Data processing agreement
Last updated: 1 October 2026
This agreement applies when Ant vs Bear Ltd (the "Processor") processes personal data on behalf of a customer (the "Controller") through HatchSolo. It meets Article 28 of the UK GDPR and forms part of the terms of service.
Operated by Ant vs Bear Ltd, company number 15391307, registered office 128 City Road, London, EC1V 2NX. Contact: contact@hatchsolo.com.
1. What this covers
| Item | Detail |
|---|---|
| Subject matter | Providing HatchSolo: reading the Controller's accounting and bank records, preparing and checking VAT figures, keeping a record of approvals and filings, and (when enabled) sending an approved return to HMRC |
| Duration | While the Controller's account is open, and until deletion under section 8 |
| Nature and purpose | Reading, storing, structuring, calculating, displaying and transmitting to HMRC, only to provide the service to the Controller |
| Types of personal data | Names and contact details of the Controller's suppliers, customers and other counterparties that appear in the books; transaction descriptions and amounts; the Controller's own account details |
| Categories of people | The Controller's suppliers, customers, employees and directors, to the extent they appear in the books |
2. Instructions
The Processor will process the personal data only on the Controller's documented instructions, which are these terms, the Controller's use of the product's features, and any written instruction the Controller sends to the contact address. If the Processor believes an instruction breaches data protection law it will tell the Controller. If the law requires the Processor to process data in another way it will say so first, unless the law forbids it.
3. Confidentiality
Everyone who may access the personal data on the Processor's side is bound by a duty of confidence.
4. Security
The Processor applies the technical and organisational measures in the privacy policy section "How we protect it", including encryption in transit and at rest, encryption of the VAT number and connection tokens, append-only records, access limited to what is needed, and no storage of HMRC credentials. It will keep these at a level appropriate to the risk.
5. Sub-processors
The Controller gives general authorisation for the sub-processors listed in the privacy policy (hosting, database, SMS and bot-check providers, and the open banking provider once bank connection is available). The Processor will tell the Controller before adding or replacing one, so the Controller can object; if the Controller objects and the parties cannot agree, the Controller may stop using HatchSolo and delete its account. The Processor remains responsible for its sub-processors and binds each to terms no less protective than these.
6. International transfers
The Processor will transfer personal data outside the UK only with a safeguard recognised by UK law, such as the UK International Data Transfer Agreement or Addendum, as described in the privacy policy.
7. Helping the Controller
The Processor will help the Controller, taking into account the nature of the processing and the information it holds, to answer requests from people exercising their rights, to keep the data secure, to handle personal data breaches, and with data protection impact assessments and consultations with the Information Commissioner's Office. If a person writes to the Processor about data it holds for the Controller, the Processor will pass the request to the Controller without delay and will not answer it itself unless instructed.
8. Breaches
The Processor will tell the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own duties, and will keep a record of it.
9. Deletion and return
On the Controller's request, or when the account is closed or a source is disconnected, the Processor will delete or return the personal data within 30 days and confirm in writing, except for records it must keep by law. The Controller can download a complete export in a standard readable format (JSON for everything, CSV for transactions) from the product at any time, and the Processor will prepare one on request within the same 30 days.
10. Information and audits
The Processor will give the Controller the information needed to show compliance with Article 28, and allow and contribute to reasonable audits, including inspections, by the Controller or an auditor it appoints, on reasonable notice and without disrupting the service for others.
11. General
If these terms conflict with the terms of service on the processing of personal data, these terms prevail. They are governed by the law of England and Wales.