This data processing agreement ("DPA") forms part of the agreement between Deo Gratias Labs Ltd (formerly GetHireIn Ltd), registered in England and Wales with company number 17285901, which provides Newenz ("we", "the processor"), and the company that uses Newenz ("the customer", "the controller"). It applies when we process personal data on the customer's behalf in providing Newenz. To have a copy signed by both parties, write to [email protected].
1. Roles and scope
- The customer is the controller of the personal data it loads into or connects to Newenz, and we are its processor.
- This DPA covers that processing only. It does not cover the information we handle as a controller for our own business, which our privacy statement at newenz.com/privacy describes.
- The words used here have the meanings given in UK data protection law: the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to the customer, references to UK law include it.
2. What is processed
- Purpose: to provide Newenz: tracking renewals, contract terms, customer health, forecasts and the related workflows, as the customer configures it.
- Personal data: names, work email addresses, job titles and phone numbers of the customer's staff and of its customers' contacts; activity records such as emails, meetings, calls, notes and meeting transcripts that the customer chooses to load or connect; and sign-in and usage records of the customer's users.
- Data subjects: the customer's staff and users, and the staff and contacts of the customer's customers.
- Special categories: none are needed for Newenz. The customer agrees not to load them on purpose.
- Duration: for as long as the customer uses Newenz, and then until the data is deleted under section 9.
3. Our obligations
- We process the personal data only on the customer's documented instructions, which are this DPA, the agreement, and the customer's use and settings of Newenz. If we believe an instruction breaks data protection law, we will tell the customer.
- We ensure everyone authorised to process the data is bound by confidentiality.
- We take the technical and organisational measures in section 5.
- We help the customer, as far as we reasonably can, to respond to requests from data subjects, to keep the data secure, to deal with breaches, and with data protection impact assessments and consultations with the regulator.
4. Sub-processors
- The customer authorises the following sub-processors: Supabase (database, sign-in and server functions, hosted in London), Cloudflare (delivery of the website and app), and our email delivery provider (service emails).
- Systems the customer chooses to connect (for example Salesforce, HubSpot, Microsoft, Slack, a call recorder or the customer's AI provider) are the customer's own services under its own agreements with them, not our sub-processors.
- We will tell the customer at least 30 days before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds. If we cannot resolve the objection, the customer may end the affected service.
- We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for them.
5. Security
We keep in place measures appropriate to the risk, including:
- data held in the United Kingdom, encrypted in transit and at rest;
- each customer's data kept apart by row-level security in the database;
- access by role, two-step login and single sign-on;
- connection tokens and keys held in an encrypted vault and never sent to a browser;
- an audit trail of important actions;
- testing before each release, and independent security review.
The measures are described further at newenz.com/security. We may improve them over time, but will not lower the overall level of protection.
6. Personal data breaches
- We will tell the customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the customer's personal data.
- We will give the customer the information it reasonably needs to meet its own obligations, and take reasonable steps to contain and remedy the breach.
7. International transfers
Personal data is held in the United Kingdom. Where a sub-processor processes it outside the UK, we make sure the transfer is protected by an adequacy regulation or by appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.
8. Audits
- We will make available the information reasonably needed to show we meet this DPA, including answering security questionnaires.
- Where that is not enough, the customer may audit our compliance, at its own cost, no more than once a year, on 30 days' notice, during working hours and subject to confidentiality.
9. Deletion and return
- When the customer stops using Newenz, it can export its data. We delete the customer's personal data within 90 days, unless the law requires us to keep it.
- Backups are overwritten in the normal course of our hosting provider's backup cycle.
10. General
- If this DPA and the agreement conflict about personal data, this DPA applies.
- Each party's liability under this DPA is subject to the limits in the agreement.
- This DPA is governed by the law of England and Wales.