Data Processing Agreement

1. Roles and scope

The Customer decides why and how personal data in its workspace is processed and acts as controller (or “business” under US state privacy laws). Erynd processes that data only to provide the service and acts as processor (or “service provider”). Terms not defined here have the meaning given in the Terms of Service or in applicable data protection law.

2. Details of the processing

• Subject matter: hosting and operating the Erynd workspace.
• Duration: the subscription term, plus the deletion period set out in section 9.
• Nature and purpose: storage, display, organization and retrieval of stock records, and the support of the Customer’s users.
• Data subjects: the Customer’s users and any people the Customer records in the workspace, such as staff or supplier contacts.
• Categories of data: names, work email addresses, roles, sign-in records and activity records (counts, approvals, movements). Erynd is not designed for sensitive categories of data, and the Customer agrees not to enter them.

3. Instructions

Erynd processes personal data only on the Customer’s documented instructions, which are the Terms, the Order, this DPA and the Customer’s use of the service’s settings. Erynd will tell the Customer if it believes an instruction breaks the law. Erynd will not sell the personal data, or retain, use or disclose it outside the direct business relationship with the Customer.

4. Confidentiality

Erynd ensures that people authorized to process personal data are bound by confidentiality obligations and access it only as needed for their role.

5. Security

Erynd maintains technical and organizational measures appropriate to the risk, including:

• encrypted connections (HTTPS) between users and the service;
• personal sign-in for every user and role-based permissions within the workspace;
• restricted internal access, granted on a need-to-know basis;
• hosting with a professional hosting provider bound by its own security obligations;

6. Sub-processors

The Customer authorizes Erynd to use sub-processors, such as its hosting and email service providers. Erynd imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance. A current list is available on request at contact@eryndllc.com. Erynd will notify the Customer of a new sub-processor in advance, and the Customer may object on reasonable grounds; if no solution is found, the Customer may end the affected part of the service.

7. Assistance

Taking into account the nature of the processing, Erynd will help the Customer respond to requests from data subjects and meet its obligations regarding security, breach notification and data protection assessments.

8. Personal data breaches

Erynd will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to help the Customer meet its own obligations, and will take reasonable steps to contain it.

9. Return and deletion

At the end of the subscription, the Customer may request a copy of its Customer Data within thirty days. After that period, Erynd deletes Customer Data from the active service, and from backups as they are routinely overwritten, unless the law requires it to be kept.

10. Information and audits

Erynd will make available the information reasonably necessary to show compliance with this DPA, and will answer reasonable written questions from the Customer, no more than once a year unless required by a regulator or following a breach.

11. International transfers

Personal data is processed in the United States. Where the law requires a transfer mechanism, the parties will rely on an appropriate one, such as standard contractual clauses.

12. Liability and precedence

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.