Data Processing Agreement
How we look after your organisation's data on its behalf.
Between the organisation that has accepted UiNform's Terms of Service (the Organisation), and UiNform, registered in the Netherlands with the Chamber of Commerce (KvK) under number 95512144 (UiNform).
This agreement forms part of the Terms of Service. It applies whenever UiNform handles personal data on the Organisation's behalf.
1. Who is who
The Organisation decides what personal data goes into UiNform and why. It is the controller. UiNform handles that data only to provide the service, on the Organisation's instructions. It is the processor.
2. What data, and why
| Purpose | Writing, storing, editing, reviewing and exporting the Organisation's project documents and reports |
|---|---|
| Kinds of data | Whatever the Organisation enters or uploads: project information, names and contact details of staff and partners, figures about the people a project serves (usually counted, not named), photographs and case stories, and the documents written from them |
| Whose data | The Organisation's staff and partners, and the people its projects serve |
| Sensitive data | The Organisation decides whether to include any. UiNform does not ask for it. Where a report includes a case story or a photograph of a person, the Organisation is responsible for having that person's consent |
| How long | For as long as the Organisation uses UiNform, and until erased as set out in section 9 |
3. Only on the Organisation's instructions
UiNform handles the Organisation's data only to provide UiNform as described in the Terms, and as the Organisation directs through its use of the app. UiNform never uses it for anything else. In particular, UiNform never uses it to train any AI model, never sells it, and never uses one organisation's data in another organisation's documents.
If UiNform believes an instruction breaks data protection law, it will say so.
4. People who can see it
Only people who need to, and who are bound to keep it confidential.
UiNform's team may look at the Organisation's workspace to support it, to fix something, or to understand how UiNform feels to use and what could be designed or organised better. When they do, the view is read-only (nothing can be changed, generated or deleted), it ends by itself after one hour at most, and it is recorded in UiNform's security record, which the Organisation may ask to see.
5. Security
UiNform protects the Organisation's data with measures that include:
- encryption whenever data travels and wherever it is stored;
- each organisation reaching only its own data, checked on every request;
- a security record of who opened which document, when, kept for one year;
- error reports stripped of the Organisation's writing before they leave the app;
- encrypted nightly backups, restored and checked every week;
- two-step sign-in on every account that can change UiNform's systems.
6. Helping the Organisation
UiNform will help the Organisation answer people who ask to see, correct, delete or take their data, as far as the app allows. Much of it the Organisation can do itself: edit any document, download everything, delete a login, delete the organisation. If a request about the Organisation's data reaches UiNform directly, UiNform will pass it to the Organisation rather than answer it alone.
UiNform will also help with security, breach notification and data protection impact assessments, where the Organisation needs information only UiNform has.
7. Other companies UiNform uses
The Organisation authorises UiNform to use the companies listed on UiNform's Sub-processors page (the sub-processors), as that page stands when this agreement is accepted and as it changes under this section. UiNform binds each one by a written agreement giving at least the protection in this agreement, and remains responsible to the Organisation for them.
Before adding or replacing a sub-processor, UiNform will tell the Organisation at least 30 days in advance, by email to the Organisation's owners and on the Sub-processors page. The Organisation may object on reasonable data protection grounds. If it does and UiNform cannot address the objection, the Organisation may stop using UiNform and is refunded for any time it has already paid for and cannot use.
8. Data outside the European Union
UiNform stores the Organisation's data in the European Union. Where a sub-processor works with it outside the EU, as the Sub-processors page says, the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.
9. If something goes wrong
If UiNform becomes aware of a breach affecting the Organisation's data, it will tell the Organisation without undue delay, and in any case within 48 hours, with what it knows: what happened, which data, how many people, what UiNform is doing, and who to talk to. It will keep the Organisation informed as it learns more, so that the Organisation can meet its own 72-hour duty to the authorities.
10. At the end
When the Organisation deletes its organisation in UiNform, everything is hidden at once and erased for good 30 days later: its sign-in organisation, every file and every record. Until then an owner can restore it, or download everything. Copies in UiNform's backups are overwritten within a further 30 days.
Only two records outlive the erasure, and neither holds the Organisation's work: UiNform's own cost record (how much writing the documents took), and the security record of who opened what, kept for its one year. Both carry only an internal number for the Organisation, never its name or its content.
11. Showing that UiNform keeps its word
UiNform will give the Organisation the information it reasonably needs to show that this agreement is kept, and will answer reasonable questions in writing. If the law or a supervisory authority requires an audit, UiNform will allow one, with reasonable notice, at the Organisation's cost, and in a way that protects other organisations' data.
12. Which law
This agreement follows the law and the court of the Terms of Service: the law of the Netherlands, and the District Court of Rotterdam (rechtbank Rotterdam). Responsibility under this agreement is part of the limit in section 12 of the Terms of Service.