Roles
For personal data you store in your projects, you are the controller and RustaBase is the processor. This agreement forms part of the Terms of Service and applies automatically to all customers.
Our commitments
- Process personal data only on your documented instructions, meaning your use of the service and settings.
- Make sure staff with access are bound by confidentiality.
- Apply appropriate technical and organizational security measures, including encryption in transit, project isolation, access control and backups.
- Help you respond to requests from your users and with data protection impact assessments where reasonable.
- Notify you without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting your data.
- Delete or return your data when you close your account, as described in the Terms.
Subprocessors
We use a limited number of subprocessors for hosting, email and payments. The current list is available on request from [email protected]. We will give notice before adding a new subprocessor, and you may object on reasonable grounds.
Data location and transfers
Project data is stored in the region you select. Where data is transferred outside the EEA, UK or Switzerland, the EU Standard Contractual Clauses (and the UK addendum where relevant) apply.
Audits
We will provide information needed to show compliance with this agreement. On reasonable notice and no more than once a year, you may request additional information or an audit at your cost.
Signed copy
If your organization needs a countersigned DPA, email [email protected].