Data Processing Agreement

The Controller determines the purposes and means of processing the personal data it puts into its workspace — for example customer contacts, invoices, scheduling and uploaded media. The Processor processes that data only to provide, secure and support the service. The Processor is an independent controller for its own account, billing and telemetry data, as described in the Privacy Policy.

• Subject matter: provision of the SimpliPilot business management platform.
• Duration: the term of the subscription, plus the deletion window below.
• Data subjects: the Controller's team members, customers, leads and contacts.
• Data categories: identity and contact details, business transaction records, scheduling data, communications, and uploaded files or media.

• Process personal data only on the Controller's documented instructions, including for international transfers, unless required by law.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organisational measures (see the Security Overview).
• Assist the Controller, taking account of the nature of processing, with data-subject requests, security, breach notification and impact assessments.
• Make available information reasonably necessary to demonstrate compliance, and allow audits limited to once per year on reasonable notice, or where required by a supervisory authority.

The Controller gives general authorisation for the Processor to engage subprocessors listed on the Subprocessors page. The Processor imposes data-protection obligations no less protective than this agreement, remains liable for their performance, and will give reasonable prior notice of additions so the Controller can object on legitimate grounds.

Where processing involves transferring personal data of individuals in the UK or EEA outside those areas, the parties rely on Standard Contractual Clauses or an applicable adequacy decision, with any required addenda incorporated by reference. Transfer mechanisms are subject to final attorney review before public launch.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with the information reasonably available, and will cooperate on investigation and remediation.

On termination, the Controller may export its data during a window of normally 30 days. After that window the Processor deletes or anonymises the data, except where retention is required by law (for example billing and tax records).

Data protection enquiries: support@simplipilot.com.