Data Processing Addendum

1. Roles

The Customer is the controller of personal data in Customer Data and decides why and how it is processed. EliteCinq is the processor and processes it only on the Customer’s documented instructions. The Terms, the Customer’s configuration of its Workspace and its use of the Service’s features are the Customer’s instructions. EliteCinq will tell the Customer if it believes an instruction breaks applicable data protection law.

2. Details of the processing

• Subject matter and purpose: providing the Service, including storing, displaying, calculating, printing and exporting records, securing the Service and providing support.
• Duration: the term of the Customer’s use of the Service, plus the deletion periods in section 8.
• Nature: hosting, storage, retrieval, organisation, transmission, display and deletion.
• Categories of data subjects: the Customer’s own customers and prospects, its staff and Authorised Users, and other people the Customer records.
• Types of personal data: names, phone numbers, email addresses, postal addresses, areas and governorates, notes, activity history, orders, invoices, payments and balances, and any other data the Customer enters.

3. The Customer’s obligations

The Customer is responsible for having a lawful basis for the processing, for giving the notices and obtaining the consents that the law requires, for the accuracy of Customer Data, and for not entering special categories of data unless the law allows it and it is appropriately protected.

4. Confidentiality

EliteCinq ensures that anyone it authorises to process personal data is bound by an appropriate duty of confidentiality and has access only as needed to provide the Service.

5. Security

EliteCinq implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include those in the Security overview: encryption in transit, isolation of each Workspace by database access rules, role-based permissions, access limited to what is needed, and the security programmes of our infrastructure providers. EliteCinq may update these measures as long as overall protection does not decrease.

6. Subprocessors

The Customer authorises EliteCinq to use the following subprocessors:

EliteCinq imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance. EliteCinq will update this list before a new subprocessor starts processing personal data. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may stop using the Service and delete its Workspace.

7. Assistance

Taking into account the nature of the processing, EliteCinq will reasonably help the Customer to respond to requests from data subjects, to carry out data protection impact assessments, and to meet its security and breach-notification obligations. The Service lets the Customer view, correct, export and delete records directly. If EliteCinq receives a request directly from a data subject about Customer Data, it will refer the person to the Customer where possible.

8. Breaches, deletion and return

Personal data breaches. EliteCinq will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a breach affecting Customer Data, with the information reasonably available to help the Customer meet its obligations.

Deletion and return. The Customer can export its customers at any time. When a Workspace is deleted, its records are removed from the active database straight away, and copies in encrypted backups are overwritten in the normal backup cycle, normally within 30 days, unless the law requires longer retention.

9. Information and audits

On reasonable written request, and no more than once a year unless a breach or a regulator requires otherwise, EliteCinq will provide the information necessary to show compliance with this DPA, which may include summaries of its measures and its providers’ certifications. Any audit must be carried out with reasonable notice, during business hours, without disrupting the Service and under confidentiality obligations.

10. International transfers

EliteCinq and its subprocessors may process personal data outside the Customer’s country. Where required, transfers rely on appropriate safeguards such as contractual clauses with subprocessors.

11. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

12. Contact