Last updated: 7 November 2026
Data processing agreement
Last updated: 7 November 2026
This Data processing agreement ("DPA") forms part of the Terms of service between Fyno and the business using Fyno ("you"). It applies where Fyno processes personal data on your behalf, mainly information about your customers who pay you through Fyno.
- Fyno ("we", "us") is a trading name of Simon Webb, a sole trader in the United Kingdom. Address: [Business address]. Email: support@fynopayments.co.uk.
- You are the controller of your customers' personal data. We are your processor.
- This DPA is intended to meet the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018 ("Data Protection Law").
If you need a signed copy, email support@fynopayments.co.uk.
1. Definitions
Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in Data Protection Law. "Customer Personal Data" means the personal data we process on your behalf as described in Annex 1.
2. Processing on your instructions
2.1 We will process Customer Personal Data only on your documented instructions, which are:
- the Terms of service and this DPA,
- your use and configuration of Fyno, and
- any other written instructions you give us that we agree to.
The only exception is where the law requires otherwise; in that case we'll tell you first unless the law forbids it.
2.2 We'll tell you promptly if we believe an instruction breaks Data Protection Law.
2.3 You are responsible for:
- having a lawful basis for the processing,
- giving your customers appropriate privacy information, and
- the accuracy of the data you provide.
3. Confidentiality
We will ensure that anyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
4. Security
We will implement appropriate technical and organisational measures to protect Customer Personal Data, including those in Annex 2. We may update these measures, provided the overall level of protection is not reduced.
5. Sub-processors
5.1 You give general authorisation for us to use the sub-processors listed in Annex 3.
5.2 We will tell you at least 30 days before adding or replacing a sub-processor, by email or in the app. If you have a reasonable data protection objection, tell us within that period. We'll try to address it; if we can't, you may end the Terms of service and receive a refund of any prepaid fees for the unused period.
5.3 We will impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
5.4 Our payment partner (GoCardless) is not our sub-processor. It acts as an independent controller for the payment services it provides to you and your customers under its own terms.
6. Helping you with data subject requests
Taking into account the nature of the processing, we will help you respond to requests from your customers to exercise their rights (such as access or deletion). If we receive a request directly, we'll pass it to you without undue delay and won't respond ourselves except to direct the person to you, unless you ask us to.
7. Personal data breaches
If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and in any event within 48 hours. We'll give you the information you reasonably need to meet your obligations, including what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We'll update you as we learn more.
8. Other assistance
We will give you reasonable help with data protection impact assessments and consultations with the Information Commissioner's Office, where relevant to our processing.
9. International transfers
We will not transfer Customer Personal Data outside the UK unless there is a lawful safeguard in place, such as:
- UK adequacy regulations (including for US organisations certified under the UK Extension to the EU–US Data Privacy Framework),
- the UK International Data Transfer Agreement, or
- the UK Addendum to the EU Standard Contractual Clauses.
10. Deletion or return
When the Terms of service end, you can export Customer Personal Data for 30 days. After that, we will delete Customer Personal Data within 90 days, including from backups as they cycle, unless the law requires us to keep it. Any data we have to keep remains protected by this DPA.
11. Audits and information
We will make available the information reasonably necessary to show we comply with this DPA. This includes our security measures and any certifications (such as Cyber Essentials) and responses to reasonable security questionnaires. If that isn't enough, you may carry out an audit:
- at your cost,
- once a year (unless required by a regulator or after a breach),
- with at least 30 days' notice,
- during business hours, and
- subject to confidentiality.
12. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms of service, except where the law does not allow that. If this DPA conflicts with the Terms of service, this DPA wins on data protection matters.
13. Term
This DPA lasts for as long as we process Customer Personal Data for you.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing the Fyno payment request software |
| Duration | The term of the Terms of service, plus the deletion period in section 10 |
| Nature and purpose | Storing customer records and payment plans; creating and sending payment requests, reminders and receipts by SMS, WhatsApp and email; showing payment status; refunds; reconciliation and reporting; integrations you enable (such as Xero); fraud and abuse prevention; support |
| Categories of data subjects | Your customers and prospective customers; your contacts; your team members, where they are processed for you |
| Types of personal data | Names; mobile numbers; email addresses; postal address where provided; job and payment details (amount, description, reference, payment plan); bank chosen to pay with; payment status and timestamps; message content and delivery status; IP address and device information when opening payment links |
| Special category data | None intended. You must not enter health or other special category data in payment descriptions or notes |
Annex 2: Security measures
- Encryption in transit (TLS) and at rest
- Data hosted in the UK (London region) where possible
- Logical separation of each business's data, enforced by database row-level security
- Multi-factor authentication for business owners and admins; role-based access for team members
- Least-privilege access for our own staff and systems; secrets stored in encrypted configuration, never in code
- Audit logs of key actions, and alerts on changes to payout details
- Signed and verified webhooks; input validation and rate limiting
- Daily backups and tested recovery
- Error monitoring and uptime monitoring
- Vulnerability patching and dependency updates
- A documented incident response process
- No storage of card numbers or online banking credentials
Annex 3: Sub-processors
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | UK (London region); support access may be from the US |
| Vercel Inc. | Website and application hosting | Global edge network, including UK, EU and US |
| Twilio Inc. | SMS and WhatsApp message delivery | US and EU |
| Meta Platforms Ireland Ltd | WhatsApp Business messaging | EU and US |
| [Postmark (ActiveCampaign, LLC) or Resend, Inc.] | Transactional email | US |
| Inngest, Inc. | Background jobs (reminders, retries, reconciliation) | US |
| Functional Software, Inc. (Sentry) | Error monitoring | US or EU |
| PostHog Inc. | Product analytics (EU hosting) | EU |
| Better Stack, Inc. | Uptime monitoring and status page | EU and US |
Stripe (our subscription billing provider) processes data about you as our customer, not your customers' data, so it is listed in our Privacy policy rather than here.