Terms for the Auditbench beta

These terms govern the use of Auditbench, a service provided by Zenaclove IT Solutions (“Zenaclove”, “we”), during its beta. They are an agreement between Zenaclove and the accounting or audit firm whose workspace you join (“the firm”). Each person the firm invites agrees to them, as a user of that workspace, when accepting the invitation.

The data processing annex at the end is part of these terms. How we handle personal data is described in the Privacy notice.

Auditbench is in beta. Bank statement analysis and ledger validation are available today. Features may change or be withdrawn, and some will behave in ways we have not yet found; where a change affects your work, we say so in the product or by email. Any fees for the beta are those agreed with the firm in writing.

• There is no public sign-up. The firm decides who is invited and with what role, and is responsible for how its users use Auditbench.
• Each account is for one person. Keep your password to yourself, and tell us at support@auditbench.app straight away if you think someone else has used your account.
• When someone leaves the firm, the firm removes them from its workspace.

The firm keeps all rights in the records it uploads and in what it produces from them. It gives Zenaclove only the rights needed to store, process and display them in order to provide Auditbench, on the terms of the data processing annex.

The firm confirms that it is entitled to upload the records it uploads, that it has a lawful basis for doing so, and that it has given its clients any notice the law requires.

Auditbench reads statements, suggests classifications and flags variances. It does not form an opinion. Its suggestions can be wrong, particularly on statement layouts it has not met before, and scanned statements are refused rather than guessed at. The firm reviews what Auditbench produces, and the firm’s professional judgement, opinions and working papers remain its own responsibility.

Neither the firm nor its users may:

• upload records the firm is not engaged or otherwise entitled to handle;
• attempt to reach another firm’s data, or test or probe the security of the service — suspected vulnerabilities should be reported to support@auditbench.app;
• upload files intended to harm the service or its users;
• give access to anyone outside the firm, or resell the service, without our agreement;
• extract data by automated means other than the exports the product provides.

We work to keep Auditbench available and to fix faults promptly, but during the beta there is no service level commitment, and maintenance may interrupt the service. Support is by email at support@auditbench.app.

Each party keeps the other’s confidential information confidential and uses it only for the purposes of these terms. The firm’s client data is the firm’s confidential information. This does not apply to information that is public through no fault of the receiving party, or that the law requires to be disclosed — in which case the other party is told first, where the law allows.

Zenaclove owns Auditbench, its software and its content, other than the firm’s data. Feedback the firm gives us may be used to improve the service without any obligation to the firm.

The firm may stop using Auditbench and ask us to close its workspace at any time. We may end the beta for a firm on 30 days’ notice by email.

We may suspend access immediately where that is needed to protect the service, other firms or their data, or in response to a serious breach of these terms, and we tell the firm why. When the agreement ends, the return and deletion commitments in the data processing annex apply.

During the beta, Auditbench is provided as it stands, without any promise that it will be uninterrupted or free of error. That does not reduce Zenaclove’s obligations under the data processing annex. To the extent the law allows:

• neither party is liable to the other for indirect or consequential loss, or for loss of profit, revenue or goodwill;
• Zenaclove’s total liability under these terms is limited to the greater of the fees the firm paid for Auditbench in the twelve months before the claim and ₦1,000,000 (one million naira);
• for a breach of the data processing annex or of confidentiality, that limit is three times that amount.

No limit applies to liability for fraud, wilful misconduct or gross negligence, or to anything else the law does not allow to be limited.

These terms are governed by the laws of the Federal Republic of Nigeria. A dispute is first taken to good-faith discussion between senior representatives of each party for 30 days; if it is not settled, the courts of Lagos State have exclusive jurisdiction. Nothing here stops either party seeking urgent relief from those courts.

New versions of these terms are published here under a new version date. For a material change, we email each firm’s administrators at least 30 days before it takes effect, and each user is asked to accept the new version. We keep a record of which version each person accepted, and when.

Questions about these terms go to support@auditbench.app.

This annex governs Zenaclove’s processing of personal data in client data on the firm’s behalf, as required by the Nigeria Data Protection Act 2023 and, to the extent it applies, Article 28 of the EU General Data Protection Regulation.

A1. Roles and scope

• Roles. The firm is the controller of client data; Zenaclove is its processor.
• Subject matter and duration. Providing Auditbench to the firm, for as long as these terms apply and until client data is deleted under A8.
• Nature and purpose. Storing statement files, ledgers and trial balances; reading transactions from them; classifying, reviewing and reconciling them; and producing reports — all at the firm’s direction.
• Personal data. Names, account names and numbers, narrations, amounts, balances, dates and counterparties, as they appear in the records the firm uploads.
• Data subjects. The firm’s clients and the individuals named in their records, such as employees, customers, suppliers and relatives.

A2. Instructions

Zenaclove processes client data only on the firm’s documented instructions. These terms, and the firm’s use of the product, are those instructions. We tell the firm if we believe an instruction breaks data protection law. If the law requires us to process client data in any other way, we tell the firm before doing so, unless the law forbids it.

A3. Confidentiality

Only Zenaclove staff who need access to operate and support the service can reach client data, and each is bound by a duty of confidentiality.

A4. Security

We maintain the measures described under How it is protected in the Privacy notice, including separation of each firm’s records in the database, capability-based access within a firm, private storage of statement files, encryption in transit and at rest, and an append-only audit trail. We review them as the service develops and do not reduce the protection they give.

A5. Sub-processors

The firm authorises the sub-processors listed in the Privacy notice. Each is bound by written data protection terms that protect client data at least as well as this annex, and Zenaclove remains responsible to the firm for their performance. We give the firm’s administrators at least 30 days’ notice by email before adding or replacing a sub-processor that handles client data. The firm may object on reasonable data protection grounds; if we cannot resolve the objection, the firm may end these terms before the change takes effect, and we refund any fees it paid in advance for the time after that, pro rata.

A6. Personal data breaches

As section 40 of the Nigeria Data Protection Act 2023 requires of a processor, we notify the firm on becoming aware of a breach affecting client data — without undue delay, and in any case within 24 hours, so that the firm can meet its own 72-hour deadline to notify the Nigeria Data Protection Commission. The notice says what we know: what happened, the kinds and approximate number of records and people affected, the likely consequences, and what we have done and propose to do. Where not everything is known yet, we send what we have and follow with the rest as we learn it, and we answer the firm’s questions so it can inform the Commission and the people affected. We do not notify regulators or individuals on the firm’s behalf unless the firm asks us to or the law requires it.

A7. Assistance

If we receive a request from an individual about client data, we pass it to the firm and do not answer it ourselves beyond saying so. We help the firm find, export, correct or delete the records a request concerns, and assist with data protection impact assessments and consultations with a regulator, as far as the information available to us allows.

A8. Return and deletion

When these terms end, the firm may export its reports for 30 days, and on request we return the original statement files. We then delete the firm’s client data, statement files and audit trail within a further 30 days, and confirm the deletion in writing on request, unless the law requires us to keep something. Copies in our providers’ backups expire on their rolling schedules, and in any case within 90 days; they are restored only to recover the service, and any deleted data restored that way is deleted again.

A9. Information and audit

We make available the information needed to show that we meet this annex, and answer reasonable security questionnaires. The firm, or an independent auditor it appoints under a duty of confidentiality, may audit our compliance on 30 days’ notice, no more than once a year unless a breach or a regulator requires it, and at the firm’s cost. Where a sub-processor’s own certifications or audit reports answer the question, we rely on those.

A10. International transfers

Client data is held in Ireland, and statement files are stored in the United States. Each transfer out of Nigeria relies on contractual clauses that give the data an adequate level of protection, as section 41 of the Nigeria Data Protection Act 2023 allows, and is described under International transfers in the Privacy notice.