Data Processing Agreement

This agreement forms part of the Terms of Service and applies whenever we process personal data on your behalf. It applies automatically; you don't need to sign a separate copy, though we'll countersign one on request.

1. Roles

You are the controller of personal data in your team's content. We are the processor and process it only on your documented instructions, which are these terms and your use of the product.

2. Our obligations

• Staff with access are bound by confidentiality.
• We apply the technical and organisational measures described on our Security page.
• We notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
• We help you respond to data subject requests and with impact assessments where reasonable.

3. Subprocessors

You authorise the subprocessors listed on the Subprocessors page. We give 30 days' notice by email before adding one, and you may object; if we can't accommodate the objection, you may cancel and receive a pro rata refund.

4. International transfers

Where data leaves the EEA or UK, we rely on adequacy decisions or the Standard Contractual Clauses (module 2 or 3), which are incorporated by reference.

5. Deletion and audit

At the end of the service we delete your data as described in the Terms. We'll provide the information reasonably needed to show compliance, including answering a security questionnaire once a year.