Data processing agreement

1. Parties and scope

This agreement is between the owner of a Kithwork workspace (the "customer", the controller) and the operator of Kithwork (the "processor"). It forms part of the terms of service and applies automatically to every workspace, with no separate signature. It covers the personal data in workspace content that we process for the customer, and is intended to meet Article 28(3) of the UK GDPR. If it conflicts with the terms, this agreement wins for personal data.

2. Details of the processing

• Subject matter and purpose: providing Kithwork, a client portal, to the customer: storing, displaying and sending notifications about the customer's workspace content.
• Duration: for as long as the workspace exists, then until deletion as described in section 9.
• Nature of processing: collection, storage, organisation, retrieval, display, transmission by email and deletion.
• Data subjects: the customer's team members, its clients and their staff, and anyone else whose details the customer adds.
• Personal data: names, email addresses and job details; the content of messages, comments, feedback, approvals and files; activity records of who did what and when.
• Special category data: none intended. The customer must not upload it unless it has a lawful basis and appropriate safeguards.

3. Our obligations

We will:

1. process the personal data only on the customer's documented instructions, which are these terms and the customer's use of Kithwork's features, unless the law requires otherwise (in which case we'll tell the customer first unless the law forbids it). We will tell the customer if we think an instruction breaks data protection law;
2. make sure everyone authorised to process the data is bound by confidentiality;
3. take the security measures in section 4 (Article 32);
4. only use sub-processors under section 5;
5. help the customer respond to people exercising their rights (section 6);
6. help the customer meet its duties on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to us;
7. delete or return the data at the end of the service (section 9);
8. make available the information needed to show we comply with Article 28, and allow for and contribute to audits (section 8).

4. Security measures

• Encryption in transit (HTTPS/TLS) and at rest by our providers.
• Strict separation between workspaces: every request is checked on the server for the person's identity, workspace membership and permission for the specific record. Clients only see projects shared with them.
• Files are private by default and only reachable through short-lived signed links issued after an access check.
• Passwords are hashed; two-step verification is available to all users and required for our staff.
• Staff access is role-based and least-privilege. Every staff action is recorded in an append-only audit log. Erasing data and changing staff access need a second staff member's approval.
• Rate limiting of sign-in and sensitive actions; error monitoring configured not to collect personal data.
• A written incident response process, staff policies that each staff member acknowledges, and a joiner, mover and leaver process for staff access.

5. Sub-processors

The customer gives general authorisation for us to use the sub-processors listed on our sub-processors page. We impose data protection terms on each that are at least as protective as this agreement, and remain liable for their performance. We'll give at least 30 days' notice by email before adding or replacing one; the customer may object on reasonable data protection grounds, and if we can't resolve the objection the customer may end the affected service and receive a refund of prepaid fees for the period after it ends.

6. Data subject requests

If someone asks us directly to exercise their rights over workspace content, we'll pass the request to the customer without undue delay and won't respond ourselves except to direct them to the customer, unless the law requires otherwise. The customer can access, correct, export and delete workspace content using Kithwork's own features; where it can't, we'll help.

7. Personal data breaches

We'll notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its workspace content. We'll tell the customer what we know about the nature of the breach, the categories and approximate number of people and records affected, the likely consequences and the measures taken or proposed, and update it as we learn more, so the customer can meet its own 72-hour duty to the ICO.

8. Audits

On reasonable request, we'll provide written answers and documentation to show compliance with this agreement. If that isn't enough to satisfy the customer or a regulator, the customer may carry out (or have an independent auditor bound by confidentiality carry out) an audit, with at least 30 days' notice, during business hours, no more than once a year unless required by a regulator or following a breach, and at the customer's cost.

9. Deletion at the end

While the workspace exists, the customer can export its data. When the owner deletes the workspace or their account, we delete the workspace content from our live systems straight away, and copies in our providers' backups are removed as those backups expire, unless the law requires us to keep it.

10. International transfers

We will only transfer personal data outside the UK with an appropriate safeguard under Chapter V of the UK GDPR, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

11. Liability and law

Each party's liability under this agreement is subject to the limits in the terms of service, except where the law doesn't allow it to be limited. This agreement is governed by the law of England and Wales. Questions about it, or requests under it, go to the contact address shown in the app.