Data Processing Agreement

Mast Finance Sàrl. Effective date: 22 October 2026. Version 1.0

English version. This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails.

1. Contractual Framework

This Data Processing Agreement ("DPA") forms an integral part of, and is incorporated into, the Terms of Service between Mast Finance Sàrl ("Mast Finance", "Mast" or "Processor") and the customer ("Controller"). In the event of conflict, this DPA prevails with respect to data protection matters.

This DPA reflects the requirements of the EU General Data Protection Regulation (GDPR), in particular Article 28, and the Swiss Federal Act on Data Protection (revFADP / nDSG).

2. Definitions

Terms not defined in this DPA have the meanings given in the Terms of Service or applicable data protection law. In this DPA:

• Controller: the customer, who determines the purposes and means of processing Customer Data.
• Processor: Mast Finance Sàrl, who processes personal data on behalf of the Controller.
• Customer Data: personal data provided by or generated on behalf of the Controller through use of the Service.
• Subprocessor: any third party engaged by Mast Finance to process Customer Data.

3. Subject Matter, Nature, and Duration

Mast Finance processes Customer Data on behalf of the Controller for the purpose of providing the Service, including hosting, storage, transmission, retrieval, computation, analysis, generation of outputs, customer support, security operations, and deletion.

Processing takes place for the duration of the subscription and any agreed data export or wind-down period following termination.

4. Categories of Personal Data and Data Subjects

Personal data processed may include:

• business contact and account data (names, roles, contact and company details);
• authentication and access data (user IDs, login events, session data, device identifiers);
• technical and usage data (logs, metadata, IP addresses, timestamps);
• billing and subscription data;
• Customer Data, which may include financial, accounting, expense, and treasury data relating to employees, contractors, customers, suppliers, or other individuals.

Data subjects may include: the Controller's employees and contractors, customers, suppliers, and any other individuals whose personal data is included in Customer Data.

5. Controller Obligations

The Controller:

• confirms it has a lawful basis for providing personal data to Mast Finance;
• is responsible for ensuring transparency toward data subjects;
• is responsible for the accuracy, legality, and completeness of instructions;
• will ensure Customer Data does not contain special categories of personal data (Art. 9 GDPR) unless expressly agreed in writing.

5.1 Fiduciary Firm Relationships (Tri-Partite Arrangements)

Where a fiduciary, accounting or advisory firm (the "Firm") works through the Service in the account of a client company (the "Client"), whether the Firm opened that account, holds it for the Client until the Client accepts it, or was invited into it by the Client:

• the Client is the controller of its Customer Data, including the supporting documents of its accounts that the Firm places there, and Mast Finance processes them as the Client's processor;
• the Firm acts for the Client under a mandate between them to which Mast Finance is not a party; it warrants that the Client has authorised it to instruct Mast Finance in respect of that Customer Data, and the Client's instructions and this DPA continue to govern its processing;
• the working papers the Firm keeps in the Client's account for its own work, being its review file (internal notes, review points, review status, reconciliation documents), belong to the Firm, which is their controller; Mast Finance processes them on the Firm's behalf under this DPA. They are not part of the Client's data export, and the Firm may share them with the Client. By way of exception to §12, they stay in the Client's account and are deleted with it; the Firm keeps for itself what its own obligations require.

The allocation of responsibilities between the Client and the Firm is set out in the mandate between them. Nothing in such an arrangement enlarges Mast Finance's obligations beyond those in this DPA.

6. Processor Obligations

Mast Finance shall:

• process Customer Data only on documented instructions from the Controller;
• ensure authorised personnel are bound by appropriate confidentiality obligations;
• implement and maintain appropriate technical and organisational security measures;
• not process Customer Data for its own purposes or disclose it to third parties except (i) as required to provide the Service or comply with law, or (ii) where the Customer has expressly enabled the model improvement programme described in the Terms of Service, in which case processing is limited to producing irreversibly anonymised training examples, and the resulting anonymised data falls outside the scope of this DPA;
• inform the Controller promptly if an instruction infringes applicable data protection law.

Service Data: Mast Finance acts as an independent data controller with respect to Service Data (account metadata, usage logs, feature adoption data, and other technical/behavioural data generated through interaction with the Service, excluding Customer Data). Mast Finance may collect, use, and analyse Service Data for legitimate internal business purposes as described in its Privacy Policy.

7. Security Measures

Mast Finance implements appropriate technical and organisational security measures, including encryption of data in transit and at rest, access controls, logging and monitoring, incident response procedures, and regular security assessments.

8. Subprocessors

The Controller grants Mast Finance general authorisation to engage subprocessors. Mast Finance maintains a publicly available list at mastfinance.io/subprocessors.

The Controller may object to a new subprocessor on reasonable data protection grounds within 14 days. If the objection cannot be resolved, the Controller may terminate the relevant service upon written notice.

Urgent replacement. Where a subprocessor must be replaced without delay to protect the security of Customer Data, to keep the Service available (for example because a subprocessor stops providing its service or suffers a security incident), or to comply with a legal obligation, Mast Finance may engage the replacement before the 14-day period has run. It publishes the change on the Subprocessors page at once, informs the Controller without undue delay, and engages only a replacement that offers guarantees at least equivalent to those of the subprocessor it replaces. The Controller's right to object then runs from that publication, under the same conditions.

Mast Finance imposes equivalent data protection obligations on subprocessors and remains liable for their acts and omissions.

Current Subprocessors

For the authoritative, version-controlled list with full legal entity names and transfer basis, see the Subprocessors page. Summary:

SIX BBS AG (bLink, open banking: bank account information and payment orders, with the bank's access token kept on Mast's behalf) is built but not yet active; PayPal, Shopify, and WooCommerce are customer-directed merchant data sources the customer connects, not Mast sub-processors of Mast-controlled data. See the Subprocessors page for the full characterisation.

9. International Data Transfers

Customer Data is stored within Switzerland (AWS Zurich). Mast staff, like the external developers (§8), access it only from Switzerland or from a country that the Swiss Federal Council recognises as providing adequate data protection for all organisations there, such as the countries of the European Union, including while travelling, and from nowhere else. The Privacy Policy lists those countries. Where the GDPR applies to Customer Data, a country outside Switzerland and the European Economic Area must also be one the European Commission recognises as providing adequate protection. Scanned documents are read by Microsoft Azure AI Document Intelligence in Switzerland (Zurich), which holds them and the result for at most 24 hours (§8); nothing leaves Switzerland in that flow. The limited EU-region exceptions listed in §8 and described in the Privacy Policy are the following: AI inference runs in Zurich or in an EU region AWS chooses, reranking in Frankfurt; backups of the production database stay in Switzerland and are kept 12 months; transactional email is delivered from AWS SES in Ireland (eu-west-1); and, where the Controller enables bill reception by email, inbound messages and attachments are held transiently (at most 7 days) by SES/S3 in Ireland. All of these are covered by the Switzerland–EU adequacy decision. The AI assistance Mast staff use (Anthropic, PBC, §8) is processed in the United States under Anthropic's Data Processing Addendum and the Standard Contractual Clauses it incorporates. Where transfers outside Switzerland or the EEA are necessary, appropriate safeguards are ensured, including:

• adequacy decisions recognised under the GDPR or the Swiss revFADP, including the Switzerland–EU adequacy decision for EU-region processing;
• the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework for transfers to certified recipients in the United States (as a Swiss controller, Mast relies on the Swiss-US Data Privacy Framework for its own US transfers);
• Standard Contractual Clauses (SCCs) approved by the European Commission, or Swiss equivalent clauses recognised by the FDPIC;
• other recognised transfer mechanisms as applicable.

10. Assistance to the Controller

Mast Finance shall provide reasonable assistance with:

• responding to data subject requests;
• meeting security and breach notification obligations;
• conducting data protection impact assessments, where required.

Such assistance may be subject to reasonable fees where it requires material effort beyond standard service delivery.

11. Personal Data Breaches

Mast Finance shall notify the Controller without undue delay (within 72 hours where feasible) after becoming aware of a breach affecting Customer Data, providing details of the nature, scope, consequences, and remedial measures.

12. Deletion and Return of Data

Upon termination, Customer Data follows a three-stage lifecycle:

• Day 0 to Day 30: Customer Data remains fully intact and available for export.
• Day 30: personal data within the Customer Data is anonymised and the tenant is archived.
• Day 90: the remaining tenant-scoped financial data is permanently purged from the Service; backups taken before then expire within 12 months of being taken. Only a minimal tenant record (company name and subscription metadata), cryptographic fingerprints of the audit trail (no content), and Mast Finance's own billing records are retained thereafter, as required for Mast Finance's 10-year bookkeeping obligation under CO Art. 958f.

Before the purge, Mast Finance returns the Customer Data to the Controller as a complete archive, prepared when the account closes, unless the Controller declines it in writing. Mast Finance will provide written confirmation of deletion upon request. The full lifecycle, including how deletion is requested, is set out in the Data Retention & Account Deletion Policy.

13. Audit Rights

Audit rights are ordinarily satisfied through the following remote mechanisms:

• completion of Mast Finance's standard security and compliance questionnaire;
• provision of any third-party audit reports or certifications Mast Finance holds at the time of the request.

Physical and on-site audits are not granted as of right. Where the Controller's regulatory obligations require more than the mechanisms above, the parties will agree a proportionate alternative in good faith. Audit requests may be submitted to contact@mastfinance.io and may be made no more than once per calendar year, except following a confirmed breach.

14. Liability

Liability is subject to the limitations in the Terms of Service, to the extent permitted by applicable data protection law.

15. Governing Law and Jurisdiction

This DPA is governed by and construed in accordance with Swiss law, excluding conflict of law rules. The parties submit to the exclusive jurisdiction of the courts of Lausanne, Switzerland. Nothing in this section limits a data subject's right to bring proceedings in any competent jurisdiction as permitted by applicable data protection law.

16. Language

This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails. A rendering in any other language is provided for information only.

Mast Finance Sàrl — Rue Centrale 15, 1003 Lausanne, Switzerland — contact@mastfinance.io