Onzli data processing terms
These terms form part of the agreement between a business or organisation using Onzli ("the Customer") and Xalterra Ltd, a company registered in England and Wales under company number 11128001, whose registered office is at Unit 29 Highcroft Industrial Estate Enterprise Road, Horndean, Waterlooville, Hampshire, PO8 0BT ("the Provider"). They meet the requirements of Article 28 of the UK GDPR.
They do not apply to individual accounts, where the Provider is the controller and the privacy policy applies instead.
1. Roles
The Customer is the controller of the personal data it puts into Onzli or connects to it ("Customer Data"), and the Provider processes Customer Data as its processor.
The Provider is a separate controller for its own account and sign-in data, billing records, security records, and the fraud-prevention data it is required to send to HMRC and keep with each submission. That data is covered by the privacy policy.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Preparing, checking and submitting UK tax returns and updates to HMRC under Making Tax Digital, and keeping the related records. |
| Duration | For the term of the agreement, then until the data is deleted under section 10. |
| Nature | Collecting (by upload, entry or read-only connection), storing, calculating, displaying, transmitting to HMRC, exporting and deleting. |
| Purpose | Providing the Onzli service to the Customer. |
| Types of personal data | Names and contact details of the Customer's users; business details that may identify a sole trader or partner; tax figures, returns, approvals and HMRC receipts; personal data within accounting records imported or read from connected software. |
| Special category data | None. The Customer must not upload special category data. |
| Data subjects | The Customer's users, staff and advisers; sole traders and partners; individuals named in the Customer's accounting records, such as its customers, suppliers and staff. |
3. The Provider's obligations
3.1 Instructions
The Provider processes Customer Data only on the Customer's documented instructions. These terms, the agreement and the Customer's use of the service and its settings are those instructions. The Provider will tell the Customer if it believes an instruction breaks data protection law. If the law requires other processing, the Provider will tell the Customer first unless the law forbids it.
3.2 Confidentiality
Everyone the Provider authorises to process Customer Data is bound by a duty of confidentiality.
3.3 Security
The Provider applies the measures in Annex B and may update them provided the overall level of security does not fall.
3.4 Sub-processors
The Customer gives general authorisation for the Provider to use the sub-processors listed in Annex A.
The Provider will give the Customer at least 30 days' notice, by email to the account's admins, before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may close its account without penalty and receive a refund of any unused annual plan.
Each sub-processor is bound by a written contract giving at least the same protection as these terms. The Provider remains responsible for its sub-processors.
3.5 Data subject requests
The Provider will help the Customer respond to requests from data subjects. An admin can export all of the account's data from Settings > Download my data. If the Provider receives a request directly about Customer Data, it will pass it to the Customer and will not respond itself unless the Customer instructs it to.
3.6 Assistance
The Provider will help the Customer meet its obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner's Office, taking into account the information available to the Provider.
3.7 Personal data breaches
The Provider will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe what is known at the time and will be updated as more becomes known. Where a breach affects data sent to or received from HMRC, the Provider will also inform HMRC as HMRC requires.
3.8 Records and audits
The Provider will make available the information needed to show it meets these terms. Once a year, on request, it will answer the Customer's reasonable written security and data protection questionnaire. Where a regulator requires it, or after a personal data breach affecting the Customer, the Provider will allow an audit by the Customer or an independent auditor it appoints, on at least 30 days' written notice, during business hours, under a duty of confidentiality and at the Customer's cost.
4. HMRC
HMRC is not a sub-processor. When the Customer approves and submits a return or update, the Provider sends it to HMRC on the Customer's instruction, and HMRC receives it as a public authority. The Provider never submits anything without approval and a fresh verification code from an authorised user. Connecting accounting software never authorises a submission; the Customer authorises HMRC separately.
5. Connected accounting software
The Customer chooses whether to connect accounting software such as Xero or ERPNext. The Provider only reads from it and never creates, changes or deletes records in it. The Customer's own contract with that provider governs the provider's processing; such providers are not the Provider's sub-processors.
6. International transfers
The Provider transfers Customer Data outside the UK only where a lawful safeguard applies. Hosting is in Spain and email delivery uses servers in the European Union, both covered by UK adequacy regulations. Backups are kept in the UK. For sub-processors in the United States, the Provider relies on the UK Extension to the EU-US Data Privacy Framework, or otherwise on the UK International Data Transfer Addendum.
7. Customer obligations
The Customer will:
- make sure it has a lawful basis for the Customer Data it puts into the service;
- give its users and data subjects the information the law requires;
- control which users have access and the roles they hold;
- not upload special category data, or data it has no right to use.
8. Liability
Each party's liability under these terms is subject to the limits in the Onzli terms of service.
9. Retention during the agreement
During the agreement the Provider keeps Customer Data while the account is open, except that uploaded spreadsheets of totals are read and not stored; only the figures and a fingerprint of the file are kept.
10. End of the agreement
When the account is closed, the Customer has 30 days to export its data from Settings > Download my data. The Provider then deletes Customer Data, destroying the account's encryption keys, except for records it must keep by law or as a controller in its own right, which it keeps for the periods in the privacy policy. Encrypted backups are overwritten on a rolling cycle of up to 35 days, after which deleted data no longer exists in them.
11. Order of precedence
If these terms conflict with the terms of service on data protection, these terms apply.
Annex A: sub-processors
| Sub-processor | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| IONOS | Hosting and database | All Customer Data | Spain (EU) | UK adequacy regulations |
| SMTP2GO | Email delivery | Users' names and email addresses; service and security emails | European Union | UK adequacy regulations |
| UK backup storage provider | Encrypted backup storage | Encrypted copy of Customer Data | United Kingdom | Not a transfer |
| Cloudflare | Website delivery and security, domain name service and Turnstile bot check | All data passing between users' browsers and the service, including IP addresses | United States and Cloudflare's global network | UK Extension to the EU-US Data Privacy Framework |
Stripe processes the Provider's own billing data as an independent service and is described in the privacy policy.
Annex B: technical and organisational measures
- TLS encryption for all connections.
- A separate encryption key for each account; HMRC tokens and connector credentials encrypted with AES-256-GCM.
- Passwords stored as argon2id hashes; authenticator secrets encrypted; recovery codes hashed.
- Two-step verification for every sign-in, and a fresh code to approve or submit anything to HMRC.
- Role-based access, with second-person approval by default.
- Database row-level security keeping each account's data separate; staff cannot see Customer Data.
- Staff use individual logins with two-step verification, have access only as their role needs, are bound by confidentiality, and any direct database access is logged with a reason.
- An append-only, tamper-evident audit trail.
- Logs that exclude passwords and tokens.
- Read-only connections to accounting software.
- Encrypted backups.
- A strict content security policy and no third-party analytics or tracking.
- A documented incident response process, including notice to HMRC and the Information Commissioner's Office where required.