Data Processing Addendum

Seller and contact

1. Scope and roles

This Data Processing Addendum ("DPA") applies when a business customer ("Customer") uses Plainline and enters personal data of other people into it. It meets the requirements of Article 28 of the GDPR and of the UK GDPR and forms part of the Terms of Service.

The Customer is the controller. Plainline is the processor. The DPA applies to every Customer that accepts the Terms of Service; a separate signature is not necessary. To get a signed copy, write to [email protected].

2. Details of the processing

• Subject matter: creating, editing, storing, sharing, and exporting presentations in Plainline.
• Duration: while the Customer uses Plainline, and until the data is deleted under section 3.
• Nature and purpose: storage, AI processing, display, sharing by link, and export, only to provide Plainline to the Customer.
• Types of personal data: personal data in source text, uploaded files, instructions, chat edits, and generated presentations; account data of the Customer's users.
• Data subjects: the Customer's users, and people whose data the Customer includes in its content.

3. Plainline's obligations

Plainline:

• processes personal data only on the Customer's documented instructions, including for transfers to third countries, unless the law requires otherwise; in that case Plainline tells the Customer first, unless the law does not allow it. The Terms of Service and the Customer's use of Plainline are the Customer's instructions;
• makes sure that people authorised to process the data are bound by confidentiality;
• applies the security measures of Article 32 of the GDPR described in Annex 1;
• uses the subprocessors listed on the Subprocessors page, binds each of them by contract to the same data protection obligations, and stays responsible for them. Plainline updates the list at least 14 days before a new subprocessor starts; the Customer can object within that period by writing to [email protected];
• helps the Customer, as far as possible, to answer requests from data subjects to use their rights;
• helps the Customer with security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available to Plainline;
• notifies the Customer of a personal data breach without undue delay after becoming aware of it;
• at the end of the service, deletes or returns the personal data at the Customer's choice, and deletes existing copies, unless the law requires storage;
• makes available the information necessary to show compliance with this DPA, and allows audits by the Customer or an auditor the Customer chooses, with reasonable prior notice.

4. International transfers

When personal data from the EU or the EEA is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses apply: Module 2 (controller to processor) between the Customer and Plainline, and Module 3 (processor to processor) between Plainline and its subprocessors. For data from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies. The countries of each subprocessor are on the Subprocessors page.

5. Customer's obligations

The Customer is responsible for having a legal basis for the processing and for giving data subjects the information they need. The Customer must not instruct Plainline to process data in a way that breaks data protection law.

Annex 1. Security measures

• Source text and presentations are encrypted before storage.
• Connections to Plainline use encryption in transit (HTTPS).
• Access to production systems is limited to the people who operate Plainline.