Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the DemarcLabs terms of service between DemarcLabs (“DemarcLabs”, “we”) and the customer that holds a workspace (“Customer”, “you”). It applies whenever the Service processes personal data on your behalf. If you need a signed copy, or your own form, email hello@demarclabs.com.

1. Roles

You are the controller (or, where you act for your own clients, a processor) of the personal data in your workspace. DemarcLabs is your processor and acts only on your documented instructions: the terms, this DPA, and what your admins and users do in the Service. If we believe an instruction breaks the law, we will tell you.

2. What is processed

• Whose data: your employees and contractors who use the Service; contacts at your locations; the people named on carrier bills, line reports and contracts you upload; your advisor's staff.
• What data: names, work email addresses and phone numbers, job titles, the business address of each location, phone numbers and user names on wireless lines, and whatever your providers print on the documents you upload.
• Why: to run the Service for you: keep your inventory, read your bills, send the alerts you chose, and let your advisor work with you.
• How long: for as long as your workspace exists, then as set out in section 8.

3. Confidentiality

Only people who need access to run the Service have it, and they are bound to confidentiality. DemarcLabs staff can look at a workspace to support it and can change records only when you ask; every such visit and change is written to the workspace's history where your admins can see it.

4. Security

We keep the measures described on our Security page: encryption in transit and at rest, row-level access control enforced in the database for every tenant, sign-in by emailed code or your identity provider with optional two-factor, signed time-limited links for files, least-privilege keys, and an audit history per workspace. We will not lower these measures during the term.

5. Subprocessors

We use the providers below to deliver the Service. Each is bound by terms at least as protective as this DPA. We will post any addition on the Security page and email your admins at least 30 days before it starts processing your data; if you object on reasonable grounds and we cannot resolve it, you may end the Service and we will refund any prepaid, unused fees.

6. Where data lives

Your data is stored and processed in the United States. If you are subject to the GDPR or UK GDPR, transfers to us rely on the EU Standard Contractual Clauses (module two, controller to processor) and the UK Addendum, which are incorporated by reference; we will sign them on request.

7. Helping you meet your obligations

• Requests from individuals: if someone asks you for their data or for its deletion, you can export or remove it yourself in the Service; where you cannot, we will help within 10 business days.
• Security incidents: we will tell your admins without undue delay, and no later than 72 hours after we confirm a breach affecting your data, with what we know, what we are doing, and what you can do.
• Assessments and audits: we will answer your security questionnaire within five business days and provide the information reasonably needed to show compliance with this DPA, once a year or after an incident.

8. Deletion and return

You can export your workspace at any time. When a workspace is deleted, or the Service ends, its records and files are deleted within 30 days, and from backups within 90 days, unless the law requires us to keep something longer. A person can delete their own account from My settings; records they entered stay with the workspace that owns them.

9. Liability and term

This DPA lasts as long as we process personal data for you. Liability is as set out in the terms of service. Where this DPA and the terms disagree about personal data, this DPA wins.