Data processing addendum

Before we handle client data, the project agreement must record the service, the purpose and duration of the work, and what we will do with the data. It must also identify the types of personal data and the people the data concerns.

The agreement must list any sensitive personal data, security measures, approved service providers, locations, and return or deletion instructions that the project needs. We will use those details to guide the work.

The project agreement states whether the client controls the data directly or handles it for another organization. Xlinfe handles the data only to deliver the agreed work and on the client's documented instructions. Those instructions include the project agreement and later written directions.

The client must have the right to share the data and direct our work. If we think an instruction conflicts with data protection law, we will tell the client unless the law prevents us from doing so.

We limit access to client data to people who need it for the project. Those people must keep it confidential. We use security measures suited to the data and the risks of the work. The project agreement records any measures the client requires.

If we learn of a personal data breach involving client data, we will tell the client without undue delay. We will share the details we have and help the client respond as required by applicable law.

We may use another service to help with project work only with the client's prior written approval. The project agreement can give approval for named services or for a defined type of service.

If we plan to change an approved service, we will tell the client in time for it to object. We will require the service to protect client data under terms that meet this DPA's requirements. We remain responsible to the client for that service's work.

We will help the client answer requests from people about their data. We will also help with security reviews, breach notices, and data protection assessments when the law requires it and the request relates to our work.

We will give the client information reasonably needed to check our compliance with this DPA. We will allow reasonable audits of the work. An audit must protect other clients' data and the security of our systems.

We will handle client data in the locations agreed for the project. We will not move it to another country on the client's behalf without its written instruction or approval. If a transfer needs extra legal safeguards, we and the client will agree on them in writing before the transfer.

When the project ends, the client can ask us to return or delete the personal data we handled for it. We will follow the agreed return or deletion plan and delete existing copies, unless the law requires us to keep them. We will protect any data we must keep and use it only for that legal reason.

We may update this page for future projects and will show the new date at the top. A change to a DPA already included in a project agreement needs the parties' written agreement.

If you have a question about this DPA, use our contact form.