Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of our Terms of Service. It applies whenever Arqiflow processes personal data for a firm, and meets the requirements of Article 28 of the GDPR and of the UK GDPR. A firm accepts it by accepting the Terms; nothing more needs to be signed.

Some firms need a copy signed by both sides for their records. See a signed copy below.

The firm is the controller of the personal data in its work, and decides what is put into Arqiflow and why. Arqiflow is its processor, and processes that data only to provide Arqiflow to the firm. Where the firm itself acts for a client, Arqiflow is its sub-processor and these same terms apply.

• Subject matter
  Providing Arqiflow, its agent and its integrations to the firm
• Duration
  While the firm has an account, and until its data is deleted afterwards
• Nature and purpose
  Storing, organising, displaying, searching and transmitting the firm's work; running each person's agent on it; sending the emails and notifications the firm's people receive
• People the data is about
  The firm's owners, staff and guests; its clients, consultants and contractors; and anyone else named in its work
• Kinds of personal data
  Names, contact details, roles, rates and costs, time records, time off, activity (only where the firm turns it on and the person agrees), chats with the agent, and whatever personal data appears in projects, files, emails and meetings
• Special categories
  None are required. The firm should not put them into Arqiflow unless it has a lawful basis to (a reason for time off, for example)

• Instructions. We process the data only on the firm's documented instructions, which are the Terms, this DPA and the firm's use of Arqiflow. We tell the firm if we think an instruction breaks data protection law.
• Confidentiality. Everyone at Arqiflow who can reach the data is bound to keep it confidential, and reaches it only when the work needs it.
• Security. We keep technical and organisational measures in place to protect the data, set out on the Security page: access checked on every request, each firm kept to its own data, the database and files reached only through our server, encrypted connections, and a record of who did what.
• Help with requests. We help the firm answer requests from people exercising their rights, and with data protection impact assessments and consultations with authorities where they concern Arqiflow.
• Breaches. We tell the firm without undue delay, and within 48 hours of becoming aware, of a personal data breach that affects its data, with what we know and what we are doing about it.
• Deletion. When the agreement ends, the firm can download its data while its account is read-only. On the firm's request we delete its data within 30 days, unless the law requires us to keep it, and confirm when it is done.
• Information and audits. We give the firm the information it reasonably needs to show compliance with Article 28. Where that is not enough, the firm may audit, once a year, with 30 days' notice, at its own cost, in a way that protects other firms' data.

The firm authorises Arqiflow to use the sub-processors on our Sub-processors page. Each is bound by a written agreement that protects the data at least as well as this DPA, and we answer to the firm for them.

We tell firms by email at least 30 days before a new sub-processor starts processing their data. A firm may object on reasonable data protection grounds within that time. If we cannot meet the objection, the firm may end the affected part of its plan and is refunded what it paid for the time left.

Services the firm connects itself (its Google, Microsoft or Dropbox account, Arqina, its webhooks) are not our sub-processors: data goes to them on the firm's instruction, under the firm's own agreement with them.

Where personal data is transferred outside the EU or the UK, to a country without an adequacy decision, the European Commission's Standard Contractual Clauses apply (Module 2, or Module 3 where Arqiflow is a sub-processor), together with the UK Addendum for UK data. They are incorporated in this DPA by reference.

• The firm has a lawful basis for the personal data it puts into Arqiflow, and gives its people and others the notices the law requires.
• If the firm turns Activity on, it is responsible for doing so lawfully where its people work, including telling them and, where the law requires it, consulting them.
• The firm's instructions to Arqiflow comply with data protection law.

Where they differ, the Standard Contractual Clauses come first, then this DPA, then the Terms of Service.

To get a copy of this DPA signed by Arqiflow, write to [email protected] with the firm's legal name, address and the person who signs for it. We send the full text, with its annexes completed for the firm, to sign electronically.