PO Genie - Data Processing Agreement

1. Roles

You are the data controller for the personal data your organisation processes through the App, such as supplier and customer contact details contained in quotes and purchase orders. Sesseto acts as a data processor, processing that data only on your instructions and only to provide, operate and support the App. Sesseto remains a controller in its own right for its account and administrative data (for example your organisation’s subscription and billing records).

2. Categories of data and data subjects

The App may process: contact names, email addresses, postal addresses and commercial terms of your suppliers, customers and staff as they appear in quotes, purchase orders and related records you create or import from Sage Accounting; your organisation’s account users (name, email address, role and permissions); and the Sage Accounting connection tokens used to keep your integration working. Data subjects are your staff, suppliers and customers.

3. Processing instructions

Sesseto will process personal data only to provide the App in accordance with your configuration and instructions, as described in the Terms and Conditions and Privacy Policy. This includes storing and displaying your organisation’s records, syncing with your Sage Accounting account, generating purchase orders, and providing support. Sesseto will not process your personal data for any other purpose, will not sell it, and will not disclose it to third parties except as permitted by this DPA or required by law.

4. Confidentiality

Sesseto ensures that personnel authorised to process your personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access personal data only as needed to operate and support the App.

5. Security

Sesseto maintains technical and organisational measures appropriate to the risk, including: encryption of data in transit and at rest; per-organisation data isolation so that each organisation’s data is accessible only to its own users; role-based permissions within organisations; and hosting on infrastructure that has been independently assessed under SOC 2 Type II and certified to ISO 27001. We will notify you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your personal data.

6. Sub-processors

Sesseto uses the following sub-processors to deliver the App: Base44 Inc. (application hosting, data storage and authentication), and Sage (whose services are used only via your organisation’s own Sage credentials and under your own agreement with Sage). Transfers to sub-processors are governed by written data-processing terms. We will give you at least 30 days’ notice before adding or replacing a sub-processor, during which you may object on reasonable data-protection grounds.

7. International transfers

The App’s hosting infrastructure is located in the United States. Where personal data is transferred outside the UK/EEA, appropriate safeguards apply, including the UK International Data Transfer Addendum and the UK Extension to the EU Standard Contractual Clauses, and where applicable the UK-US Data Privacy Framework.

8. Your compliance and data subject requests

Sesseto will assist you, so far as possible, in fulfilling your obligations to respond to data subject requests (access, correction, erasure, restriction, portability) and in carrying out data protection impact assessments where required. Requests for assistance should be sent to support@sesseto.com.

9. Audit

Sesseto maintains records of its processing and makes available the information necessary to demonstrate compliance with this DPA. On reasonable request, we will provide a summary of the security measures described in section 5, and cooperate with your reasonable audits of the App’s data-handling practices.

10. Return or deletion on termination

When your subscription ends, Sesseto will, at your choice, export your organisation’s data in a structured, commonly used format, or delete it from the App within 30 days of closure. Export or deletion can be requested at any time via support@sesseto.com.

11. Term

This DPA applies for as long as Sesseto processes personal data on your behalf and terminates when all such data has been returned or deleted under section 10.

12. Contact

Sesseto Ltd, Hillsboro, Clodgy View, St Ives, Cornwall TR26 1JG, United Kingdom.

Email: support@sesseto.com. Website: sesseto.com.

See also our Terms and Conditions and Privacy Policy.