Data Processing Addendum

• “Customer personal data” means personal data you or your members put into your workspace, such as details of staff, clients and contacts, and the recces, plans, messages, locations and media that contain them.
• You are the controller of customer personal data, and we are your processor. We are the controller only for data we use for our own purposes, such as account, billing and security data, as described in our Privacy Policy.
• Words used in this DPA, such as “personal data”, “processing” and “personal data breach”, have the meanings given in the UK GDPR.

• Have a lawful basis for all customer personal data, and an Article 9 condition (usually explicit consent) for any health data.
• Give data subjects, including your clients, the information the law requires about how their data is used.
• Make sure your instructions to us are lawful, and decide who in your organisation can access what, using the roles and settings in the service.
• Deal with requests from data subjects. We will help as set out in section 4.

• Process customer personal data only on your documented instructions, which are the Terms of Service, this DPA and the way you configure and use the service, unless UK law requires otherwise. If we think an instruction is unlawful, we will tell you.
• Make sure everyone who can access customer personal data is bound by confidentiality.
• Keep appropriate technical and organisational security measures in place, including those in the Annex, and review them regularly.
• Help you, taking into account the nature of the processing, to respond to data subjects exercising their rights, mainly through the service’s own tools such as export, correction and deletion.
• Help you with security, breach notifications, data protection impact assessments and consultations with the ICO, where they relate to our processing.
• Not sell customer personal data, or use it for our own purposes or to train AI models.

You give general authorisation for us to use the sub-processors on our Sub-processors page. We will give at least 30 days’ notice of a new sub-processor by updating that page (and by email, if you ask us to). You may object on reasonable data protection grounds. If we cannot reasonably resolve an objection, you may end the affected service and receive a pro-rata refund of prepaid fees for it. We impose data protection terms on each sub-processor that are at least as protective as this DPA, and we remain responsible for their performance.

We transfer customer personal data outside the UK only with a lawful transfer mechanism in place: UK adequacy regulations (including the UK–US data bridge for certified providers), the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We will give you the information you reasonably need to meet your own obligations, take reasonable steps to contain the breach, and keep you updated.

When your use of the service ends, you can export your content, or ask us for an export, within 30 days. After that we delete customer personal data, including from backups as they cycle out, unless UK law requires us to keep it.

We will make available the information reasonably necessary to show we comply with this DPA, including written answers to security questionnaires. If that is not enough, you may carry out, or appoint an independent auditor to carry out, an audit no more than once a year. You must give reasonable notice, keep the results confidential, and avoid disrupting our operations or compromising other customers’ data. Each party pays its own costs.

The limits of liability in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms of Service on data protection, this DPA takes priority.