Data processing agreement

CDCT processes workbook content only on the customer's documented instructions: these terms, this DPA and the validations, package builds and package emails the customer starts in the service. This includes the transfers described in section 4. If EU or Dutch law requires other processing, CDCT tells the customer first, unless that law forbids it. CDCT tells the customer if it believes an instruction breaks data protection law.

CDCT ensures that everyone it authorises to process workbook content is bound by a duty of confidentiality.

CDCT takes the measures Article 32 GDPR requires. Workbooks travel over HTTPS, and uploading requires a signed-in session. Each workbook is processed in a temporary folder that is deleted when the request ends. A built package can be downloaded only in the session that built it; it is deleted once downloaded and otherwise expires shortly after it is built (currently after five minutes).

The customer gives general authorisation for the sub-processors in section 4. CDCT gives the customer notice of any intended addition or replacement in advance and the opportunity to object. CDCT binds each sub-processor to the same data protection obligations by contract and remains liable to the customer for its sub-processors.

Workbook content is not kept after processing (see (g)), so CDCT normally holds nothing to give access to, correct or delete. Where CDCT can help the customer answer a data subject's request, it does so with appropriate technical and organisational measures. CDCT passes any request it receives directly to the customer without delay.

CDCT helps the customer meet its duties under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to CDCT. CDCT notifies the customer without undue delay after becoming aware of a personal data breach involving workbook content, and gives the information the customer needs to report it.

CDCT deletes workbook content as part of normal processing: the uploaded workbook when the validation or build request ends, and the built package once it is downloaded or has expired. CDCT keeps no other copies, unless EU or Dutch law requires storage. The customer already holds the package, so there is nothing to return. A package the customer has emailed to itself stays in its own mailbox.

CDCT makes available all information needed to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, by the customer or an auditor the customer appoints. Send requests to [email protected].