Data processing agreement (DPA)

1. Roles

This agreement applies to the personal data contained in the Files of SynkriaOps clients: companies keeping their own books, and accounting firms keeping their clients' books.

• The Client (the company, or the firm for its clients' files) is the controller.
• SynkriaOps SARL acts as processor: it processes this data only on the Client's behalf and instructions, within the meaning of Cameroonian law n° 2024/017 of 23 December 2024 on the protection of personal data.

The relationship between a firm and its own clients remains governed by the firm's engagement letter.

2. Purpose of processing

Revised SYSCOHADA bookkeeping, accounting migration, bank and Mobile Money, invoicing, purchases, reconciliation, financial statements, DSF bundle, exports, and the collaboration features between a company and its firm.

3. Data and data subjects

• Identity and contact details of third parties (customers, suppliers, employees, managers), tax identification numbers, bank and Mobile Money details;
• Vouchers, entries, amounts and uploaded documents;
• File users: managers, employees, firm team members.

4. SynkriaOps commitments

• Process the data only on the Client's instructions;
• Ensure its confidentiality, including by the people authorised to access it;
• Implement the security measures described in section 8 of the privacy policy;
• Notify the Client of any data breach affecting it within 48 hours of its discovery, with the information needed to respond;
• Help the Client answer requests from data subjects and from the data protection authority;
• Make available the information needed to demonstrate compliance with this agreement, and allow an audit with 30 days' notice, at the Client's expense unless a breach is proven.

5. Sub-processors and hosting

SynkriaOps uses the providers listed in section 6 of the privacy policy. Data is hosted outside Cameroon, mainly in the European Union; these transfers are carried out in compliance with the conditions set by law n° 2024/017. Any added or replaced provider is notified to the Client 30 days in advance; the Client may object and, failing agreement, terminate at no cost.

6. Security specific to accounting firms

• Each client file is sealed off by the database: one file can never read another's data;
• A firm accesses a file only by invitation, with rights set module by module;
• Log of sensitive actions and two-factor authentication available.

7. End of contract

At the end of the subscription, the File becomes read-only for 30 days: the Client can download its exports (FEC, financial statements, data). The File is then archived. On the Client's written request, the data is deleted, subject to the legal retention obligations that apply to SynkriaOps.

8. Contact

Questions about this agreement or data protection: legal@synkriaops.com.