Data Processing Agreement

This agreement forms part of the Subscription Terms and applies where, in providing CloudVerdict, we process personal data for which you are the controller. Where we are the controller in our own right, the Privacy Notice applies instead.

In this agreement, "UK GDPR", "controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meanings given in the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Roles

You are the controller. Apex Edge Sales Engineering Limited is the processor.

2. What is processed

CloudVerdict is not designed to hold special category data, criminal offence data, or personal data about children, and you should not put any of those into it.

3. Our obligations

We will:

• process personal data only on your documented instructions, which for these purposes are your use of the product and this agreement, unless we are required to do otherwise by law, in which case we will tell you unless the law forbids it;
• ensure that anybody authorised to process the data is under an appropriate duty of confidentiality;
• take appropriate technical and organisational security measures, including keeping each subscriber's data separate from every other subscriber's;
• assist you, so far as we reasonably can, with data subject requests, with data protection impact assessments, and with consultations with a supervisory authority;
• on the end of your subscription, delete all of the personal data, including the records described in clause 6, within the period stated in the Privacy Notice, keeping only invoices and tax records for as long as tax law requires; a copy in a backup is overwritten within the period the Privacy Notice states for backups;
• where you delete a use case, delete it, with every version and result, on the date the Privacy Notice states for it, unless you restore it first;
• make available the information you reasonably need to demonstrate our compliance with this agreement.

4. Sub-processors

You give general authorisation for us to engage sub-processors. By category, they are our hosting provider, our database and sign-in provider, our email delivery service, and our payment processor, as the Privacy Notice sets out. The named list of every sub-processor currently engaged, with what it does and where it processes, is given to you on request, at privacy@apexedgesalesengineering.com.

We impose on each sub-processor data protection obligations no less protective than those in this agreement, and we remain responsible to you for their performance.

Before we add or replace a sub-processor we will update the list and give you notice, to the email address held on your subscription. If you have a reasonable objection on data protection grounds, tell us at privacy@apexedgesalesengineering.com and we will work with you in good faith; if it cannot be resolved you may cancel under the Subscription Terms.

5. Our staff can reach your account, and it is recorded

Our staff can enter your account to support you. Every session records who opened it, whose account it entered, why, and when it ended, and every action taken during one names the member of staff as well as the person whose account it was. During one, staff cannot, as you, change your name, your subscription's name, your password, or your second factor, or close or reopen your account.

This is a security measure and an accountability measure, and it is disclosed here rather than buried because it is access to your data by somebody other than you.

6. Records that cannot be edited

The activity record and the audit record are immutable while your subscription exists. A correction is a new entry, never a change to an old one. Both are deleted with the rest of your personal data, within the period the Privacy Notice states or at once on your instruction, and what is left is a count of the deletion holding only its dates.

7. International transfers

The product is hosted in Europe, in Ireland (EEA): the database and sign-in, the servers that render every screen, and the email delivery service. Some of our sub-processors are incorporated in the United States. Where personal data is transferred outside the UK or the EEA, we do so under an approved safeguard, such as the UK International Data Transfer Addendum to the Standard Contractual Clauses, or an adequacy decision.

8. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, with the information you reasonably need to meet your own obligations.

Report a suspected breach or any security concern to security@apexedgesalesengineering.com. That address exists because a breach has a deadline on it, and product support is not where that deadline is watched.

9. Audit

We will make available the information reasonably needed to demonstrate compliance with this agreement and, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise, contribute to an audit conducted by you or an auditor you appoint, subject to confidentiality and to not compromising the security of other subscribers.

10. Your obligations

You warrant that you have a lawful basis for the personal data you put into CloudVerdict, that you have given any notice and obtained any consent required, and that your instructions will not put us in breach of data protection law.

11. The cloud providers are not involved

The cloud providers CloudVerdict prices are not sub-processors and receive no personal data from CloudVerdict. We read the prices they publish; we send them nothing. Nor is the European Central Bank, whose published reference rates convert a comparison into pounds or euros: we read its rates, and it receives nothing from us.

An export is yours to send. A PDF or a CSV you export leaves CloudVerdict when you download it. What you then do with it, and whom you send it to, is your own processing and not ours.

12. Precedence and changes

Where this agreement conflicts with the Subscription Terms on the processing of personal data, this agreement prevails. We may update it to reflect a change in law or in how the platform works, and where a change materially affects you we will give notice to the email address held on your subscription at least 30 days before it takes effect, unless the law or a risk to the security of the service requires it sooner.

13. Contact

Data protection matters: privacy@apexedgesalesengineering.com.

Security reports and suspected breaches: security@apexedgesalesengineering.com.

Anything with no better home: contact@apexedgesalesengineering.com.

14. Contact points

Each kind of correspondence has its own address. Using the right one matters: a data rights request has a statutory clock running on it, and a security report should not wait in a support queue.