Data Processing Addendum

This addendum forms part of the Terms of Service. You are the controller of the personal data you upload or generate through the service; [YOUR FULL LEGAL NAME] is the processor. Where the two conflict, this addendum takes precedence for matters of data protection.

It applies to personal data protected by the UK GDPR, the EU GDPR, or comparable legislation. It takes effect when you start using the service and continues while we hold data on your behalf.

We process personal data only on your documented instructions, which are constituted by the Terms of Service, this addendum, and your use of the product’s features. We will tell you if we believe an instruction breaches data protection law, and we will not use your data for our own purposes — no profiling, no advertising, and no training of machine-learning models.

If law requires us to process data otherwise, we will inform you first unless that law prohibits it.

Anyone we authorise to access personal data is bound by a duty of confidentiality, and access is limited to those who need it to operate or support the service.

We implement appropriate technical and organisational measures under Article 32. Concretely, and not as aspiration:

• No client application can read or write the database directly. Database rules deny all client access and every operation is mediated by our server.
• Acceptance metadata — IP address, user-agent, timestamp, content hash — is captured server-side, so a recipient cannot influence what is recorded about them.
• Each stored version of your terms carries a SHA-256 hash of its exact content, recomputed and verified whenever a certificate is produced.
• Uploaded terms are sanitised against a strict allowlist before storage or display.
• Sessions are HTTP-only, HTTPS-only, expire after 14 days, and are revocable — signing out invalidates them server-side.
• Optional one-time email verification codes are stored only as hashes, are single-use, expire after 10 minutes, and are attempt-capped.
• Public endpoints are rate-limited. Pages carrying a personal link are excluded from search engines, cannot be framed, and do not leak their address via the referrer header.
• Data is encrypted in transit and at rest by our infrastructure provider.

You give general authorisation for the sub-processors below. We impose data-protection obligations on each of them no less protective than those in this addendum, and we remain liable to you for their performance.

We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you reasonably object on data-protection grounds, you may terminate your account without penalty.

Taking into account the nature of the processing, we will assist you with:

• responding to requests from data subjects exercising their rights — if one contacts us directly about your data, we will refer them to you rather than act on it ourselves;
• data protection impact assessments and prior consultation with a supervisory authority;
• demonstrating compliance, by making available the information needed to do so.

The product’s export function lets you retrieve your acceptance records at any time without needing to ask us.

On termination you may export your data. We will then delete or return personal data we hold on your behalf, except where law requires us to keep it — and except as follows, which you should read before relying on this service.

We can delete the surrounding contact record, which ends any further contact with that person and removes them from your workspace. If your own retention obligations are incompatible with permanent retention of acceptance records, Pacts is not a suitable tool for that data, and you should establish that before collecting it.

We will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data. The notice will describe what happened, the categories and approximate number of records concerned, the likely consequences, and the measures taken. We will not make public statements identifying you without your agreement unless legally required.

On reasonable written request, and no more than once a year unless a supervisory authority requires otherwise, we will provide the information necessary to demonstrate compliance with this addendum. Where an on-site inspection is genuinely necessary, we will cooperate on reasonable notice, during business hours, subject to confidentiality and without disrupting the service or exposing other customers’ data.

Our infrastructure is located in the United States. Where personal data is transferred out of the UK, EEA or Switzerland, the transfer is made under the Standard Contractual Clauses adopted by the European Commission, and the UK Addendum where applicable, together with any supplementary measures required. By entering into this addendum, the parties are deemed to have signed those clauses, with you as data exporter and us as data importer.

Questions, requests and notices under this addendum go to [privacy@pacts.io], or by post to [POSTAL ADDRESS FOR LEGAL CORRESPONDENCE].