Data Processing Agreement

01When this applies

This agreement forms part of our Terms of Service. It applies when you (the “Customer”) use the Service to process personal data for which you, or your client, decide the purpose: for example, your client’s customers, staff or contacts, or vendors you register. For that data, you (or your client) are the Data Fiduciary or controller, and we (Seidr Stack) are the Data Processor.

It covers data-protection laws that apply to that data, including India’s Digital Personal Data Protection Act, 2023 and, where relevant, the GDPR. If this agreement and the Terms conflict on personal data, this agreement wins.

02Your instructions

We process the data only to provide the Service as you configure and use it, and on your other documented instructions. Using the Service’s features (reading, drafting, publishing, syncing, sharing links) is an instruction. We’ll tell you if we believe an instruction breaks the law.

03Our commitments

• Confidentiality: only people who need access to run the Service have it, and they’re bound to confidentiality.
• Security: we keep appropriate technical and organisational measures, including encryption in transit, encrypted storage of credentials, access checks on every request, and private file storage (see the Privacy Policy).
• Subprocessors: we use the ones listed on our Subprocessors page, under terms at least as protective as these, and remain responsible for them. We give notice of changes and you may object.
• Helping you: we help you respond to people’s requests to exercise their rights, and with impact assessments and regulator questions, as far as the Service allows.
• Breaches: we tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we’re doing.
• Transfers: where data leaves India or the EEA, we use transfer mechanisms the law permits.

04Your commitments

• You have a lawful basis, notices and consents needed for the data you put in and the people you invite.
• You don’t put in more personal data than the work needs, and avoid sensitive categories unless necessary and lawful.
• You keep your account’s access, roles and links under control.

05Deletion and return

You can download your outputs and delete data at any time in the app, and ask us for a full copy of your data. When your account is deleted, we delete your data as the Privacy Policy describes, except where the law requires us to keep it.

06Information and audits

On reasonable request, we’ll give you the information needed to show we meet this agreement. If that isn’t enough, a reasonable audit can be agreed in advance, at your cost, no more than once a year, without access to other customers’ data.

07Signing a copy

This agreement applies automatically when it’s relevant. If your organisation needs a signed copy or its own form, write to support@seidrstack.com.