Data processing agreement
When you keep your customers' details in EasyTradesPro, you decide what is kept and why: you are the controller of that information. We look after it for you and use it only to provide EasyTradesPro: we are your processor. UK data protection law (UK GDPR, Article 28) requires an agreement between us setting out how we do that. This is it.
1. What we process
| Whose information | Your customers and enquirers, your staff and the people you give access to, and anyone whose details appear in your emails and files. |
|---|---|
| What kind | Names, addresses, phone numbers, email addresses, details of jobs, quotations, invoices and payments, emails and their attachments, notes, and anything else you choose to keep. EasyTradesPro is not designed for special category information (such as health details), and you should not keep it there. |
| What we do with it | Store it, back it up, show it to you and the people you allow, send the emails you choose to send, and delete it when asked or when your account ends. |
| For how long | While you have an account, then as section 9 says. |
2. Only on your instructions
We process your information only to provide EasyTradesPro as you use it, and on your documented instructions (which these terms and your use of the portal are), unless the law requires otherwise; if it does, we will tell you first unless the law forbids that. We will tell you if we think an instruction of yours breaks data protection law.
3. Confidentiality
Only the people who run EasyTradesPro can reach your information, only where needed to provide or fix the service, and they are bound to keep it confidential. We will not look at your records except to fix a problem, when you ask us to, or where the law requires.
4. Security
We keep your information safe with measures that include:
- a separate database and separate database account for every business, which can reach nothing else;
- sign-in with a password and a registered device, attempts limited, and every sign-in and change recorded in your activity log;
- everything sent over encrypted connections; saved mailbox passwords and keys encrypted;
- a server in the UK that receives security updates every night, behind a firewall, administered only with cryptographic keys;
- encrypted backups every night, kept away from the server for 35 days, locked with a key that is not kept on the server.
5. Other processors we use
You agree that we may use these sub-processors, each bound by a written agreement giving your information the same protection:
- Krystal Hosting Ltd, UK: the server in London.
- Backblaze: encrypted backups in its EU (Amsterdam) data centre. Backblaze cannot read them. Where this is a transfer outside the UK, it is covered by the UK adequacy regulations for the EEA / the UK International Data Transfer Addendum.
If you connect your own mailbox, your emails stay with your own email provider, which you choose. We will tell you at least 30 days before adding or replacing a sub-processor, so you can object, or cancel if we cannot agree.
6. Helping you
We will help you, as far as we reasonably can, to answer people who use their data protection rights (for example by letting you find, correct, export or delete their details in your portal), to keep your information secure, and with any assessment or consultation with the Information Commissioner's Office about it.
7. If something goes wrong
If we become aware of a breach affecting your information, we will tell you without undue delay, and within 48 hours, with what we know, so you can meet your own 72-hour duty to report it where needed. We will keep you informed and take steps to limit the harm.
8. Checking up on us
We will give you the information you reasonably need to show that we meet this agreement, and answer your reasonable questions about how we protect your information.
9. When your account ends
Your portal stays read-only for 90 days so you can download what you need, and we will send you a complete copy on request. We then delete your information, and it leaves our backups within a further 35 days, unless the law requires us to keep it.
10. The rest
If this agreement and the rest of the terms disagree about your customers' information, this agreement wins. It is governed by the law of England and Wales.