Scope and roles
Customer Payroll Data means personal information relating to a Customer's employees or payroll activities that the Customer, its authorized users, or employees submit to or generate through Payroll, including payroll documents and private Support content submitted to resolve a payroll issue. It excludes Beanflow's separate account administration, website analytics, security administration, and subscription billing data, which are governed by the Privacy Policy.
The Customer decides which payroll data to provide, the authorized users and recipients, and the lawful purposes of payroll processing. Beanflow provides the requested processing service and remains responsible for its own acts, safeguards, and obligations under applicable privacy law. These descriptions allocate contractual responsibilities and do not override any legal determination of control or accountability.
Processing details and customer instructions
The nature and purpose of processing are to receive, store, organize, calculate, display, generate, export, and deliver payroll information and documents, operate authorized employee access, and provide private payroll-related Support, security, and incident response. Processing lasts for the account relationship and applicable retention or deletion periods.
Data subjects may include employees, former employees, employer representatives, and document recipients. Data may include identifying and contact details, dates of birth, Social Insurance Numbers, employment and payment information, hours, earnings, deductions, tax forms and claims, payroll history, and related documents.
Beanflow will process Customer Payroll Data only to deliver and secure the agreed service, comply with these Terms, follow the Customer's documented and lawful instructions through supported product features or authorized Support requests, and meet applicable legal duties. If an instruction appears unlawful or cannot be performed through the service, we may decline it, explain the issue where legally permitted, and discuss a lawful alternative. We will not use Customer Payroll Data for advertising, sell it, or train general-purpose AI models on it without separate authorization.
Confidentiality and safeguards
Beanflow will restrict access to Customer Payroll Data to authorized personnel and providers with a legitimate need, subject to confidentiality and appropriate security obligations. We will use safeguards proportionate to the sensitivity of payroll information, including access restrictions, private document handling, and protective controls for data in storage and transit.
Customer is responsible for selecting authorized account users and document recipients, securing credentials and downloaded copies, and providing any required employee notices or authority. Customer must avoid submitting sensitive information in public or shared Support tickets.
Subprocessors and cross-border processing
Customer authorizes Beanflow to use service providers reasonably needed to supply Payroll and related Support, including database and storage, authentication, hosting and delivery, email, and diagnostics providers. The Privacy Policy identifies the principal provider categories and current named providers. We will use contractual or other appropriate measures to require providers handling Customer Payroll Data for us to provide comparable protection, including restrictions on unauthorized use and disclosure.
We will assess material privacy risks when engaging providers, including processing outside Canada. Core Payroll database and payroll file storage are described in the Privacy Policy as hosted in Canada, but authentication, network delivery, email, support infrastructure, and diagnostics may involve other countries. We will make reasonably available information about material provider changes on request and, where practicable, provide advance notice of a material change in processing so the Customer can raise a substantiated privacy concern before the change.
Where a provider independently handles information for its own security or legal purposes, that separate role is described in its applicable privacy notice. Beanflow remains accountable for transfers within its control and cannot contract away mandatory legal duties.
Security incidents and cooperation
After becoming aware of a confirmed or reasonably suspected security incident involving unauthorized access to, disclosure, or loss of Customer Payroll Data, Beanflow will investigate, take proportionate containment and remediation steps, and inform the affected Customer without undue delay when the incident reasonably warrants customer action or notification. We may provide information in stages as facts are verified, subject to legal or security restrictions.
We will provide reasonably available information about affected data, known scope, mitigation, and corrective actions to assist the Customer in assessing any duty to notify individuals or regulators. Each party remains responsible for the reporting, notification, and record-keeping duties imposed on it by applicable law. Neither party will assume that notification to the other alone discharges those duties.
Privacy requests and cooperation
Each party will promptly direct requests concerning the other party's responsibilities to the appropriate contact and provide reasonable assistance, taking account of the nature of the request and information available. The Customer ordinarily handles the accuracy and correction of employer-controlled payroll records. Beanflow will independently address access, correction, or complaint obligations that apply directly to it, including any statutory response periods.
Before releasing or modifying sensitive payroll information, we may verify the requester's identity and authority. We will avoid unnecessary disclosure of other employees' records and will preserve data where needed for a pending lawful access request or dispute.
Data access, return, and deletion
During the account relationship, the Customer may view or export records available under its plan, except while ordinary Payroll access is suspended for a valid overdue Basic invoice under the Terms. The Customer is responsible for retaining copies needed to satisfy its own employment and tax obligations. This Addendum does not expand Free-plan features, waive valid overdue subscription charges, or create a separate right to free T4 generation or downloads. Independently applicable statutory personal-information access rights remain available.
Before requesting closure, the Customer should export available records. For a verified, lawful request for other Customer Payroll Data, we will assess reasonably practicable secure access or return options, subject to privacy rights, contractual plan boundaries, applicable law, and any mutually agreed service charge. We do not guarantee recovery of already deleted data.
Once an authorized permanent deletion request is completed, we delete the associated Customer Payroll Data and files from active systems, except for limited information subject to applicable legal retention or preservation requirements described in the Privacy Policy. Residual backups expire through their normal rotation and are protected from routine access; if a backup is restored, applicable deletion instructions will be reapplied. Already delivered emails and files downloaded by recipients remain outside our control.
Relationship to other terms and contact
Where this Addendum and the Terms conflict about the handling of Customer Payroll Data, this Addendum prevails for that processing only, except where mandatory law requires otherwise. The Terms' limitation-of-liability and other commercial provisions apply to this Addendum to the extent permitted by law, without limiting statutory privacy rights or obligations. Other services, including Bookkeeping and TaxGPT, are not covered by this Addendum.
For a processing instruction, privacy request, or concern about a service provider, email [email protected] with the subject "Privacy request". Please do not include full payroll files or Social Insurance Numbers in your initial message.