Data processing addendum

This addendum forms part of the Terms for companies. The company is the controller (or a processor for its own clients) of the personal data it shares for an engagement, and Deftridge, Inc. or Deftridge Ltd, according to the order confirmation, is the processor. Where Deftridge uses data for its own purposes, such as managing a professional's account, it acts as an independent controller as described in the privacy notice.

Deftridge processes the personal data contained in the files, systems and briefs the company provides, only to carry out the engagement and only on the company's documented instructions. The data may include names, work contact details and business records of the company's staff and customers. The processing lasts for the engagement and ends with return or deletion of the data.

Deftridge maintains encryption in transit and at rest for data it stores, role-based access limited to people working on the engagement, access logging, confidentiality duties for staff and for professionals, and a process for removing access when an engagement ends. Professionals work under written confidentiality terms.

The company authorises the use of sub-processors for hosting, email delivery and payments, bound by terms no less protective than this addendum. Deftridge keeps the list of sub-processors available on request at [email protected] and tells the company at least 14 days before adding one, so that it can object.

Deftridge helps the company respond to requests from individuals about their data, and to carry out impact assessments where needed. We tell the company without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data.

Where personal data moves from the UK or the EEA to a country without an adequacy decision, the parties rely on the standard contractual clauses (and the UK addendum) in the form published by the competent authority, which are incorporated here. On written request, not more than once a year, Deftridge provides the information needed to show compliance with this addendum.

When the engagement ends, Deftridge returns or deletes the company's personal data within 30 days, unless the law requires it to keep a copy.

Write to [email protected].