This data processing agreement (“DPA”) forms part of the terms of service between Tidewater Data, Inc. (“Tidewater”, the processor) and the customer (the controller). Tidewater is a fictional company, and this DPA is written as a real company’s would be, for a demonstration site.
1. Subject matter and duration
Tidewater processes personal data on behalf of the customer to provide the service described in the terms of service. Processing lasts for as long as the customer has a workspace, and ends as described in section 10.
2. What is processed
Categories of data subjects: the customer’s employees and contractors who use Tidewater, and the people named in metadata the customer connects (for example, owners of tables).
Types of personal data: names, work e-mail addresses, roles, sign-in events, owner names and any personal data that appears in table names, column names or SQL text. Tidewater does not read the contents of customer tables unless the customer creates a custom SQL check.
3. Our instructions
Tidewater processes personal data only on the customer’s documented instructions, which are the terms of service, this DPA and the customer’s use of the product. If we believe an instruction breaks the law we will tell the customer.
4. Confidentiality
People who can access personal data are bound by confidentiality, receive security training and have access only to the extent their job requires it.
5. Security measures
Tidewater maintains the measures described on its trust page, including:
- encryption of data in transit with TLS 1.2 or later, and at rest with AES-256
- separate storage for each workspace, with access checks on every request
- single sign-on, role based access and an audit log for the customer’s administrators
- least privilege for employees, with access reviewed every quarter
- an independent penetration test every year, with a summary available on request
- backups encrypted and tested for restoration every quarter
6. Subprocessors
The customer agrees that Tidewater may use the subprocessors listed on the trust page. We will give 30 days’ notice before adding or replacing one, by e-mail to the customer’s administrators and by updating that page. The customer can object on reasonable data protection grounds within that period. If we cannot resolve the objection, the customer can end the affected service and receive a refund for the prepaid period that remains.
Tidewater is responsible for its subprocessors and imposes on them obligations no less protective than this DPA.
7. International transfers
Product data is stored in the region the customer selects. Where personal data is transferred outside the European Economic Area or the United Kingdom to a country without an adequacy decision, the parties rely on the standard contractual clauses, which are incorporated by reference, and on supplementary measures described on the trust page.
8. Assistance
Taking into account the nature of the processing, Tidewater will help the customer to respond to requests from data subjects, to carry out data protection impact assessments and to meet its security and breach notification duties. We will pass on any request we receive directly from a data subject, and we will not answer it ourselves unless the customer asks us to.
9. Personal data breaches
Tidewater will tell the customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the customer’s data. The notice will describe what happened, the data involved, what we have done and what we recommend the customer does.
10. Deletion and return
When the agreement ends, the customer can export its data for 30 days. After that, Tidewater deletes the customer’s workspace and its personal data from live systems within 30 days, and from backups within a further 60 days, unless the law requires us to keep it.
11. Audits
Tidewater will give the customer the information needed to show compliance with this DPA, including our latest penetration test summary and security questionnaire answers. Where that is not enough, the customer can audit Tidewater once a year with 30 days’ notice, during business hours, at the customer’s cost and under confidentiality.
12. Order of precedence
If this DPA and the terms of service conflict on personal data, this DPA applies. Questions about it go to privacy@saas.phoenixcodes.org, and customers who need a signed copy can request one through the contact form.