Data Processing Agreement
The terms under which HappyFetch processes personal data on a customer's behalf (GDPR article 28). Draft, pending legal review.
This agreement applies when a customer ("you", the controller) has HappyFetch ([Legal entity pending registration], "we", the processor) process personal data on your behalf through the service. It forms part of the Terms of Service.
1. Subject and duration#
We process the personal data contained in your requests (for example a search query naming a person) and in the results we return and store for you, for as long as you use the service.
2. Your instructions#
We process personal data only to provide the service as documented, or on your other written instructions. If an instruction breaks data protection law, we'll tell you.
3. Confidentiality and security#
- Everyone with access to the data is bound to confidentiality.
- Traffic is encrypted in transit.
- API keys are stored as hashes. Stored credentials are encrypted at rest.
- Access to production systems is restricted and logged in an audit log.
- We keep backups and test restoring them.
4. Sub-processors#
You authorize the sub-processors listed in our privacy policy. We'll announce new ones at least 30 days in advance; you may object, and if we can't resolve the objection you may stop using the service.
5. Helping you#
We help you respond to requests from data subjects, with security, and with data protection impact assessments where that's reasonable given what we know.
6. Personal data breaches#
We notify you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own obligations.
7. End of the service#
When you stop using the service and ask us to, we delete the personal data we process on your behalf within 30 days, except where the law requires us to keep it.
8. Audits#
We make available the information needed to show compliance with this agreement, and allow audits by you or an auditor you appoint, with reasonable notice and at most once a year unless there has been a breach.
9. Transfers#
We transfer personal data outside the EEA only under the European Commission's standard contractual clauses or an adequacy decision.