Data Processing Agreement

1. Who this is between

This agreement is between [Your organisation] ("you", the controller) and [Company name], which runs Anterra ("we", the processor). It applies to personal data we process for you when we host [your app] and your other apps on Anterra.

It is part of our Terms of Service. If this agreement and the Terms of Service disagree about personal data, this agreement wins.

2. What we process and why

• Subject matter: hosting and running your apps, including their databases, stored files, email sending, logs, error reports, backups and the AI features you switch on.
• Duration: as long as you use Anterra, plus the deletion periods in section 10.
• Nature and purpose: storing, running, backing up, sending and deleting data so your apps work, as you set them up and ask through Anterra.
• People the data is about: your apps' visitors, users and customers, and anyone whose data you put in your apps.
• Types of data: whatever your apps collect, such as names, email addresses, account details, uploaded content and order details, plus technical data such as IP addresses and device information in logs.
• Special category data: only if your app collects it. You must tell us before you use Anterra for special category or criminal offence data, and make sure you have a lawful basis for it.

3. Your instructions

• We process the data only on your documented instructions. Your instructions are this agreement, the Terms of Service, your app's settings, and what you ask for through Anterra.
• We tell you straight away if we think an instruction breaks data protection law.
• If the law requires us to process the data in another way, we tell you first, unless the law forbids it.

4. Sub-processors

• You give us general permission to use the sub-processors on our Sub-processor list that are marked "Apps". They are also listed below.
• Each one is bound by written terms that protect the data at least as well as this agreement. We remain responsible to you for what they do.
• We tell you by email at least 30 days before we add or replace a sub-processor that handles app data. If you object for reasonable data protection reasons and we can't resolve it, you can stop using the affected feature, or end your plan and get a refund of fees paid in advance for the time after that.

5. Where the data is

• Your app [your app] and its database run in [London, UK (europe-west2)], and backups stay in the UK.
• Some sub-processors are outside the UK (see the list). Where data leaves the UK, we use a valid transfer mechanism under UK GDPR Chapter V: the UK adequacy regulations (including the UK–US data bridge), the ICO's International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or binding corporate rules. We carry out transfer risk assessments for these transfers.

6. Confidentiality and security

• Everyone at Anterra who can reach the data is bound to keep it confidential.
• We protect it with the technical and organisational measures in Annex 2, and keep them up to date.

7. Helping you

• People's rights. Your app's privacy settings let you export and delete a person's data. If you need more help to answer a request (access, correction, deletion, restriction, portability or objection), we provide it. If a request comes to us directly, we pass it to you and don't answer it ourselves unless you ask us to.
• Assessments and regulators. We help you with data protection impact assessments, and with consulting the ICO, where they relate to our processing.

8. Personal data breaches

• We tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your apps' data.
• We tell you what happened, what data and how many people are likely to be affected, the likely consequences, and what we are doing about it. We add details as we learn them.
• We help you meet your own duty to tell the ICO (within 72 hours) and the people affected.

9. Audits

We give you the information you need to show that this agreement is being followed. You may audit us, or appoint an independent auditor bound to confidentiality, once a year with at least 30 days' notice, or after a personal data breach. We will usually first share our security documentation and any independent reports, and you agree to rely on these where they answer your questions. You pay the cost of an audit unless it finds that we have materially broken this agreement.

10. At the end

• When you delete an app, we delete its hosting, files, secrets and databases. We first take a final backup, which is kept for 30 days so you can change your mind. Backups and logs expire on their own within 35 days.
• When you close your account, we delete your apps' data in the same way after the 14-day grace period.
• You can export your apps' data at any time before then. If you ask, we confirm in writing that the deletion is complete.
• We only keep data after this if the law requires us to, and we keep protecting it under this agreement.

11. Responsibility

Each party's responsibility under this agreement is subject to the limits in the Terms of Service. These limits don't apply where the law doesn't allow it, including to fines imposed directly on a party by a regulator.

12. Contacts and law

• Your contact for data protection: [your data protection contact]. Ours: privacy@anterra.io.
• This agreement is governed by the law of England and Wales.

Annex 1: Details of the processing

• Controller: [Your organisation], contact [your data protection contact].
• Processor: [Company name], [Registered office address], contact privacy@anterra.io.
• Processing: as in section 2, for [your app] and your other apps on Anterra.
• Region: [London, UK (europe-west2)].

Annex 2: Security measures

• Separation. Each app runs on its own, with its own service, its own database and database users, and its own secrets.
• Encryption. Data is encrypted in transit (TLS) and at rest (provider encryption). Secrets are kept in a secrets manager, never in code.
• Access control. Staff access is limited to people who need it, needs two-step sign-in, is recorded, and is time-limited. Looking inside your apps needs your permission.
• Backups. App databases are backed up every day and before every change to their structure. Restores are tested regularly.
• Software. Dependencies are pinned, scanned for known weaknesses and updated. Every release is checked before it goes live.
• Monitoring. We watch for errors, unusual activity and abuse, and we have an incident response process.
• People. Staff are trained in data protection and bound to confidentiality.

Annex 3: Sub-processors

The sub-processors marked "Apps" on our Sub-processor list.