PingtailData Processing Agreement
For client documents, the firm is the data controller and Pingtail Partners is the data processor. This agreement lists what we process, where, for how long, and the sub-processors we use.
Last updated: 28 September 2026.
Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Terms of Service between Pingtail Partners ("we", "us", "the processor") and the firm that holds the account ("you", "the firm", "the controller"). It applies automatically when you accept the Terms. No signature is needed.
In this DPA, "data protection law" means the privacy laws that apply to the personal data, including the EU GDPR, the UK GDPR and US state privacy laws. "Client data" means the personal data of your clients that we handle for you through Pingtail.
1. Parties and roles
- For client data, you are the controller and we are the processor. Where a US state law applies, you are the "business" and we are the "service provider".
- If you act as a processor for someone else, we are your sub-processor, and you confirm that your instructions are allowed by your own controller.
- For your own account data, such as team member names, emails and billing details, we are a controller. The Privacy Policy covers that data. This DPA does not.
2. Subject matter, duration, nature and purpose
We process client data to provide Pingtail: sending your requests and reminders, receiving and storing uploads and answers, checking uploads, showing them to your team, and keeping an audit log. We process client data for as long as you have an account, and afterwards only until it is deleted under section 10. Annex 1 gives the details.
3. Categories of data subjects and personal data
| Data subjects | Personal data |
|---|---|
| Clients of the firm, and people who act for them | Names, email addresses, phone numbers |
| Clients of the firm, and other people named in the documents | The documents and answers the client provides. These may include financial, tax and identity data, such as bank statements, payslips, tax forms and ID documents. |
| Clients of the firm | Special-category data, only if the client includes it in a document or answer |
| Clients of the firm | Technical data: IP address, browser type, and times of link opens, uploads and confirmations |
4. Your instructions
We process client data only on your documented instructions. The Terms, this DPA, and your use and settings of the service are your instructions. We will tell you if we think an instruction breaks data protection law. If a law requires us to process client data in another way, we will tell you first, unless that law forbids it.
We do not sell client data. We do not use it for our own purposes, for advertising, or to train AI models. We do not combine it with data from other sources, except as needed to provide and secure the service.
5. Your responsibilities
You are the sender of every message to your clients. You confirm that you have a lawful basis to contact them and to collect their data, that you have given them the privacy information the law requires, and that your instructions are lawful. You decide how long client data is kept.
6. Confidentiality
Everyone we allow to access client data is bound by a duty of confidentiality. Access is limited to people who need it to run the service.
7. Security
We apply the technical and organisational measures described on our Security page and summarised in Annex 2. We may update these measures, but we will not lower the overall level of protection.
8. Sub-processors
- You give us general authorisation to use sub-processors in the categories listed in Annex 3.
- The current named list is available on request at dipa@pingtail.com.
- We will give you notice, by email or in the service, at least 14 days before we add or replace a sub-processor.
- You may object on reasonable data protection grounds within that period. We will try to find a solution. If we cannot, you may end the affected service and we will refund any prepaid fees for the unused period.
- We put a written contract in place with each sub-processor. It gives at least the same level of protection as this DPA. We remain responsible to you for the work of our sub-processors.
9. Help with requests, assessments and breaches
- Requests from individuals. The service lets you find, export and delete client data yourself. If a client sends a request to us, we will pass it to you without undue delay and will not answer it ourselves, except to tell the client to contact you. We give reasonable further help on request.
- Impact assessments. We give you reasonable information to help with data protection impact assessments and with consulting a regulator, where the law requires them.
- Personal data breach. We will notify you without undue delay, and in any case within 72 hours of becoming aware of a breach that affects client data. We will tell you what we know: what happened, the data and people likely affected, the likely effects, and what we are doing about it. We will send updates as we learn more. We will help you meet your own duties to notify.
10. Deletion or return
You can download all your files at any time, on every plan. After a paid plan ends, the account is read-only with export for 60 days. You can delete any file, request, client or your whole account at any time. Deletion removes the stored object and its encryption key, so the file cannot be recovered. When an owner deletes the firm, the owner can undo it for 30 days; after that we erase the firm's files and its clients' details, and an anonymised record of actions stays, unless the law requires us to keep more. Encrypted backups expire on their normal schedule and are not used to restore deleted data, except to recover from an incident.
11. Audits and information
We will give you the information you reasonably need to show that we comply with this DPA. Once a year, on reasonable written notice, you may send us a reasonable written questionnaire, and we will answer it within a reasonable time. If a regulator requires more, or after a breach that affects your client data, we will agree a further audit with you. It must protect the confidentiality and security of other customers. Each party pays its own costs, unless the audit finds that we materially broke this DPA.
12. Records
We keep records of the processing we carry out for you, as data protection law requires.
13. International transfers
We host client data in the EU (Finland). Transfers outside the UK and the European Economic Area may occur for email delivery and AI checks. We make them only with a safeguard that data protection law accepts, such as standard contractual clauses or the provider's equivalent. Transfers to services you connect yourself (Annex 3, destinations you choose) are made on your instruction.
If you are in the EEA or the UK and we are in a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two, or Module Three where you are a processor) are incorporated into this DPA by reference. For UK transfers, the UK International Data Transfer Addendum is also incorporated by reference. The annexes to this DPA complete the annexes to those clauses. The governing law and courts are those of Ireland.
14. Liability
Liability under this DPA follows the Terms. The exclusions and limits in the Terms apply to this DPA. Nothing in this DPA limits the rights of individuals under data protection law.
15. Order of precedence
If there is a conflict, the order is: first the standard contractual clauses, where they apply; then this DPA; then the Terms. This DPA is governed by the same law as the Terms, India, except where the standard contractual clauses say otherwise.
Annex 1: Processing details
| Item | Details |
|---|---|
| Controller (data exporter) | The firm named on the account. Contact: the account owner's email. |
| Processor (data importer) | Pingtail Partners, NH231, Above Axis Bank, Gulabbagh, Purnia, Bihar 854326, India. Contact: dipa@pingtail.com |
| Subject matter | Providing Pingtail, a service for requesting and collecting documents and information from the firm's clients |
| Nature of processing | Collecting, storing, encrypting, checking (by rules and by an AI model), displaying, sending email, logging, exporting and deleting |
| Purpose | To let the firm request, receive, check and manage documents and information from its clients |
| Data subjects and data | As listed in section 3 |
| Frequency | Continuous, while the firm uses the service |
| Duration and retention | The firm sets retention. The default is 7 years on paid plans. On a read-only account (no active plan), files are deleted 90 days after a request is completed. Accounts with no login for 12 months are archived and their files deleted after a warning email. |
Annex 2: Security measures (summary)
- Encryption. The application encrypts every file with AES-256-GCM before it reaches storage. Each file has its own key, and a master key wraps the file keys. The storage provider holds only ciphertext. TLS protects data in transit.
- Storage and access. The storage bucket is private, with no public access. Downloads go only through the application, for a signed-in member of the firm. Passwords are hashed with argon2id.
- Client links. Links are long random tokens, stored only as hashes and bound to one request. A second device must enter a code sent to the client's email.
- Application protection. CSRF protection, rate limits and a strict content security policy.
- Uploads. A file type allow-list is checked against the real file bytes, with a 25 MB limit. PDFs with scripts or embedded files are refused. Files are never executed.
- Logging. An audit log records views, downloads, accepts, send-backs and deletions.
- Backups and hosting. Nightly encrypted database backups. Servers are hosted in the EU (Finland).
- People. Production access is limited to the founder and operations. Staff do not open customer documents, except at the firm's written request for support.
- Deletion. Deleting a file removes the stored object and its encryption key.
We do not currently hold SOC 2 or ISO 27001 certification.
Annex 3: Sub-processor categories
| Category | What it does | Client data involved |
|---|---|---|
| Cloud hosting (EU) | Runs the application and database | Client contact details, request data, logs and encrypted backups |
| S3-compatible object storage | Stores uploaded files | Ciphertext only. The provider cannot read the files. |
| Transactional email delivery | Delivers requests, reminders and codes | Client name, email address and the content of the email |
| WhatsApp Business Platform (Meta Platforms), only for firms that connect WhatsApp | Delivers the firm's requests and reminders on WhatsApp from the firm's own number, and returns the client's replies | Client name, phone number, the content of the message and the client's replies and files |
| AI model provider for document checks (Anthropic) | Reads a document to check if it matches what was asked. Not used to train models. The firm can switch this off. | The content of the uploaded document |
Destinations you choose. Services you connect yourself (Google Drive, Dropbox, Xero, QuickBooks Online, Slack, Zapier or your own webhook address) are not our sub-processors. When you connect one, you instruct us to transfer the client data you select to it: accepted documents and their names for storage and accounting services, and short event notices (names, statuses, dates, links, never documents) for Slack, Zapier and webhooks. That service's own terms govern what it does with the data. We hold an encrypted access token, which we delete when you disconnect. For QuickBooks Online we also keep the lines we ask a client about and the changes the firm confirmed, as described in the Privacy Policy.
Our payment processor (PayPal) handles firm subscriptions only. It does not receive client data. The current named list of sub-processors is available on request at dipa@pingtail.com.
Pingtail Partners, NH231, Above Axis Bank, Gulabbagh, Purnia, Bihar 854326, India · +91 91801 85753 · dipa@pingtail.com