Data Processing Addendum

1.Roles

The Organization determines what personal information is put into the platform and why: it is the controller, and the business. Daviah handles that information only on the Organization's instructions: it is the processor, and the service provider.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not retain, use or disclose it for any purpose other than providing the platform to the Organization under the agreement.

2.What is processed

The people: the Organization's members, officers, candidates, guests, people who write to it through its website, and people who pay it.

The information: names, contact details, membership and office history, attendance, subscription and payment records, photographs, documents, meeting records, and whatever else the Organization chooses to record.

For as long as the agreement lasts, and for the periods in the Terms after it ends.

3.Our people, and the providers we use

Access is limited to those who need it to run the platform, and they are bound to keep it confidential.

We use other companies to provide parts of the service — hosting, file storage, email delivery, payment processing, and the optional features that generate text or artwork. Each is bound to protect the information and to use it only to provide its part of the service. We remain responsible to you for what they do with it.

We will tell you at least 30 days before a new provider begins handling your information, and if you reasonably object we will either find another way or let you end the agreement without penalty.

4.Security

Information is encrypted in transit and at rest. Access to production systems requires individual credentials and is limited to those who need it. Passwords are stored hashed, never in a form anybody can read. Each organization's records are separated from every other organization's, and that separation is enforced in the software and tested automatically.

We keep routine backups, and we restore from them when something goes wrong.

If we confirm a breach of security affecting your information, we will tell the Organization within 72 hours, with what we know and what we are doing.

5.People exercising their rights

Requests from members to see, correct, delete or take a copy of what is held about them belong to the Organization, because the roll is the Organization's. The platform gives you the means to answer them, and we will help where it does not.

If such a request comes to us directly, we will pass it to the Organization rather than act on it, unless the law requires otherwise.

6.Return and deletion

On request during the agreement, and for 30 days after it ends, we will provide an export of the Organization's information in a common, machine-readable format.

We delete it within 60 days of the end of the agreement, or sooner on request, with backup copies overwritten within 90 days.

7.Checking

On reasonable notice, and no more than once a year unless something has gone wrong, we will answer an Organization's questions about how its information is handled and provide what documentation we have.