Data Processing Agreement

Roles. You're the controller and we're your processor for the personal data you put into getSoapy, or that getSoapy collects for you, about your customers, enquirers, your team and other people you deal with ("your personal data"). This doesn't cover the data we control under section 9.2 of the terms. Annex A describes the processing.

Your responsibilities. You're responsible for having a lawful reason to use your personal data, and for the instructions you give us.

Your instructions. We process your personal data only to provide getSoapy to you. The terms, and the way you use getSoapy, are your documented instructions to us, including for transfers outside the UK. If the law requires us to process your personal data in another way, we'll tell you before we do, unless the law forbids it. If we think the way you're using getSoapy breaks data protection law, we'll tell you straight away.

Confidentiality. Everyone we authorise to process your personal data is bound to keep it confidential.

Security. We'll take appropriate technical and organisational measures to protect your personal data, as Article 32 of the UK GDPR requires. Annex B describes them.

Sub-processors. You give us general permission to use sub-processors. Our sub-processors page lists the ones we use now.

• We'll tell you at least 30 days before we add or replace a sub-processor, by updating the page and emailing the account owner. If we have to replace one urgently, for example because it has stopped working or is no longer safe, we'll tell you as soon as we can.
• If you object on reasonable data protection grounds, tell us. We'll try to find a solution. If we can't, tell us before the change and we'll close your account on the day it happens, so you can download your data until then. We'll refund you as section 4.12 of the terms describes.
• We'll give each sub-processor data protection obligations that are at least as protective as this agreement. We remain fully responsible to you for what they do.

Helping you. Taking into account what we do and the information we have, we'll help you:

• respond to people who exercise their rights over their information, mostly through features in getSoapy, such as editing, exporting and deleting customer records;
• deal with complaints about how their information is used;
• keep personal data secure, deal with breaches, and carry out data protection impact assessments and any consultation with the Information Commission.

Breaches. If we become aware of a breach affecting your personal data, we'll tell you without undue delay, and we'll aim to do so within 48 hours. We'll give you the information you need to meet your own duties, and we'll keep you updated.

At the end. You can export your personal data while your account is open, or ask us for a copy, as section 7.2 of the terms describes. When your account closes, we'll delete your personal data as section 8.8 of the terms describes, unless the law requires us to keep it.

Showing we comply. We'll give you the information you reasonably need to show that we meet this agreement. We'll answer your questions in writing first. If that isn't enough, we'll allow an audit by you, or by an auditor you choose who is bound by confidentiality. It will be remote unless a regulator requires otherwise, with its scope agreed in advance and reasonable notice. Audits can't happen more than once a year unless there's been a breach or a regulator requires it. You pay the cost of your audit and our reasonable costs.

Transfers outside the UK. We'll only transfer your personal data outside the UK, or let a sub-processor do so, with a safeguard UK data protection law allows. Examples are a country the UK has approved, the UK International Data Transfer Agreement or Addendum, and, for certified US companies, the UK extension to the EU-US Data Privacy Framework.

Liability. Section 23 of the terms applies to this agreement.