Data processing terms

These data processing terms are a draft pending solicitor review. They form part of the contract between the customer and Acess Limited, trading as Quantifiable (company number 16890479). Print or save this page as the form.

Roles

The customer is the controller for personal data it (or its portal users) put in the workspace: client contacts, project names, messages, and similar. We are the processor for that data. We are the controller for account, billing and security data, as the privacy notice describes.

Instructions

We process customer personal data only to provide Quantifiable, on the customer's documented instructions in these terms and in the product, and as UK law requires.

Security

We apply the measures in the security overview: TLS in transit, encryption at rest at the infrastructure providers, tenant isolation enforced in Postgres, access logging, and separate Clerk instances for the tenant app and the client portal.

Sub-processors

The customer authorises the sub-processors on /legal/sub-processors. We will publish a change before a new sub-processor sees customer personal data, except where a replacement is needed to keep the service running, in which case we publish as soon as we can.

Assistance, deletion, audit

• We will help the customer respond to data-subject requests that concern data in the product.
• On ending, we delete or return customer personal data as the erasure process describes, except copies we must keep by law.
• We will make available information the customer reasonably needs to show these terms are met, and allow an audit on reasonable notice no more than once a year unless a breach requires more.

International transfers

Where we transfer customer personal data outside the UK we use a lawful transfer tool as the privacy notice describes.

Questions: privacy@quantifiable.co.uk.