Data processing addendum

Roles and scope

In shortYou decide what personal data goes into the product and why. We process it only to run the product for you.

1. The Customer is the controller and MAR Squared is the processor of personal data in Customer Data. MAR Squared is a controller only for account, billing and security data, as described in its privacy notice.
2. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in the processing details below.

Processing details

Our obligations

1. We process personal data only on the Customer’s documented instructions, which are this Agreement and the Customer’s use of the Services, unless UK law requires otherwise, in which case we will tell the Customer first unless the law forbids it. We will tell the Customer if we believe an instruction infringes data protection law.
2. We ensure everyone authorised to process the personal data is bound by confidentiality.
3. We implement the technical and organisational measures in Article 32 of the UK GDPR, as described in our security overview.
4. Taking into account the nature of the processing, we assist the Customer with data subject requests, security, breach notification, data protection impact assessments and prior consultation with the ICO. Assistance beyond the self-service tools in the Services may be charged at reasonable rates.

Sub-processors

In shortWe use a short list of named sub-processors, give 30 days’ notice of new ones, and you can object.

1. The Customer gives general authorisation for us to engage the sub-processors listed on our sub-processors page.
2. We will give at least 30 days’ notice of a new or replacement sub-processor by updating that page and notifying subscribed customers. The Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the Customer may end the affected subscription and receive a pro rata refund of prepaid fees.
3. We impose data protection obligations on each sub-processor equivalent to this DPA and remain liable for their performance.

International transfers

1. Customer Data is hosted on Microsoft Azure in the UK South (London) region. We will not transfer personal data outside the UK, or allow a sub-processor to do so, unless the transfer complies with Chapter V of the UK GDPR, using UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Personal data breaches

In shortIf something goes wrong, we tell you without undue delay and within 48 hours of becoming aware.

1. We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.
2. The notice will describe, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.

Return and deletion

1. The Customer can export Customer Data during the Subscription Term and for 30 days after it ends.
2. After that, we delete Customer Data from the live Services within a further 30 days, and from backups within 90 days, unless UK law requires us to keep it. On request we will confirm deletion in writing.

Audits and information

1. We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation and, when available, third-party certifications or audit reports.
2. Where that information is not sufficient, the Customer may carry out an audit, at its own cost, no more than once a year, on 30 days’ notice, during business hours, subject to confidentiality, and without access to other customers’ data. Audits required by a regulator are not limited in frequency.

Contact

1. Questions about this DPA, or requests for a countersigned copy, can be sent to privacy@marsquared.com.