Data processing addendum
This addendum is part of the terms of service between you, the customer, and [legal entity name], the processor. It applies where we process personal data about the users of your apps on your behalf, and is meant to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Roles
You are the controller of personal data about the users of your apps. We are your processor for the licence and usage data described below. We act only on your documented instructions, which are these terms, this addendum and the settings you choose in the customer console.
2. What we process
| Subject matter | Issuing licence tokens to your apps and counting monthly active users for billing. |
|---|---|
| Data subjects | People who use your apps that include the SDK. |
| Personal data | Device-key thumbprints; pseudonymous device identifiers with per-device monthly usage counts; app ID, platform, SDK version and first and last seen times per device; IP addresses while a request is handled. |
| Not processed | Camera frames, images, video, face landmarks and face measurements. The SDK processes these on the device only and never sends them to us. No special category data is sent to us. |
| Duration | For the life of your licence, then as set out in section 8. |
3. Confidentiality
Only people who need access to run the Service can reach your data, and they are bound by confidentiality.
4. Security
We keep appropriate technical and organisational measures in place, including:
- TLS for all traffic between apps and the licence server.
- Licence keys stored only as keyed hashes; signing keys kept outside the database.
- Database rules that deny public clients any access to licence, device and usage tables.
- An admin console limited to named staff, with a mandatory second factor and an audit log of every change.
- Nightly encrypted backups kept for 14 days and a tested restore. [Confirm encryption of backups.]
- Rate limits and alerts on unusual use of a licence key.
5. Sub-processors
You authorise the sub-processors listed here: [hosting provider and location], [email provider]. We will tell you at least [30] days before adding or replacing one, and you may object on reasonable grounds. Each sub-processor is bound by terms at least as protective as these.
6. Helping you
We will help you answer requests from your users to exercise their rights, and with security, breach notification, impact assessments and consultations with authorities, as far as our role allows. A revoked device gets no further tokens.
7. Personal data breaches
We will tell you without undue delay, and within [48] hours, after we become aware of a personal data breach affecting your data, with the information you need to meet your own duties.
8. Deletion and return
When your licence ends, we delete device records and usage counts for your apps within [90] days, except for billing records the law requires us to keep. Backups roll over within 14 days. On request, we will first give you an export of your usage data.
9. Audits
We will make available the information you need to show compliance with this addendum, and allow reasonable audits with [30] days' notice, no more than once a year unless a breach or an authority requires it.
10. Transfers
Data is stored in [country or region]. If data is transferred outside the European Economic Area, we will use a valid transfer mechanism such as the EU Standard Contractual Clauses. [Confirm.]
Contact
Questions about this addendum: hello@example.com.