Data processing agreement

This agreement forms part of the terms of service between [Your Company Ltd] (the processor) and the business using Hideinfotech (the controller), as required by Article 28 of the UK GDPR.

1. What we process

Personal data in the records you enter (for example staff names, supplier names and notes), for the purpose of providing Hideinfotech, for as long as the agreement lasts and the retention period set out in the terms.

2. Our commitments

• We act only on your documented instructions (using the service is such an instruction).
• Everyone with access to the data is bound by confidentiality.
• We keep appropriate security: encryption in transit, access controls separating every business's data, audit logs and backups.
• We use sub-processors only under equivalent written terms: [Supabase], [Vercel], [Stripe]. We will tell you before adding new ones.
• We help you respond to requests from individuals and to meet your security and breach-notification duties.
• We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
• At the end of the agreement we return or delete the data, except where the law requires us to keep it.
• We give you the information needed to show compliance, and allow reasonable audits.

3. International transfers

Data is not transferred outside the UK/EEA except under appropriate safeguards (such as the UK International Data Transfer Addendum).