Data processing agreement

This agreement forms part of the subscription agreement between Archiet Ltd ("we", "us") and the organisation that subscribes to the hosted Entelim service ("you", "the customer"). It applies whenever we process personal data on your behalf in providing that service, and it takes precedence over the subscription agreement where the two conflict on data protection.

It is written to meet Article 28 of the UK General Data Protection Regulation and the Data Protection Act 2018. Where you are subject to the EU General Data Protection Regulation, it applies in the same way to processing that falls under that regulation.

1. Roles

You are the controller of the personal data your users enter into, or import into, your organisation's workspace. We are your processor for that data.

We are a controller, not a processor, for the limited data we need to run the relationship with you: the contact and billing details of the people who buy and administer the subscription. Our privacy notice covers that data.

2. What we process, and why

3. Instructions

We process your personal data only on your documented instructions. The subscription agreement, this agreement, and your use and configuration of the service are your complete instructions at the start. If we are required by UK law to process the data in some other way, we will tell you first unless that law forbids it. If we believe an instruction breaks data protection law, we will tell you promptly.

4. Confidentiality

Everyone we authorise to process your personal data is bound by a duty of confidentiality, whether by contract or by law, and has access only to what their role requires.

5. Security

We take appropriate technical and organisational measures to protect your personal data, as Article 32 requires. They include:

• encryption of data in transit between users' browsers and the service;
• separation of each organisation's records, so one customer's users cannot read another's;
• passwords stored only as salted hashes, never in readable form;
• sessions that expire after a period of inactivity, and protection against cross-site request forgery on every action that changes data;
• role-based access within your workspace, controlled by your administrators;
• an audit trail of significant changes made in the workspace.

We review these measures as the service and the risks change, and we will not reduce the overall level of protection during your subscription.

6. Sub-processors

You authorise us to use sub-processors to provide the service. They fall into these categories:

• cloud hosting and infrastructure, for running the service and storing its data;
• transactional email delivery, for password resets and notifications;
• payment processing, for taking subscription payments;
• AI model providers, only where your organisation uses the AI features of the service. They are named in the sub-processor list.

The AI model providers are named in the sub-processor list; we will give you the list of the other sub-processors on request. We will tell you at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you in good faith; if we cannot resolve it, you may end the affected part of the subscription and we will refund any fees you have paid in advance for the period after it ends.

Our hosting, email and payment sub-processors are bound by written terms that protect your personal data at least as well as this agreement does. The AI model providers in the sub-processor list are not: we have no data processing agreement with them, and their terms may let them keep prompts and use them to train their models. We remain responsible to you for what our sub-processors do.

7. International transfers

Our hosting, email and payment sub-processors will not receive your personal data outside the United Kingdom unless the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

This does not apply to the AI features. When your users use them, content that can include personal data is sent to the AI model providers in the sub-processor list, in the United States and the People's Republic of China, without an adequacy regulation or a safeguard of the kind above. If you do not want that, do not use the AI features with personal data, or ask an administrator to turn them off.

8. Helping you meet your obligations

Taking into account the nature of the processing and the information available to us, we will:

• help you respond to requests from people exercising their data protection rights — much of this you can do yourself in the service, and where you cannot, we will help. If a request reaches us directly, we will pass it to you and not respond to it ourselves unless you ask us to;
• help you with your security obligations, with data protection impact assessments, and with prior consultation of the Information Commissioner's Office where that is needed.

9. Personal data breaches

If we become aware of a personal data breach affecting your personal data, we will tell you without undue delay, and in any case within 48 hours. We will give you the information you need to meet your own reporting obligations, as it becomes available, and take reasonable steps to contain the breach and limit its effects.

10. When the subscription ends

When your subscription ends, you can export your data for 30 days. After that, we will delete your personal data from the live service, unless UK law requires us to keep it. Copies in backups are deleted as the backups expire on their normal cycle, within 90 days, and are protected by this agreement until then.

11. Information and audits

We will make available the information you reasonably need to show that this agreement is being met. We will also allow audits by you, or by an independent auditor you appoint who is bound by confidentiality, on at least 30 days' notice, no more than once a year unless a regulator requires it or a personal data breach has occurred. Audits take place during business hours and must not disrupt the service for other customers. Each party bears its own costs.

12. Liability and law

Each party's liability under this agreement is subject to the limits in the subscription agreement. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Questions about this agreement: contact us.