Data Processing Addendum

For your customers' data that passes through the workflows we build for you, you decide why and how it is used, so you are the controller and we act as your processor. For data about people who use this website (visitors, members, buyers), we decide, so we are the controller. That second case is covered by the Privacy Policy.

We process the data only to deliver the service you asked for and only on your written instructions. People who work with the data are bound to keep it confidential. We apply the protections described on our security page. We use only the providers on our subprocessors list (plus any named for your project) and we tell you before adding one so you can object. We help you answer requests from your own customers to see, correct or delete their data. We tell you without undue delay if we learn of a breach affecting your data. When the work ends we delete or return the data, as you choose, unless the law requires us to keep it.

To ask for a signed DPA, contact us through the form on our homepage. Tell us the legal name of your company and which law you need it to cover (for example GDPR or UK GDPR). If you need specific clauses, such as Standard Contractual Clauses for transfers outside the EU or UK, say so in the same message.