Data Processing Addendum

For Canadian engagements (PIPEDA) · Certa Finance · Kolkata, India

This DPA is required for all Canadian client engagements and available for US engagements on request. Email hello@certafinance.com to receive a countersigned copy.

This Data Processing Addendum ("DPA") forms part of the Service Agreement between Certa Finance ("Processor") and the CPA firm ("Controller") and governs the processing of personal data in connection with bookkeeping and advisory services.

1. Scope

This DPA applies to all personal data of your clients' customers, employees, or other individuals that Certa Finance processes in the course of delivering contracted services.

2. Processing Instructions

Certa Finance processes personal data only on documented instructions from the Controller (i.e., within the scope of the contracted services). No data is processed for any other purpose.

3. Security Measures

AES-256 encryption for all data in transit and at rest
Access limited to assigned engagement personnel only
No data stored on personal devices
All subcontractors bound by equivalent obligations

4. Data Retention & Deletion

All personal data is deleted or returned to the Controller within 14 days of engagement termination. Deletion certificates available on request.

5. Breach Notification

Certa Finance will notify the Controller of any data breach within 48 hours of discovery, including the nature of the breach, data affected, and remedial steps taken.

6. PIPEDA Compliance

Certa Finance acknowledges and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) for all engagements involving Canadian personal data.

7. Contact

hello@certafinance.com