Legal · Data processing
Data processing agreement
How we handle personal information that customers send to the hosted API.
Draft under legal review. This document has not yet been approved by counsel. It shows the terms we intend to apply and may change before it takes effect.
Purpose
When a customer sends names and other details to our hosted API for screening, we process that information on the customer's behalf. This agreement will set out how we do so: under PIPEDA's accountability rules for transfers to service providers, Quebec's Law 25 and, for customers subject to it, Article 28 of the EU General Data Protection Regulation.
To be provided: counsel-drafted agreement text; whether EU customers are accepted; hosting location; whether and how long query logs are kept; the breach-notification timeline; and whether the agreement is published and incorporated by reference or signed per customer.
Planned contents
- Subject matter and nature of the processing
- Where the processing takes place
- Duration
- Instructions from the customer
- Our support obligations
- The customer's audit rights
- Privacy contact
- Confidentiality
- Technical and organisational measures
- Information duties and breach notification
- Subprocessors
- Deletion and return of data
- Liability
- Final provisions
Annex
- Processing
- Screening and matching of customer-submitted names and identifiers through the hosted API.
- Data and people
- To be provided: the categories of personal information customers may submit and the categories of people concerned.
- Privacy contact
- Privacy Officer, [email protected]
- Subprocessors
- To be provided: the published subprocessor list.
- Security measures
- The measures described in our technical and organizational measures, as in force when the data is processed.
Versions
This is the first version of this document. When it changes, earlier versions will be kept here with the dates they applied, together with a short summary of what changed.