Data Processing Addendum

For the personal data you upload into Tally (your entries, notes, contacts, files and any personal data of your customers or team members that you choose to record), you are the Controller and Tally is the Processor. Tally will process that personal data only on your documented instructions — which, unless you tell us otherwise, are the instructions set out in the Terms of Service, this DPA and your use of the product.

For account-level data (your login email, billing details, product telemetry) Tally acts as an independent Controller. That processing is governed by our Privacy Policy, not this DPA.

Subject-matter: providing the Tally accounting product to you. Duration: for as long as your Tally account is active, plus the deletion window described in Section 8.

Nature and purpose: hosting, storing, transmitting, backing up, organising and displaying the personal data you put into Tally so you can use the product.

Types of personal data: whatever you choose to enter — typically identifiers, contact details, financial transaction data and free-text notes. Categories of data subjects: your customers, suppliers, employees, contractors and anyone else you record in Tally.

Tally will:

• Process personal data only on your documented instructions.
• Ensure people authorised to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organisational measures (Section 5).
• Assist you, taking into account the nature of processing, with data subject requests, DPIAs and prior consultations.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data (Section 6).
• Delete or return the personal data at the end of the service, as you choose (Section 8).
• Make available to you the information necessary to demonstrate compliance with Article 28 UK/EU GDPR.

You provide a general authorisation for Tally to engage the following sub-processors to help deliver the service:

• Supabase — database, authentication and file storage.
• Cloudflare — application hosting, edge compute and CDN.
• Stripe — subscription billing and payment processing.
• Resend — transactional email delivery.
• Google — only if a user chooses to sign in with Google.

Tally imposes data-protection obligations on each sub-processor no less protective than those in this DPA. If we add or replace a sub-processor we will update this page and notify account administrators in advance so you have a chance to object.

Tally maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including:

• Encryption in transit (TLS 1.2+) and at rest.
• Row-level security and role-based access controls.
• Least-privilege access for staff, with audit logging.
• Regular backups with tested restoration procedures.
• Vulnerability scanning and dependency monitoring.
• Vendor due diligence and written data-processing agreements.

If Tally becomes aware of a personal data breach affecting your personal data, we will notify you without undue delay and, where feasible, within 72 hours. Our notice will describe what we know, the likely consequences, and the measures taken or proposed to address it, so you can meet your own notification obligations.

Some sub-processors process data outside the UK/EEA. Where that happens, Tally relies on an appropriate transfer mechanism — the UK International Data Transfer Addendum, the EU Standard Contractual Clauses (2021/914), or an adequacy decision — together with any supplementary measures required by the relevant regulator.

On termination of the service, or at your written request, Tally will delete or return the personal data processed on your behalf and delete existing copies, unless applicable law requires continued storage. Deletion of product data completes within 30 days of your request; encrypted backups age out on the standard backup cycle.

Tally will make available to you all information reasonably necessary to demonstrate compliance with Article 28 UK/EU GDPR, and will contribute to audits — including inspections — conducted by you or a mutually-agreed auditor, subject to reasonable notice, confidentiality obligations and cost-recovery for time and materials. Where available, Tally may satisfy audit requests by providing the latest third-party audit reports of its infrastructure providers.

You are responsible for responding to requests from data subjects (access, rectification, erasure, portability, restriction, objection). Tally will provide reasonable assistance through the product's built-in export and deletion tools and, where those aren't enough, by acting on written instructions from you.

To the extent of any conflict between this DPA and the Terms of Service, this DPA prevails for matters of personal data protection. To the extent of any conflict between this DPA and the EU Standard Contractual Clauses or the UK IDTA, those clauses prevail.

Data-protection questions or requests under this DPA: open a support ticket from inside Tally, or write to us at the registered office shown below. Include enough detail for us to identify the account and the request.