TexaCoreData Processing Agreement
Version 2026-10-27 · Effective 27 October 2026
This Data Processing Agreement ("DPA") sets out how Next Revolution for Software Development, Dublin, Ireland ("Next Revolution", "we", "us", the processor) processes personal data on behalf of the business that has subscribed to the TexaCore cloud service ("you", the controller). It meets Article 28 of Regulation (EU) 2016/679 (the GDPR) and the equivalent provisions of the UK GDPR. TexaCore is the name of our product.
1. Scope and roles
1.1 This DPA forms part of the Terms of Service between you and us and applies from the day you start using the service, for as long as we process personal data for you. It applies to personal data that you or your users enter into, import into, or store through the TexaCore cloud service, and to the cloud backup copies of your desktop company files ("customer personal data").
1.2 For customer personal data you are the controller and we are the processor. If you are yourself a processor acting for your own customers, we are a subprocessor, and you confirm that you have the authority to give us the instructions in this DPA.
1.3 For personal data about your account administrators, billing contacts and website visitors, and for the licence and device information of the desktop edition, we are a controller. The Privacy Policy covers it.
2. Instructions
2.1 We process customer personal data only on your documented instructions. This DPA, the Terms of Service, your configuration of the service, and the actions your users take in it are your instructions. We process it to provide, secure, support and back up the service, and as the law requires.
2.2 If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you before we do it unless the law forbids this.
2.3 We do not sell customer personal data, we do not use it for advertising, and we do not use it to train AI models of our own.
3. Details of the processing
3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex 1.
4. Confidentiality
4.1 We make sure that the people who are authorised to process customer personal data are bound by confidentiality, and give access only to those who need it to provide the service.
5. Security
5.1 We take the technical and organisational measures required by Article 32 of the GDPR. The measures are described on the Security page. They include protection of connections with TLS, encryption at rest by our hosting provider, isolation of each company's data, role and company permissions, an audit trail and backups. We may update the measures if the update does not reduce the overall level of protection.
5.2 You are responsible for your own use of the service: who you give access to, the strength of your users' passwords, and the data you choose to enter.
6. Subprocessors
6.1 You give us general authorisation to use the subprocessors listed on the Subprocessors page. We have a written contract with each subprocessor that puts on it data protection obligations no less protective than those in this DPA. We remain responsible for our subprocessors' performance.
6.2 We tell you at least 30 days before we add or replace a subprocessor, by email to your account administrator or by a notice in the service, and we update the Subprocessors page. You may object on reasonable data protection grounds within that time by writing to [email protected]. We will then work with you in good faith to find a solution; if none is found, you may end the affected part of the service and receive a refund of fees paid for the period after it ends.
7. Assistance
7.1 Taking into account the nature of the processing, we help you answer requests from individuals who use their rights (access, correction, erasure, restriction, portability and objection). If an individual contacts us about customer personal data, we send them to you and do not answer on the substance without your instruction, unless the law requires it. The service includes tools to find, correct, export and delete data.
7.2 We help you meet your duties on security, breach notification, data protection impact assessments and prior consultation of a supervisory authority, to the extent they relate to our processing and the information available to us.
8. Personal data breaches
8.1 We tell you without undue delay after we become aware of a personal data breach affecting customer personal data. We tell you what we know about its nature, the data and people affected, its likely consequences and the steps taken, and we help you to meet your own notification duties.
9. International transfers
9.1 Customer personal data is hosted in London, United Kingdom. Where we or a subprocessor transfer customer personal data outside the United Kingdom and the European Economic Area, we make sure that an adequacy decision, Standard Contractual Clauses (with the UK addendum where needed) or another lawful transfer mechanism applies. Where the Standard Contractual Clauses are needed between you and us, module 2 (controller to processor) or module 3 (processor to processor) applies and is incorporated into this DPA, with Irish law and the courts of Ireland.
10. Return and deletion
10.1 While your subscription is active you can export your data. For 30 days after it ends we keep your data so you can export it. Then we delete customer personal data from our live systems within 30 days. Copies in backups are overwritten in the normal backup cycle. We will confirm deletion in writing if you ask.
10.2 We may keep customer personal data after that only if the law requires us to, and then only for that purpose.
11. Information and audits
11.1 We make available to you the information necessary to show that we meet this DPA. You may audit our compliance once a year, and also after a personal data breach, on 30 days' written notice, during business hours, subject to confidentiality, without disrupting the service or other customers' data, and at your own cost. We may first answer your questions in writing or with documents, which you agree to consider before you ask for an on-site audit. A supervisory authority may audit us as the law provides.
12. Liability, term and law
12.1 Each party's liability under this DPA is governed by the limits in the Terms of Service, except where the law does not allow them.
12.2 This DPA lasts for as long as we process customer personal data for you and its obligations continue until the data is deleted. If it conflicts with the Terms of Service on the processing of personal data, this DPA prevails. It is governed by the laws of Ireland, and English is its governing language.
13. Contact
13.1 For questions about this DPA, or to ask for a signed copy: [email protected].
Annex 1 — Details of the processing
- Subject matter and nature. Hosting, storing, backing up, displaying, retrieving, exporting and deleting the data you put into TexaCore, and supporting and securing the service.
- Purpose. To provide the TexaCore cloud service and its features to you.
- Duration. The term of your subscription, the 30-day export period that follows, and the deletion period in section 10.
- Types of personal data. Depends on how you use the service. Typically: names, business contact details, addresses and tax or company identifiers of customers and suppliers; transaction, invoice, payment and account-balance records; employee records, salaries and payroll data if you use the human-resources modules; documents and attachments; messages exchanged through the service; and user names and activity logs of your users.
- Special categories. The service is not designed for special categories of personal data. If you enter them, you are responsible for having a lawful basis and appropriate safeguards.
- Data subjects. Your customers, suppliers and business partners; your employees and job applicants; your agents and contractors; and your users.
- Subprocessors. As listed on the Subprocessors page.
Annex 2 — Security measures
The measures are described on the Security page, which forms part of this DPA.