Data processing addendum

This addendum forms part of the terms between your organisation and the business that provides SLETOR (details to be published). It applies where SLETOR processes personal data on your behalf, for example the names and emails of team members you add or notes you write about contacts. For your own account data, SLETOR is the controller and the privacy notice applies.

1. Roles

You are the controller and SLETOR is the processor for personal data you put into the service for your own purposes.

2. Instructions

We process that data only to provide SLETOR to you and on your documented instructions, which are these terms and your use of the service.

3. Confidentiality and security

Only staff who need it can access the data, under confidentiality. We encrypt data in transit and at rest, use least-privilege access, keep an audit log and test restores from backup monthly.

4. Sub-processors

You authorise the sub-processors on the sub-processors page. We give 30 days' notice of a new one, and you may object.

5. Help with your duties

We help you answer requests from people about their data, and with security, breach notification and impact assessments, as far as our role allows.

6. Breaches

We tell you without undue delay, and within 48 hours where we can, after becoming aware of a personal data breach affecting your data.

7. End of service

When you delete your organisation, we erase the data after a 14 day grace period, except records the law requires us to keep.

8. Transfers

We host in the EU. Transfers to US sub-processors rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.

9. Audits

We give you the information you reasonably need to show compliance, on request, once a year.