Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (the DPA) applies where, in your use of the Service, Textent processes personal data on your behalf. For that data you are the controller and Textent is the processor. This DPA forms part of, and is subject to, our Terms of Service.

2. Definitions

Terms such as controller, processor, personal data, processing, data subject, and supervisory authority have the meanings given in applicable data protection law, including the GDPR and UK GDPR.

3. Processing instructions

We will process personal data only on your documented instructions, including as set out in the Terms, this DPA, and your use of the features of the Service, unless we are required to process it by law, in which case we will inform you unless the law prohibits it.

4. Confidentiality

We ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations.

5. Security

We implement appropriate technical and organizational measures to protect personal data, taking into account the state of the art and the risks of processing, as described in Annex 2 and in our Security overview.

6. Subprocessors

You authorize us to engage the subprocessors listed in the Subprocessors document to process personal data. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give you a way to learn of changes to our subprocessors and an opportunity to object on reasonable grounds.

7. Data subject requests

Taking into account the nature of the processing, we will assist you with appropriate measures to respond to requests from individuals to exercise their rights, to the extent you cannot address those requests yourself through the Service.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, and will provide information reasonably available to us to help you meet your notification obligations.

9. International transfers

Where we transfer personal data across borders on your behalf, we will rely on a lawful transfer mechanism. The parties agree that, where required, the European Commission standard contractual clauses and, for UK transfers, the UK International Data Transfer Addendum, are incorporated into this DPA by reference and apply to the transfers they cover.

10. Deletion and return

On termination of the Service, we will delete or, at your request, return the personal data we process on your behalf, except to the extent we are required to retain it by law.

11. Audits

On reasonable request, we will make available information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, subject to reasonable confidentiality and security limits.

12. Liability and precedence

Each party liability under this DPA is subject to the limitations of liability in the Terms. In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.

Annex 1: Description of the processing

Annex 2: Technical and organizational measures

We maintain measures including:

• encryption of data in transit and of sensitive data at rest;
• logical tenant isolation and request-level access scoping;
• role-based access control and least-privilege access to production;
• secure credential storage and encrypted access tokens;
• logging, monitoring, and incident response processes;
• regular backups and recovery testing;
• secure software development and dependency management.

Annex 3: Subprocessors

The current list of subprocessors is maintained in the Subprocessors document and forms part of this DPA.