Do you have a Data Processing Agreement, and who is controller and processor?

Yes. The Data Processing Agreement, the UK GDPR Article 28 terms, is published for review at /dpa/. It is a final draft awaiting solicitor sign-off. It is not yet in force and does not form part of any current agreement until it is executed.

Roles, as the Terms of Service describe them:

• For the marketing website and an individual's own account, we are the controller.
• For content put into the platform about other people, the organisation is the controller and we are the processor, acting on the organisation's instructions.

What the draft DPA proposes:

• Data subject requests: we would help the organisation respond, and forward any request made to us about its data to the organisation rather than answering it ourselves.
• Breach notice: we would give notice without undue delay and within 48 hours of becoming aware, so the organisation can meet its own 72-hour reporting window. That figure is still to be confirmed by our solicitor.
• Audits: we would allow reasonable audits, on notice, no more than once in any twelve months save where required.
• End of service: at the organisation's choice, we would delete or return its data.

Where we are the controller, individuals can exercise their UK GDPR rights at [email protected], with a response within 30 days. Accounts can also be deleted at any time from account settings, with immediate effect.