Data processing agreement

Scope

This agreement forms part of the terms between your company (the "Customer") and Sitedaftar ("daftar"). It applies when daftar processes personal information on the Customer's behalf while providing the Service.

Roles

The Customer is the controller of personal information in its workspace. daftar is the processor and acts only on the Customer's documented instructions, which include the terms, this agreement and the Customer's use of the Service.

What is processed

• People: the Customer's staff, guests and other people who appear in workspace content.
• Information: names, phone numbers, roles, messages, voice notes, photos, location and time stamps, signatures and files.
• Purpose: providing, securing and supporting the Service.
• Duration: the length of the agreement, plus the deletion period in the terms.

daftar's commitments

• keep the information confidential and make sure staff with access are bound by confidentiality;
• apply the security measures described on the security page;
• help the Customer respond to requests from individuals and to regulators;
• tell the Customer without undue delay after becoming aware of a personal data breach;
• delete or return information when the agreement ends, unless the law requires it to be kept.

Sub-processors

The Customer authorises daftar to use sub-processors for hosting, messaging, translation and speech-to-text, and payments. daftar will give at least 30 days' notice of a new sub-processor, and the Customer may object on reasonable grounds. The current list is available from hello@sitedaftar.com.

International transfers

Where information is transferred between countries, daftar uses the safeguards required by the applicable law.

Audits

On reasonable request, daftar will provide the information needed to show it meets this agreement.