Data processing agreement

What we process and why

Our obligations

We will:

• process personal data only on your documented instructions, which are these terms, your account configuration and any written instruction you give us, unless the law requires otherwise, in which case we will tell you first where we can;
• ensure the people who process the data are bound by confidentiality;
• apply the security measures in the Security section;
• engage sub-processors only as the Sub-processors section allows;
• help you respond to data subject requests and, taking into account the nature of the processing, help you meet your obligations on security, breach notification and impact assessments;
• delete or return the data when the service ends as described below;
• make available the information needed to show we meet these obligations and allow audits as described below;
• tell you promptly if we believe an instruction of yours breaks data protection law.

Your obligations

You are responsible for the lawfulness of the processing, including having a lawful basis to receive and act on handoffs, giving customers the privacy information they are entitled to, and responding to their requests. You will give us only lawful instructions.

Sub-processors

You authorise us to use the sub-processors listed at https://usherup.com/subprocessors. We will give you at least 30 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account without penalty. We impose data protection obligations on each sub-processor that are no less protective than these, and we remain responsible for their performance.

Security measures

• Encryption in transit (TLS 1.2 or higher) for all traffic, including to sub-processors.
• Encryption at rest for stored handoffs.
• Access to production limited to named personnel, protected by two factor authentication, reviewed when roles change.
• Signed webhook deliveries so receivers can verify origin and integrity.
• Automatic deletion of handoffs after 90 days; deletion on request sooner.
• Logging of access to administrative functions.
• Dependence on Cloudflare's certified infrastructure (SOC 2 Type II, ISO 27001) for hosting and storage.

Data subject requests

If a data subject contacts us directly about data we process for you, we will not respond on your behalf except to acknowledge receipt and point them to you. We will forward the request to you within 5 business days. On your instruction we will delete, correct or export the relevant handoffs within 10 business days.

Personal data breaches

If we become aware of a breach affecting your data we will notify you without undue delay and no later than 72 hours after becoming aware, with what we know at the time: the nature of the breach, the data and people affected as far as known, likely consequences, and the steps taken. We will update you as we learn more and cooperate with your own notifications.

Audits

Once a year, or after a breach, you may ask us written questions about our compliance with this agreement and we will answer within 30 days. If a regulator requires more, or written answers are genuinely insufficient, you may conduct an audit of the relevant systems at reasonable notice, during business hours, no more than once a year, at your cost, subject to confidentiality.

International transfers

We process data in the United States. Where you are established in the EEA, the parties enter into the Standard Contractual Clauses adopted by European Commission Decision 2021/914, Module Two (controller to processor), with you as data exporter and Aliso LLC as data importer, the optional docking clause included, Clause 9 option 2 with the notice period above, Clause 13 with the supervisory authority of your establishment, Irish law and courts for Clauses 17 and 18, and the annexes completed by this agreement and the sub-processors page. Where you are established in the United Kingdom, the UK International Data Transfer Addendum to those clauses applies. Where you are established in Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection.

California

Where the California Consumer Privacy Act applies, we are a service provider. We will not sell or share personal information, retain, use or disclose it for any purpose other than the business purpose of providing the service, use it outside the direct business relationship with you, or combine it with personal information from other sources except as the law permits. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorised use.

Deletion and return

When your account closes we will delete all handoffs and account data within 30 days, unless the law requires us to keep some of it. Before closing you may export your handoffs through the service. Backups are overwritten on their own schedule within a further 30 days.

General

If this agreement conflicts with the terms of service, this agreement prevails for data protection matters. Liability under this agreement is subject to the limitation in the terms of service. If any part is held invalid the rest continues to apply.