Ayiza legal and privacy statements

Data Processing Agreement

Last updated: 10 October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Ayiza Software Labs Limited, a company registered in England and Wales with company number 12718749 and its registered office at 1 World Business Centre Heathrow, Newall Road, London Heathrow Airport, Hounslow, England, TW6 2AS (“Ayiza”, “we”, “us”) and the customer that subscribes to the Ayiza services (“Customer”, “you”) under our Terms of use (the “Agreement”). It applies whenever we process personal data on your behalf while providing the services. If this DPA conflicts with the Agreement, this DPA prevails for the processing of personal data.

1. Definitions

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced from time to time, and, where they apply to the processing, the EU GDPR and the national laws that implement it.

“Customer Personal Data” means personal data that you or your users enter, upload, import, connect or generate in the services, including through the AI assistant, the Telegram and email channels and the MCP server, and that we process on your behalf.

“Subprocessor” means a third party we engage to process Customer Personal Data. “Personal Data Breach”, “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in Data Protection Law.

2. Roles

2.1 You are the controller of Customer Personal Data, and we are your processor.

2.2 If you use the services to process personal data on behalf of your own clients, for example as an accountant, you are their processor and we are your subprocessor. You confirm that your clients have authorised you to appoint us on the terms of this DPA.

2.3 We are a controller, not a processor, for the personal data we need to run our relationship with you, such as your users’ account details, billing information and usage records. Our privacy notice explains that processing.

3. Our obligations

We will:

  • process Customer Personal Data only on your documented instructions. Your instructions are this DPA, the Agreement, and your use and configuration of the services, including the features you or your users switch on, such as the AI assistant, the Telegram and email channels, the MCP server and submissions to HMRC and Companies House. We will tell you if we believe an instruction infringes Data Protection Law;
  • process Customer Personal Data for any other purpose only where UK law requires us to, and tell you before we do so unless that law prohibits it;
  • ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality;
  • implement the technical and organisational measures described in Annex 2 and keep them appropriate to the risk;
  • help you, by appropriate technical and organisational measures, to respond to requests from data subjects who exercise their rights. If we receive such a request directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to;
  • help you meet your obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to us;
  • notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, give you the information you reasonably need to meet your own obligations, and update you as more information becomes available;
  • not use Customer Personal Data for our own purposes, and not use it to train AI models;
  • make available to you the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits take place on at least 30 days’ notice, at most once a year unless a Personal Data Breach or a regulator requires otherwise, and under reasonable confidentiality obligations.
4. Subprocessors

4.1 You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

4.2 We will give you at least 30 days’ notice before we add or replace a Subprocessor, by updating that page and by email to the administrators of your Ayiza account.

4.3 You may object to a new Subprocessor on reasonable data protection grounds within that notice period. We will then work with you in good faith to find a solution. If we cannot find one, you may terminate the affected services by written notice.

4.4 We will impose on each Subprocessor, by written contract, data protection obligations that give at least the protection this DPA requires. We remain liable to you for the performance of our Subprocessors’ obligations.

5. AI features and connected services

5.1 When your users use the AI assistant through Ayiza’s own access to AI models, we send the question and the Customer Personal Data the assistant needs to answer it to the AI model provider that processes the request. These providers are Subprocessors and are listed on the Subprocessors page.

5.2 If you connect your own AI provider account with your own API key, that provider processes the data under your own contract with it. It is not our Subprocessor.

5.3 Telegram, and any other third-party messaging service your users choose to connect to the assistant, processes messages under its own terms. Your users send messages through such a service on your instruction, and the service is not our Subprocessor. Messages between a user and a Telegram bot are not end-to-end encrypted.

5.4 AI tools that your users connect through the MCP server act for the user the API key belongs to, with that user’s access. The provider of such a tool is not our Subprocessor.

5.5 HMRC, Companies House and other public authorities that receive submissions you make through the services are independent controllers, not Subprocessors.

6. International transfers

6.1 We will transfer Customer Personal Data outside the UK, or allow a Subprocessor to do so, only where the transfer complies with Data Protection Law. We rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified US organisations, or on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, together with any supplementary measures that are needed.

6.2 The Subprocessors page shows where each Subprocessor processes data and the safeguard we rely on.

7. Your obligations

You will:

  • have a lawful basis for the processing and give data subjects the information Data Protection Law requires, including that you use Ayiza and its AI features;
  • make sure your instructions to us comply with Data Protection Law;
  • not enter special category data or criminal offence data into the services unless you need to for your bookkeeping or tax filing and you have a lawful basis for it;
  • decide, through the roles and settings in the services, which of your users may use the AI assistant, the Telegram and email channels and the MCP server.
8. Return and deletion

8.1 When the Agreement ends, we will delete Customer Personal Data within [90] days, unless UK law requires us to keep it. If you ask us before the Agreement ends, we will first return a copy of your records to you.

8.2 Our database backups are kept for 35 days and are then overwritten. We restore data from backups only to recover the services.

9. Liability, duration and law

9.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Law does not allow them.

9.2 This DPA applies for as long as we process Customer Personal Data.

9.3 This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about it.

Annex 1: Details of the processing

Subject matter and duration: the provision of the Ayiza accounting, tax filing and AI assistant services for the term of the Agreement and the deletion period in section 8.

Nature and purpose: storing, organising, calculating, displaying, exporting and transmitting accounting records; preparing and submitting returns to HMRC and Companies House; answering users’ questions and carrying out actions through the AI assistant; delivering messages through the channels you enable; giving access through the MCP server; and support at your request.

Categories of data subjects: your users; your customers, suppliers and their contact persons; employees, directors and other officers whose details appear in your records or filings; you, where you are a sole trader or a partnership; and anyone named in documents you upload.

Types of personal data: names and contact details; postal addresses; bank account details and bank transactions; invoices, bills, receipts and other documents and their contents; tax references such as VAT registration numbers and Unique Taxpayer References; details of company officers needed for filings; questions, messages and attachments sent to the AI assistant, including through Telegram and email; the Telegram accounts and email addresses linked to your users; and logs of the actions taken by your users and by the assistant.

Special category data: none intended; see section 7.

Annex 2: Technical and organisational measures

We protect Customer Personal Data with the following measures, and review them as the services change.

  • Hosting: the services run in Microsoft Azure data centres in the UK (UK South), inside a private network. The database and the cache cannot be reached from the internet.
  • Encryption: all public connections use HTTPS. Connections to file storage and the cache require TLS 1.2 or later. The Azure platform encrypts the database and file storage at rest. Application secrets are kept in Azure Key Vault, and the secrets behind two-step sign-in are stored encrypted.
  • Sign-in: passwords are stored only as salted PBKDF2-SHA256 hashes with 600,000 iterations. Every user can turn on two-step sign-in with an authenticator app or email codes, with recovery codes. Repeated failed sign-ins are slowed down, and users are alerted when their account is used from a new device.
  • Access control: access within a customer account is role-based. The AI assistant can only use the functions that both the asking user and the assistant’s own role are allowed to use, and it asks for approval before it posts, reverses or deletes records. Each MCP API key has exactly the access of the user it belongs to.
  • Separation: customer data is separated logically: every record carries the identifier of the customer account it belongs to, and the services only return records of the signed-in customer account.
  • Audit trail: every record stores when it was created and last changed, and by whom, including a marker when the AI assistant made the change. The assistant’s action log is kept for 90 days.
  • Resilience: the database can be restored to any point in the last 35 days, from backups that are also copied to a second UK region (UK West).
  • Monitoring: application logs are kept for 30 days. Error monitoring is configured not to collect personal data by default.
  • Administration: administrative access to the hosting environment goes through a single jump server that accepts connections from one approved address only.
Annex 3: Subprocessors

The current list is on our Subprocessors page.