Data Processing Agreement

1. Parties and scope

This agreement is between Synthaveil Ltd ("Synthaveil", "we", "us") and the customer that uses the Synthaveil service ("you"). It forms part of the terms under which you use the service and applies whenever we process personal data on your behalf.

You are the controller of that personal data and we are your processor, as those terms are defined in the UK GDPR and, where it applies, the EU GDPR.

2. The processing

Subject matter	Replacing identifying details in your data with stand-ins, and restoring them where the service supports it
Duration	For as long as you use the service, and until the data is deleted or returned under section 9
Nature and purpose	Detecting personal data in content you send to the service and replacing it, on your instructions
Types of personal data	Whatever personal data you choose to send, typically names, contact details, identifiers and free text about people
Categories of individuals	The people your data relates to, such as your customers, staff and contacts

3. Our obligations

We will:

• process the personal data only on your documented instructions, including with regard to transfers outside the UK, unless the law requires otherwise. In that case we will tell you first, unless the law forbids us;
• tell you promptly if we consider an instruction to be unlawful;
• make sure everyone we authorise to process the data is bound by a duty of confidentiality;
• take the technical and organisational measures required by Article 32 of the UK GDPR to keep the data secure;
• not use the data for any purpose of our own. We do not use it to train, tune or improve any model, and we do not build datasets from it;
• help you, taking into account the nature of the processing, to meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a regulator;
• make available the information needed to show that we meet this agreement, and allow for and contribute to audits and inspections by you, or an auditor you appoint, on reasonable notice, at reasonable intervals and subject to confidentiality.

4. Your obligations

You are responsible for:

• having a lawful basis for the personal data you send us, and giving the people it relates to the information the law requires;
• where you use features that may involve special category data, having a lawful condition for processing it;
• keeping the contact details on your account up to date, so that we can reach you, including about a breach.

5. Sub-processors

You give us general authorisation to use sub-processors. We give you the current list, with what each one does and where it processes your data, before you start using the service and at any time on request to policies@synthaveil.com. Each is bound by a written contract that imposes data protection obligations equivalent to those in this agreement. We remain responsible to you for their performance.

We will notify you at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may end the affected part of the service.

6. International transfers

We will not transfer your personal data outside the UK except in line with UK data protection law, using UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

7. Support access to your data

Our support staff can access data inside your account only when all of the following apply:

• you have asked for help, or the access is needed to meet a legal obligation;
• the reason for the access is recorded before it happens;
• access uses short-lived credentials limited to what the task needs. No member of staff has standing access to customer data;
• every access is recorded in an audit log.

Support access is limited to Synthaveil staff.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any case within 48 hours. The notice will describe what happened, the categories and approximate numbers of people and records affected, the likely consequences, what we have done about it, and who to contact. If we do not have all of this at once, we will send what we have and follow up as we learn more.

We will not notify a regulator or the people affected about your data without your agreement, unless the law requires us to.

We handle every incident under our written incident response plan and keep a record of each one.

9. At the end of the service

When you stop using the service, we will delete or return your personal data, at your choice, and delete existing copies unless the law requires us to keep them.

10. Requests from individuals

If you are a customer: we will help you respond to requests from individuals exercising their data protection rights, taking into account the nature of the processing. If an individual contacts us directly about data we process for you, we will pass the request to you and will not respond to it ourselves unless you instruct us to.

Complaints. The same applies to a data protection complaint about data we process for you: we will pass it to you within five working days of receiving it, and give you the information you reasonably need to acknowledge, investigate and answer it. You remain responsible for responding to the complainant.

If you are an individual: if your personal data reached us through one of our customers, that customer decides what happens to it. Please contact them first. If you cannot identify them, email policies@synthaveil.com and we will pass your request on. For personal data we hold about you ourselves, such as your waitlist details, see the Privacy Notice or use the data request page.

11. Contact

Questions about this agreement: policies@synthaveil.com.