Data processing agreement

1. Parties and scope

1.1 This agreement is between the customer named on the Subtilitas account ("the customer"), as controller, and BHIK Studios Ltd, trading as SYNF, registered in Scotland with number SC670511, of 1 Cambuslang Court, Cambuslang, Glasgow G32 8FH ("SYNF"), as processor.

1.2 It applies whenever SYNF processes personal data in customer content to provide Subtilitas, and forms part of the terms of service. A customer that needs a signed copy can ask at [email protected].

1.3 Words such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time.

2. Roles and instructions

2.1 The customer is the controller of personal data in customer content, and SYNF is its processor. The details of the processing are in Annex 1.

2.2 SYNF will process that personal data only on the customer's documented instructions. The terms, this agreement and the customer's use and configuration of the service are the customer's complete instructions. SYNF will tell the customer if it believes an instruction breaks data protection law.

2.3 If the law requires SYNF to process the data in any other way, SYNF will tell the customer first unless the law forbids it.

2.4 The customer is responsible for having a lawful basis for the processing, for giving its workers and other data subjects the information the law requires, and for the content it puts into the service.

3. Keeping each customer's content separate

3.1 SYNF keeps each customer's content strictly separate from every other customer's. In particular:

• every guide, file and record is tied to a single customer account, and the service checks that link on every request so one customer's users cannot see or change another customer's content;
• photos, videos and documents are stored in folders specific to each customer and served only after the service has checked that the user belongs to that customer;
• guides are never shared between customers;
• customer content is used only to provide the service to that customer, and is not combined with other customers' content for any purpose; and
• SYNF staff access customer content only when needed to provide support the customer has asked for, to keep the service secure, or where the law requires.

3.2 SYNF may use anonymous, aggregated measures of how the service is used (such as page load times or the number of guides completed across all customers) to run and improve the service. These contain no customer content and identify no person or customer.

4. Confidentiality and security

4.1 SYNF will make sure that everyone it authorises to process the personal data is bound by a duty of confidentiality.

4.2 SYNF will apply the technical and organisational measures in Annex 2, and will keep them appropriate to the risk. It may update them, provided the overall level of protection does not fall.

5. Sub-processors

5.1 The customer gives SYNF general authorisation to use sub-processors. The current sub-processors are listed in Annex 3.

5.2 SYNF will give the customer at least 30 days' notice by email before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that period. If SYNF cannot address the objection, the customer may end the affected subscription and receive a refund of fees paid for the period after it ends.

5.3 SYNF will put a written contract in place with each sub-processor with data protection obligations no less protective than this agreement, and remains responsible to the customer for each sub-processor's performance.

6. International transfers

SYNF will not transfer personal data outside the UK, or allow a sub-processor to do so, unless the transfer is covered by UK adequacy regulations or by the ICO's International Data Transfer Agreement or Addendum, with any supplementary measures needed.

7. Helping the customer

7.1 Taking into account the nature of the processing, SYNF will help the customer to respond to requests from data subjects exercising their rights, mainly by providing export, correction and deletion tools in the service. If SYNF receives a request directly, it will pass it to the customer without undue delay and will not respond itself unless the customer asks it to.

7.2 SYNF will give the customer reasonable help with data protection impact assessments and consultations with the ICO that relate to the service.

8. Personal data breaches

8.1 SYNF will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer content.

8.2 The notice will describe, as far as SYNF then knows, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the steps taken or proposed. SYNF will update the customer as it learns more, and will help the customer meet its own obligations to notify the ICO and data subjects.

9. Deletion or return at the end

9.1 When the subscription ends, the customer can export its content for 30 days.

9.2 SYNF will then delete customer content from the live service, and it will be removed from backups within a further 7 days as they expire, unless the law requires SYNF to keep it. SYNF will confirm deletion in writing if asked.

10. Audits and information

10.1 SYNF will make available the information reasonably needed to show it complies with this agreement, including answers to security questionnaires and copies of relevant certificates.

10.2 If that information is not enough, the customer, or an independent auditor it appoints under a duty of confidentiality, may audit SYNF's compliance once a year on at least 30 days' notice, during working hours and in a way that does not expose other customers' data. Each party bears its own costs unless the audit finds a material breach by SYNF.

11. Liability, duration and law

11.1 Each party's liability under this agreement is subject to the limits in the terms of service, except where data protection law does not allow those limits.

11.2 This agreement lasts as long as SYNF processes personal data in customer content.

11.3 This agreement is governed by the law of Scotland, and the Scottish courts have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Security measures

• Separation of each customer's content as described in section 3.
• Encryption in transit using TLS.
• Role-based access in the service, so customers decide which users can edit, approve and report.
• Staff access to production systems limited to named people who need it, protected by multi-factor authentication and logged.
• Nightly backups kept in a separate location for 7 days, with restores tested quarterly.
• Security updates applied promptly, and dependencies monitored for known vulnerabilities.
• Logging and monitoring to detect misuse and investigate incidents.
• Data on worker devices limited to what is needed for offline use.
• SYNF holds Cyber Essentials certification covering the whole organisation.

Annex 3: Sub-processors

Once billing starts, Stripe will process payments. Stripe handles account and billing data, not customer content, so it is covered by the privacy notice rather than this list.