Linewise

Draft for legal review. This document is not yet in force. Highlighted parts are to be completed.

Data processing agreement

Last updated: date. This agreement forms part of the Terms of Service between Company name Ltd ("Processor", "we") and the customer ("Controller", "you"). It applies where we process personal data on your behalf in providing Linewise, and meets the requirements of Article 28 of the UK GDPR.

1. Details of the processing

Subject matterHosting and processing Customer Data to provide the Linewise service
DurationThe term of the subscription, plus the 30-day read-only period and backup retention described in the privacy notice
Nature and purposeStoring, displaying, simulating and exporting workspaces as you instruct through the service
Personal dataNames or identifiers of staff and contacts that you include in workspaces; names and emails of your users
Data subjectsYour employees, contractors and users
Special category dataNone, unless agreed in writing

2. Our obligations

We will:

  1. process the personal data only on your documented instructions (using the service as designed counts as instructions), unless the law requires otherwise, in which case we will tell you first unless that is prohibited;
  2. make sure people authorised to process it are bound by confidentiality;
  3. take appropriate technical and organisational security measures (Article 32), including encryption in transit and at rest, database-enforced separation between customers, access controls with two-factor authentication, and tested backups;
  4. use sub-processors only as set out in section 3;
  5. help you, taking into account the nature of the processing, to respond to requests from data subjects and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation;
  6. tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations;
  7. at the end of the service, delete the personal data (after giving you the chance to export it), unless the law requires us to keep it;
  8. make available the information needed to show we comply with this agreement, and allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice and no more than once a year unless there has been a breach.

3. Sub-processors

  1. You authorise us to use the sub-processors listed on our sub-processors page.
  2. We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your admins and on that page. You may object on reasonable data protection grounds; if we cannot address the objection, you may end the affected subscription and receive a pro-rata refund.
  3. We impose data protection terms on each sub-processor that are no less protective than this agreement, and remain responsible for their performance.

4. International transfers

Where a sub-processor processes personal data outside the UK, we make sure the transfer is covered by UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Addendum).

5. Your obligations

You confirm that you have a lawful basis for the personal data you put into Linewise and have given any notices required to the people concerned.

6. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Service.