable card payments from your own payers

The Sub-processors listed at https://expenseplus.co.uk/legal/sub-processors state when each is used.

8.4 We will give you at least 30 days’ notice before we add or replace a Sub-processor. We will do this by updating our Sub-processors page and emailing your account contact.

8.5 You may object on reasonable data protection grounds by writing to us within that 30-day period. We will talk with you in good faith to resolve your concern. If we cannot, you may cancel your subscription at any time before the change takes effect, without penalty. This means we will not charge any cancellation fee, or any further subscription fees after you cancel. Access to The Service ends when you cancel, and we will not refund fees you have already paid. You can therefore choose to cancel as late as the day before the change takes effect.

8.6 If we need to replace a Sub-processor urgently for security or service continuity reasons, we may do so with shorter notice. We will tell you as soon as we can, and clause 8.5 still applies.

9. International transfers

9.1 The core Service is hosted in the UK. Our primary servers are with Linode Akamai, and our backup servers are with Amazon Web Services (AWS), in a separate UK data centre.

9.2 We will not make a Restricted Transfer except to the Sub-processors in Annex 3 that process data outside the UK, and only where there is a lawful transfer mechanism in place. That means UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Annex 3 gives the location and mechanism for each Sub-processor.

9.3 If a transfer mechanism stops being valid, we will work with the Sub-processor to put an alternative in place. If we cannot, we will stop using that Sub-processor for the affected feature and tell you.

10. Data subject rights

10.1 Taking into account the nature of the processing, we will help you respond to requests from data subjects exercising their rights under Applicable Data Protection Law. The Service includes functions to find, correct, export and delete data, and we will provide reasonable additional help where those functions are not enough, within 14 working days of your request. For erasure requests, we will delete or anonymise the individual’s personal data in the live system. Where you must keep a record for legal or accounting reasons, we can redact the personal fields and keep the underlying record. Erased data may remain in our backups until they expire (see Annex 2).

10.2 If a data subject contacts us directly about Customer Personal Data, we will not respond except to say that we will pass the request on. We will send it to you within 5 working days.

11. Assistance with your other obligations

11.1 We will give you reasonable assistance with your obligations on security of processing, data protection impact assessments and prior consultation with the Information Commissioner (Articles 32 to 36 of the UK GDPR), taking into account the nature of the processing and the information available to us. This includes the information in this DPA and Annex 2.

11.2 Routine assistance is part of The Service. If a request needs a significant amount of extra work, we may charge reasonable costs, and we will tell you before we start.

12. Personal data breaches

12.1 We will tell you without undue delay, and in any event within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data.

12.2 We will send the notification to your system administrator contact. It will include, as far as we know it: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and what we have done or propose to do. If we cannot provide everything at once, we will provide it in stages.

12.3 We will take reasonable steps to contain the breach, investigate it, and help you meet your obligations to notify the Information Commissioner and data subjects.

12.4 You decide whether to notify the regulator or data subjects. We will not do so on your behalf unless the law requires it.

13. Return and deletion

13.1 Before you cancel, you can download your data using The Service’s export functions. If you ask during the cancellation process, we will also send you copies of the documents you have uploaded, such as receipts and invoices.

13.2 When your subscription ends, for any reason, we will delete all Customer Personal Data from our live systems within 30 days, and from our backups within 60 days, unless clause 13.3 applies.

13.3 We may keep Customer Personal Data after that only if the law requires it. If so, we will tell you what we keep and why, keep it secure, and use it only for that purpose.

13.4 We will confirm in writing that deletion is complete if you ask.

13.5 If a free trial ends without your Organisation subscribing, we will delete all Customer Personal Data in the trial account from our live systems within 30 days after the trial ends, and from our backups within 60 days after it ends. Clauses 13.3 and 13.4 apply to that deletion.

14. Audit and information

14.1 We will give you the information reasonably needed to show that we comply with this DPA. On request, we will share our current Cyber Essentials certificate and the attestation from our most recent annual independent penetration test.

14.2 We will answer reasonable security questionnaires from you, up to once every 12 months.

14.3 If that information is not enough, or if there has been a personal data breach, or a regulator requires it, you (or an independent auditor you appoint) may audit our compliance with this DPA. You must give us at least 30 days’ written notice, carry out the audit during working hours with as little disruption as possible, keep what you learn confidential, and bear the costs. Audits may take place once every 12 months, except where a regulator requires otherwise or following a personal data breach. They do not extend to other customers’ data or to our Sub-processors’ own premises. For Sub-processors, we will share the audit reports and certifications that they make available to us.

15. Liability

15.1 Each party’s liability under or in connection with this DPA is subject to the limits and exclusions in the Limitation of Liability section of the Terms.

15.2 Nothing in this DPA limits any liability that cannot be limited by law, or any right a data subject has against either party under Article 82 of the UK GDPR.

16. Term, changes and contact

16.1 This DPA lasts for as long as we process Customer Personal Data on your behalf, including the deletion period in clause 13.2.

16.2 We may update this DPA to reflect changes in law, in The Service or in our Sub-processors. We will give you at least 30 days’ notice of material changes, and no change will reduce the protection of Customer Personal Data. If you do not agree to a material change, you may cancel your subscription at any time before it takes effect, without penalty, as set out in the Terms.

16.3 This DPA, and any dispute arising from it, is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

16.4 For data protection questions, data subject requests and personal data breach matters, contact dpo-contact@expenseplus.co.uk. For general support, contact support@expenseplus.co.uk.