Skip to main content

Data processing agreement

What it covers​

  • Roles. You are the controller of the content you check. We are the processor and handle it only to run the service for you.
  • Purpose. Your files are read to run the checks and produce the reports you ask for. They are used for nothing else. Your text is never used to train our models.
  • Sub-processors. The services that handle data for us are the ones on Sub-processors, with 30 days' notice by email before that list changes and a right to object.
  • Incidents. An incident that affects your personal data is reported to you without undue delay and within 48 hours of our becoming aware of it, with details as the investigation goes on (Support and incidents).
  • Deletion at the end. When a workspace is deleted, its profiles, term lists, runs, reports, uploads, Learn records, members, API keys and settings are removed from the live service at once. Backups rotate after 14 days, so the data leaves them within 14 days of a normal run of nightly backups; the newest complete backup is kept until a newer one succeeds, so a stalled backup can hold it longer. If a backup that still holds the workspace is ever restored, the deletion is applied again before the service opens (Backups, recovery and continuity). A workspace admin can export the workspace first.
  • Audit. The rights to information and to an audit follow the standard clauses the agreement is built on. The detail is in the agreement text.

How it is built​

Our approach is to use the European Commission's standard contractual clauses for processors under Article 28 (Decision 2021/915) as the body of the agreement, with annexes for the processing (subject, duration, categories of data and of data subjects), the technical and organisational measures (Controls we have) and the sub-processors. This describes the structure we are working to, not a signed document you can download today.

Who can have it​

A data processing agreement is available for the Business and Enterprise plans. It is the standard agreement for both; it is not negotiated per customer, except in an Enterprise contract.

How to get it​

Write to [email protected], or ask through the contact form and choose Procurement, security or DPA.

A data processing agreement is available for Business and Enterprise; ask us.