Data Processing Agreement

These are the terms required by Article 28 of the UK GDPR, in short and plain English.

1. Roles

• The Organisation is the controller of the personal data it puts into the Service. We are its processor.
• What: parents', children's, members' and donors' names, contact details, children's classes and fees, charges, payments, pledges, notes and files, and anything else the Organisation enters or imports.
• Why: only to provide the Service: keeping the Organisation's billing records, making statements and reports, backups and support.
• How long: for as long as the Organisation uses the Service, and then as in section 8.

2. We act only on the Organisation's instructions

We process the data only to provide the Service and on the Organisation's documented instructions (these terms, and what its users do in the Service). If we think an instruction breaks data protection law, we will tell the Organisation. If the law ever requires us to process the data in another way, we will tell the Organisation first unless the law forbids it.

3. Confidentiality

Only people who need it to run or support the Service can reach the data, and they are bound to keep it confidential. The platform admin cannot see the Organisation's client data unless the Organisation gives access under Settings › Privacy. That access is logged and can be taken back at any time.

4. Security

We keep appropriate technical and organisational measures in place, including:

• encryption in transit (HTTPS) and at rest (by our hosting provider);
• passwords stored only as salted hashes;
• each organisation's data kept separate, with logins and permissions controlled by the Organisation;
• a change log of edits, deletions and imports;
• a full backup every day and before every update.

5. Sub-processors

The Organisation agrees that we may use these sub-processors:

• Cloudflare, Inc.: hosting, database (stored in Western Europe), backups and email forwarding.
• Stripe: card payments, only if the Organisation switches them on.

Our rules for sub-processors:

• Each one is bound by a written agreement with data protection terms at least as protective as these.
• We will tell the Organisation before adding or replacing a sub-processor, so it can object. If it objects on reasonable grounds and we cannot solve it, the Organisation may stop using the Service.
• Where data is processed outside the UK, we make sure a lawful transfer mechanism is in place (UK adequacy regulations, or the UK International Data Transfer Agreement or Addendum).

6. Helping the Organisation

• Requests from parents or members (to see, correct or delete their data) are handled by the Organisation. Most can be done directly in the Service. If a request comes to us, we will pass it to the Organisation without delay and help it respond.
• We will give reasonable help with the Organisation's security duties, data protection impact assessments and contact with the Information Commissioner's Office, as far as they relate to the Service.

7. Breaches

If we become aware of a personal data breach affecting the Organisation's data, we will tell the Organisation without undue delay (we aim for within 48 hours), with what we know, the likely effect and what we are doing about it, and keep it updated. This lets the Organisation report to the ICO within 72 hours where it needs to.

8. When the Organisation leaves

• At the Organisation's choice we will return its data (a full export) and/or delete it.
• We delete the data from the live system within 30 days of the account closing. Copies in backups are deleted automatically as the backups expire (daily backups after 30 days, monthly after 12 months), unless the law requires us to keep them.

9. Showing that we comply

We will give the Organisation the information it reasonably needs to show that these obligations are met, and answer reasonable questions about how the data is protected.

10. Contact

Email admin@billingformosdos.com or write to [postal address to be added].