B2B data processing addendum

Roles

The company acts as controller when deciding which users to invite, which seats to purchase and which administrators to authorise. Prism Finance acts as processor to provision and operate the B2B environment.

Prism Finance may act as an independent controller for direct accounts, security, support, payments, compliance and its own service communications.

Purpose limitation

Using Prism Finance, its metrics or inferences for hiring, dismissal, promotion, salary, evaluation, discipline or any employment decision is prohibited. No corporate endpoint or export provides individual metrics alongside a UID or email.

Data processed

Email, UID, role, associated company, Premium status, contracted and active seats, assignment or revocation events, billing data and aggregated operational analytics.

Security

The service uses authentication, role-based controls, company separation, Firestore rules, document validation, HTTPS/TLS, secrets management and traceability of seat changes.

Subprocessors and transfers

Prism Finance may use technical providers for hosting, databases, authentication, payments and support, subject to equivalent obligations. International transfers will be covered by valid mechanisms under the GDPR.

Rights, breaches and termination

Prism Finance will reasonably assist the customer with data subjects' rights, notify breaches without undue delay and delete or return data upon contract termination unless retention is legally or technically necessary.