Data processing agreement

This agreement forms part of the terms of service between CaptiFi Connect Ltd ("we", the processor) and the business that holds a CaptiFi Connect account ("you", the controller). It covers the personal data we process for you when you use the service, and it meets the requirements of Article 28 of the UK GDPR.

1. What this agreement covers

It applies to personal data you upload to, send through or receive in CaptiFi Connect: your contacts, your lists, the texts you send and receive, delivery records and opt-out records. Personal data about you and the people who use your account (names, email addresses, sign-in records) is ours as controller and is covered by our privacy notice instead.

2. Details of the processing

• Subject matter: providing the CaptiFi Connect texting service to you.
• Duration: for as long as you have an account, then until the data is deleted under section 10.
• Nature and purpose: storing contacts and lists, sending texts to them, receiving replies, recording delivery statuses and opt-outs, and keeping the service secure and working.
• Types of personal data: phone numbers, names, email addresses, notes and custom fields you add, the content of texts, delivery statuses and times, and opt-out records.
• Data subjects: the people whose details you hold as contacts or who text your numbers.
• Special category data: the service isn't designed for it, and you agree not to put it in texts or contact records unless you have a lawful basis and it is needed.

3. Your instructions

We process the data only on your documented instructions. Your use of the dashboard and the API, and these terms, are those instructions. If the law requires us to process it in any other way, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.

You are responsible for having a lawful basis for the data you give us and the texts you send, including consent or the soft opt-in for marketing texts under PECR.

4. Our people

Everyone at CaptiFi Connect who can access your data is bound to keep it confidential, and only accesses it when they need to, for example to deliver a text, fix a fault or answer a support request.

5. Security

We keep appropriate technical and organisational measures in place to protect the data. Today they include:

• encryption in transit (HTTPS) for the website, the dashboard, the API and our webhooks;
• passwords stored only as scrypt hashes, and session tokens, API keys and gateway tokens stored only as SHA-256 hashes;
• webhook signing secrets encrypted at rest with AES-256-GCM;
• every account's data kept separate, so one account's ids read as not found from any other account;
• an audit record of staff actions on customer accounts;
• full phone numbers kept out of our application logs;
• nightly database backups, kept for 14 days; and
• [encryption at rest of the database and backup storage, and access controls on the server, to be confirmed]

6. Sub-processors

You give us general authorisation to use sub-processors. The current list is on our sub-processors page. We'll tell you at least [30] days before adding or replacing one, and you can object on reasonable data protection grounds. If we can't resolve the objection, you can close your account and we'll refund any unused credit [confirm refund position].

Each sub-processor is bound by a written contract with data protection terms at least as protective as these. We remain responsible to you for their work.

7. Transfers outside the UK

We won't transfer the data outside the UK unless the destination has UK adequacy regulations or the transfer is covered by an appropriate safeguard, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. [Confirm hosting location and the safeguard used for each sub-processor outside the UK]

8. Helping you with people's rights

If someone asks us to exercise their data protection rights over data we hold for you, we'll pass the request to you and won't answer it ourselves unless you ask us to. The dashboard and API let you find, export, correct and delete contacts and messages yourself; if you need more help, we'll give it where we reasonably can.

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, and in any case within [48] hours. We'll give you the information you need to assess it and, where required, report it to the ICO and tell the people affected. We'll also help with data protection impact assessments and consultations with the ICO where they relate to the service.

10. When your account closes

When your account closes, we'll delete the data we hold for you within [30] days, unless the law requires us to keep some of it. Before then, you can export your contacts and message history from the dashboard. Copies in backups are deleted as the backups expire.

11. Information and audits

We'll make available the information you reasonably need to show that this agreement is being met, and allow for audits by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach or a regulator requires it. [Audit costs and confidentiality terms]

12. General

Liability under this agreement is subject to the limits in the terms of service. If this agreement and the terms conflict on data protection, this agreement wins. It is governed by the law of England and Wales.

Questions: hello@captificonnect.co.uk.