Data Processing Agreement

1. Roles

The Customer is the controller (or business) for personal data in Customer Content, and Selvian is its processor (or service provider). Selvian processes that data only to provide the service and on the Customer’s documented instructions, which include the Terms of Service, the order and the Customer’s use of the service’s settings.

2. Subject matter and duration

The processing concerns the hosting, storage, indexing for search, display, versioning and deletion of Customer Content, for the duration of the subscription and the deletion period that follows.

3. Categories of data and people

• People concerned: the Customer’s staff, contractors and other users of its workspace, and any person mentioned in pages the Customer writes.
• Data: names, work contact details, roles, sign-in records, and any personal information the Customer chooses to include in pages and comments.
• The service is not designed for special categories of data, such as health or biometric data; the Customer should not store such data in pages.

4. Processor obligations

• Process personal data only on the Customer’s instructions, and tell the Customer if an instruction appears to break the law.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational measures, including encryption in transit, access controls and limited internal access.
• Not sell personal data, and not use it for any purpose other than providing the service.

5. Sub-processors

The Customer authorises Selvian to engage the technical service providers needed to run the service (for example hosting and email delivery). Selvian will bind each one by written terms that protect the data at least as well as this DPA, keep a list available on request, and give notice of new sub-processors, allowing the Customer to object on reasonable grounds.

6. Assistance

Taking into account the nature of the processing, Selvian will help the Customer respond to requests from individuals exercising their rights, and with security, breach notification and impact assessments where required by law.

7. Personal data breaches

Selvian will notify the Customer without undue delay after becoming aware of a breach affecting Customer personal data, with the information reasonably available, and will take reasonable steps to contain it.

8. Deletion and return

At the end of the subscription, the Customer may request a copy of its Customer Content before the end date. Selvian will then delete Customer Content within the period set out in the Cancellation policy, except where retention is required by law.

9. Information and audits

Selvian will make available the information reasonably needed to show compliance with this DPA, and will answer reasonable written questionnaires about its measures, no more than once a year unless a breach or a regulator requires otherwise.

10. Transfers

Selvian is based in the United States and Customer Content is processed there. Where the law that applies to the Customer requires a transfer mechanism, the parties will agree one in writing.

11. Precedence

If this DPA conflicts with the Terms of Service regarding personal data, this DPA prevails.