Data Processing Agreement

1. Introduction and Scope

1.1 Purpose

This Data Processing Agreement governs the processing of personal data by Finance Forecaster ("Data Processor" or "we") on behalf of users ("Data Controllers" or "you") in accordance with applicable data protection laws.

1.2 Definitions

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data, including collection, storage, analysis, and deletion
• Data Subject: The individual whose personal data is being processed
• Data Controller: The entity that determines the purposes and means of processing (typically the user)
• Data Processor: The entity that processes personal data on behalf of the controller (Finance Forecaster)

2. Data Processing Details

2.1 Subject Matter and Duration

• Subject Matter: AI-powered financial forecasting and analysis services
• Duration: For the duration of the service agreement and applicable retention periods
• Nature of Processing: Collection, storage, analysis, and deletion of financial and personal data

2.2 Categories of Personal Data

Data Category	Data Types	Processing Purpose
Account Data	Name, email, password hash	User authentication and account management
Financial Data	Account balances, transaction history, account numbers	Financial analysis and forecasting
Technical Data	IP addresses, device information, usage logs	Service provision and security monitoring
Communication Data	Support messages, AI chat interactions	Customer support and service improvement

2.3 Categories of Data Subjects

• End Users: Individuals who use Finance Forecaster for personal financial management
• Business Users: Individuals using the service for business financial management
• Support Contacts: Individuals who contact our customer support

3. Data Processing Principles

3.1 Lawful Basis for Processing

We process personal data based on the following legal grounds:

• Consent: Explicit consent for financial account access and AI analysis
• Contract Performance: Processing necessary to provide our services
• Legitimate Interest: Service improvement, security monitoring, and fraud prevention
• Legal Obligation: Compliance with applicable financial regulations

3.2 Data Processing Principles

All personal data processing adheres to these principles:

• Lawfulness: Processing only occurs on valid legal grounds
• Fairness: Processing does not adversely affect data subjects
• Transparency: Clear information about processing activities
• Purpose Limitation: Data used only for specified, legitimate purposes
• Data Minimisation: Only necessary data is collected and processed
• Accuracy: Data is kept accurate and up to date
• Storage Limitation: Data retained only as long as necessary
• Security: Appropriate technical and organizational security measures

4. Data Security and Technical Measures

4.1 Security Measures

Finance Forecaster implements comprehensive security measures:

Technical Safeguards:

• Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
• Access Controls: Multi-factor authentication and role-based access
• Network Security: Firewalls, intrusion detection, and DDoS protection
• Data Anonymization: Anonymization of data used for analytics

Organizational Safeguards:

• Staff Training: Regular data protection and security training
• Access Policies: Strict need-to-know access policies
• Audit Procedures: Regular security audits and penetration testing
• Incident Response: Documented incident response procedures

4.2 Data Backup and Recovery

• Encrypted Backups: All backups are encrypted with AES-256
• Geographic Redundancy: Backups stored in multiple secure locations
• Recovery Testing: Regular testing of backup and recovery procedures
• Retention Limits: Backup data retained for maximum 90 days

5. Subprocessors and Third-Party Services

5.1 Authorized Subprocessors

We may engage the following categories of subprocessors:

Subprocessor	Service	Data Location	Purpose
Microsoft Azure	Cloud hosting and AI services	United States	Application hosting, AI processing
MongoDB Atlas	Database hosting	United States	Secure data storage
Plaid Inc.	Financial data connectivity	United States	Bank account integration
Email Service Providers	Communication services	Various	Service notifications

5.2 Subprocessor Management

• Due Diligence: All subprocessors undergo security and privacy assessments
• Contractual Obligations: Subprocessors bound by equivalent data protection obligations
• Monitoring: Regular monitoring of subprocessor compliance
• Notification: Users notified of changes to subprocessor arrangements

6. International Data Transfers

6.2 Data Localization

Primary data processing locations:

• United States: Primary hosting and processing location
• European Union: EU data may be processed within EU where requested
• Other Jurisdictions: Only with appropriate safeguards

7. Data Subject Rights

7.1 Individual Rights

We support the following data subject rights:

• Right of Access: Provide copies of personal data upon request
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Delete personal data when no longer needed
• Right to Restrict Processing: Limit processing in certain circumstances
• Right to Data Portability: Provide data in machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Rights related to Automated Decision-making: Human review of AI-driven decisions

7.2 Request Processing

• Response Time: Within 30 days of receipt
• Verification: Identity verification required for security
• Free of Charge: No fees for reasonable requests
• Assistance: We assist with fulfilling data subject requests

8. Data Retention and Deletion

8.1 Retention Periods

Data Category	Retention Period	Legal Basis
Account Data	Duration of account + 2 years	Contract performance, legal obligations
Transaction Data	Duration of account + 7 years	Financial regulations compliance
Support Data	3 years after resolution	Service improvement, legal claims
Marketing Data	Until consent withdrawn	Consent

8.2 Secure Deletion

• Automated Deletion: Systematic deletion after retention periods
• Secure Methods: Cryptographic erasure and secure overwriting
• Backup Deletion: Deletion from all backup systems
• Verification: Confirmation of complete data removal

9. Data Breach Notification

9.1 Incident Response

In the event of a personal data breach, we will:

• Immediate Response: Contain and assess the breach within 1 hour
• Investigation: Conduct thorough investigation within 24 hours
• Regulatory Notification: Notify supervisory authorities within 72 hours where required
• User Notification: Notify affected users without undue delay if high risk to rights
• Documentation: Maintain detailed records of all data breaches

9.2 Breach Information

Breach notifications will include:

• Nature and scope of the breach
• Categories and number of data subjects affected
• Likely consequences of the breach
• Measures taken to address the breach
• Recommendations for affected individuals

10. Audit and Compliance

10.1 Regular Audits

• Internal Audits: Quarterly compliance assessments
• External Audits: Annual third-party security assessments
• Penetration Testing: Bi-annual security testing
• Compliance Reviews: Regular review of regulatory requirements

10.2 Documentation

• Processing Records: Detailed records of all processing activities
• Security Documentation: Comprehensive security policies and procedures
• Training Records: Staff training and certification records
• Audit Reports: Results of compliance audits and assessments

11. Contact and Data Protection Officer

12. Agreement Updates

This Data Processing Agreement may be updated to reflect:

• Changes in applicable laws and regulations
• Updates to our data processing practices
• New security measures or technologies
• Changes to subprocessor arrangements

We will provide notice of material changes and, where required by law, obtain consent for continued processing.

---

Finance Forecaster - Secure, AI-Powered Financial Forecasting
© 2025 Finance Forecaster. All rights reserved.