Data processing agreement

If your company puts other people’s personal data into a Issuelane workspace, the law asks for the arrangement between us to be in writing. This page says who is who, what that writing has to contain, and how to ask for it.

Which of us is which

Two relationships, and they are not the same one.

• Your account is ours to answer for. Your address, your sign-in identifier and the record of your own use of the service are processed by [TO BE CONFIRMED: registered company name and legal form] as controller. The Privacy & Cookie Policy describes that half.
• What a workspace puts in is the workspace’s to answer for. Tasks, comments, attachments and whatever personal data they happen to contain are processed by us on that workspace’s instructions. The workspace is the controller; we are the processor.

The practical consequence: if someone asks a workspace to delete something they wrote in it, that is the workspace’s request to answer, and we help. If someone asks us to delete their account, that is ours, and profile settings does it without anybody having to ask.

What the agreement has to contain

Article 28(3) of the GDPR sets the list. Any agreement worth signing covers all of it:

• That we process only on your documented instructions, transfers included.
• That everyone who touches the data is bound to confidentiality.
• What is done to keep the data safe. The security page describes the measures in place today.
• The terms on which we may use another provider, and your right to object to one. The subprocessors page is the current list.
• That we help you answer the requests people make of you: access, correction, deletion, portability and objection.
• That we help you with security, with telling an authority about a breach, and with an impact assessment where you need one.
• What happens at the end: the data is returned or deleted, on your instruction.
• That you can see enough to check all of the above, and that we submit to an audit.

Data leaving the EEA

Where a provider processes, and under what mechanism anything leaves the European Economic Area, is set out per provider on the subprocessors page and summarised in the Privacy & Cookie Policy. An agreement naming a mechanism has to name the same one.

Asking for one

[TO BE CONFIRMED: whether a signed data processing agreement is offered, and who signs it]

Write to legal@cublya.com and say which company is signing. If your own agreement is the one you want used, send it and we will read it.

This page is at /dpa and will keep that address.