Skip to content
CadenceFi

Data Processing Terms

Last updated: 26 October 2026

1. Scope

These terms form part of our Terms of Service and apply automatically to every customer. They cover personal data in the records you keep in Cadence, for which you are the controller and CadenceFi Ltd ("we") is your processor. They meet the requirements of Article 28 of the UK GDPR. Personal data we handle as a controller (such as your users' account details) is covered by our Privacy Policy instead.

2. Details of the processing

  • Subject matter and purpose: providing Cadence to you: storing, syncing and analysing your business's financial records to produce cash flow forecasts, reports, alerts and AI answers.
  • Nature: collection (including from accounting systems and banks you connect), storage, organisation, analysis, retrieval, display and deletion.
  • Duration: for as long as you use Cadence, and until deletion under section 7.
  • Types of personal data: names, contact details, invoice, bill, payment and bank transaction details, and any other personal data you choose to put in your records.
  • Data subjects: your customers, suppliers, staff and other contacts who appear in your records.
  • Special category data: Cadence is not designed for it, and you agree not to put it in your records unless a record genuinely requires it.

3. Our obligations

We will:

  • process the personal data only on your documented instructions, which are these terms, the Terms of Service and the way you configure and use Cadence, unless UK law requires otherwise (in which case we will tell you first, unless the law forbids it). We will tell you if we think an instruction breaks data protection law;
  • make sure everyone authorised to process the data is bound by confidentiality;
  • take the security measures required by Article 32 of the UK GDPR, described in our security statement;
  • help you, taking into account the nature of the processing, to respond to requests from people exercising their data protection rights, and pass any such request we receive to you without undue delay;
  • help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to us.

4. Sub-processors

You give us general authorisation to use sub-processors for hosting and database, off-site backup storage (encrypted copies only), email delivery, AI features, error monitoring, rate limiting and bot protection, and Google (Google Workspace) for our business email and calendar, which hold support emails and setup call bookings. The current list is available on request at support@cadencefi.co.uk. We will tell you by email before we add or replace a sub-processor, so you have the chance to object. If you object on reasonable data protection grounds and we cannot address your concern, you may end your subscription before the change takes effect.

Each sub-processor is bound by a written contract with data protection obligations equivalent to these terms, and we remain liable to you for their performance. Accounting systems, banks and other services you choose to connect are not our sub-processors: they provide their services to you under their own terms.

5. International transfers

Your data is stored in the UK. We will transfer personal data outside the UK only where the transfer is covered by UK adequacy regulations or by appropriate safeguards under the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

6. Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting your data, and give you the information you reasonably need to assess it and meet your own obligations to notify the ICO and the people affected.

7. End of the service

You can export your data at any time. When your account is deleted, we delete the personal data in your records straight away, and in any case within 30 days, unless UK law requires us to keep it. Copies in backups are put beyond use and expire within 90 days.

8. Information and audits

We will make available to you the information reasonably needed to show that we meet Article 28, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits need reasonable notice, take place no more than once a year unless required by a regulator or following a breach, and are subject to confidentiality. Where our written answers and security documentation can answer the question, we will use them first.

9. Your obligations

You are responsible for having a lawful basis for the personal data you put in Cadence or connect to it, for giving the people concerned the privacy information the law requires, and for the instructions you give us.

10. General

If these terms conflict with the Terms of Service on the processing of personal data, these terms take priority. They are governed by the same law as the Terms of Service. If you need a signed copy for your records, email support@cadencefi.co.uk.