Data Processing Agreement

1. Parties and roles

The customer is the controller of the personal data it places in ReadyGDPR. ReadyGDPR (Muverity Consultancy Services LLC) is the processor and processes that data on the customer's behalf.

For the customer's own personal data as a ReadyGDPR user — for example the account details of the individuals who sign in — ReadyGDPR is the controller, and its Privacy Policy applies.

2. Subject matter and duration

The subject matter is the processing of personal data carried out by ReadyGDPR in providing the service to the customer. Processing lasts for the term of the subscription.

3. Nature and purpose of processing

Processing is carried out for the purpose of providing compliance record-keeping, data subject request handling, document generation and the Virtual DPO.

4. Categories of data subjects

• the customer's own staff who use the product
• the data subjects who submit requests through the customer's public data subject request portal

5. Categories of personal data

Names, email addresses, and whatever the customer chooses to record in its own compliance records and data subject request responses.

ReadyGDPR does not require special-category data, and asks customers not to place it in free-text fields.

6. Processor obligations

• process personal data only on the customer's documented instructions
• keep personnel with access to personal data under a duty of confidentiality
• implement appropriate technical and organisational measures
• assist the customer with data subject rights and with breach notification
• delete or return the customer's personal data at the end of the term

7. Sub-processors

The current list of sub-processors is published at /sub-processors. The customer gives general authorisation for the use of these sub-processors. ReadyGDPR will give notice before adding or replacing a sub-processor, and the customer may object to the change.

The transfer mechanism will be stated here once the sub-processor locations are confirmed. We do not assert any mechanism until then.

9. Security measures

• encryption in transit
• authentication and role-based access control
• tenant isolation enforced in the database
• audit logging of significant actions
• single-use expiring links for data subject downloads

ReadyGDPR will respond to reasonable requests for information needed to demonstrate compliance with this agreement. On-site audit rights are to be confirmed.

ReadyGDPR will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. The specific hour commitment is to be confirmed.

This is a commercial term and has not yet been set.

The governing law and venue are to be confirmed.