Data Processing Terms.

What these terms cover #

These terms are part of the Terms of Service. They apply when we process personal data on your behalf in the course of providing the products: client records, portal guests, team members, form submissions, CMS entries, files and the pages you publish ("customer personal data"). For that data, you are the controller and Stacklumen LLC is your processor. They are written to meet the processor requirements of the GDPR, the UK GDPR and US state privacy laws where those apply.

What we commit to #

• Instructions. We process customer personal data only to provide the products and on your documented instructions, which are these terms and how you configure and use the products, unless the law requires otherwise, in which case we tell you first where the law allows.
• Confidentiality. Everyone at Stacklumen with access to customer personal data is bound to keep it confidential, and has access only as their role requires.
• Security. We protect it with the technical and organisational measures that protect the platform: encryption in transit, tenant isolation, access controls, and least-privilege access for staff.
• Subprocessors. You authorise the subprocessors on the Subprocessors page. We bind each to data protection terms no less protective than these, and we update that page before adding one. You may object to a new subprocessor on reasonable data protection grounds by writing to us; if we cannot address it, you may cancel.
• Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting customer personal data, with the information we have, and we help you meet your own obligations.
• Assistance. We help you, as reasonably needed, to answer requests from data subjects and to meet your obligations on security, impact assessments and consultation with regulators. Most requests you can answer yourself in the products.
• Deletion. Data you delete is deleted from the products. When your account ends, we delete customer personal data as the Terms of Service and Privacy Policy describe, unless the law requires us to keep it.
• Information. We make available the information reasonably necessary to show we meet these terms, in writing and on request, no more than once a year unless a regulator requires it.

International transfers #

Customer personal data is stored and processed in the United States. Where the law requires a transfer mechanism for data leaving the EU, the EEA, the UK or Switzerland, we will enter into the European Commission's Standard Contractual Clauses (and the UK addendum) with you on request.

Your obligations #

You are responsible for the lawfulness of the customer personal data you put into the products and of your instructions: for having a lawful basis, for giving the notices and obtaining the consents the law requires, and for not putting special category data, card numbers or government identity numbers into the products unless they are built to hold them.

A signed copy #

If your organisation needs a countersigned data processing agreement, write to support@stacklumen.com. These terms apply whether or not one is signed, and the limits of liability in the Terms of Service apply to them.