Parties and roles
This Data Processing Addendum is a baseline for an engagement in which Madevyn processes personal data on a client's behalf. The client is the controller and Madevyn is the processor for that data. For the site's own inquiries, analytics and administration, Madevyn is the controller under the Privacy Notice.
The signed proposal or a separately signed data processing agreement can add to or vary this baseline for a particular engagement. If they conflict, the signed document governs for that engagement.
Scope, purpose and duration
The processing covers the personal data categories, data subjects and purposes described in the proposal or the agreed project documentation. It lasts for the engagement and for the period needed to return or delete the data, subject to legal retention.
Madevyn processes the data only on the client's documented instructions, including for a transfer, unless a law requires otherwise. If a law requires processing that is not in the instructions, Madevyn will tell the client unless the law prohibits the disclosure.
Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given by the data protection law that applies to the processing.
A subprocessor is a third party that Madevyn engages to process personal data on the client's behalf. A transfer is a disclosure or movement of personal data to a country or organisation outside the country in which it was collected.
Madevyn's obligations as processor
Madevyn will:
- process personal data only on documented instructions and for the agreed purpose;
- keep the people who process the data confidential and limit access to those who need it;
- implement appropriate technical and organisational security measures;
- assist the client with its obligations for data subject rights, security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing;
- not engage a subprocessor without the notice and objection route in this addendum;
- not sell the data, use it for advertising or use it for Madevyn's own purposes except as the controller under the Privacy Notice;
- delete or return the data at the end of the engagement as agreed, subject to legal retention;
- make available the information needed to show compliance and allow an audit as agreed.
Client's obligations as controller
The client will provide a lawful basis and a privacy notice for the data it asks Madevyn to process, give the required information to data subjects, and make sure the instructions are lawful and complete. The client will not ask Madevyn to process special category data or another person's data without the required authority and safeguards.
The client will tell Madevyn promptly if an instruction changes, if a data subject makes a request, or if the client becomes aware of a breach that affects the data.
Confidentiality
Madevyn will ensure that anyone authorised to process the data is bound by a duty of confidentiality or an equivalent legal obligation. The duty continues after the engagement ends.
Security measures
The measures are risk-based and include access control, salted password hashing, authenticator-based admin sign-in, hashed sessions, encrypted transport, input validation, rate limits, least-privilege access and logging. The agreed project documentation records any measure specific to the engagement.
The client is responsible for the security of its own accounts, devices, content and access it grants. The client will tell Madevyn promptly about a suspected compromise.
Subprocessors
Madevyn may use hosting, database, email, storage, security and other providers as subprocessors. The proposal or a current list supplied on request identifies a material subprocessor and its role. A subprocessor is bound by data protection and security terms that are no less protective than this addendum for the relevant data.
Madevyn will give the client notice of a new subprocessor where the engagement or the law requires it. The client may object on reasonable data protection grounds. If the objection cannot be resolved, either side may end the affected part of the engagement without penalty for that part.
International transfers
Where the processing involves a transfer to another country, Madevyn will use a lawful transfer mechanism and the safeguards required by applicable law, such as standard contractual clauses or another permitted route. Madevyn will give the client information about the mechanism on request.
Data subject requests
Madevyn will assist the client with a data subject request relating to the data it processes. Madevyn will not answer the request on the client's behalf unless instructed, except to acknowledge it and direct the person to the client where appropriate. Madevyn will not charge for reasonable assistance unless the law or the signed agreement allows it.
Personal data breaches
Madevyn will notify the client without undue delay after becoming aware of a personal data breach affecting the client's data. The notice will describe what happened, the data and people affected, the likely consequences, the measures taken and the contact for the incident, to the extent known at the time.
Madevyn will assist the client's own notification to a supervisory authority or to affected people. The client is responsible for deciding whether to notify and for the content of its notice.
Deletion and return
At the end of the engagement, Madevyn will return the client's data in an agreed format or delete it, as the client instructs, subject to a legal retention duty. If an instruction is missing, Madevyn will delete the data after a reasonable notice period.
A backup copy may persist for the short rotation of the backup system under the same access and security controls before it is deleted.
Audit and information
Madevyn will provide the information reasonably needed to show compliance with this addendum. An audit or inspection will be agreed in advance, limited to the relevant systems and data, carried out without disrupting another client, and subject to confidentiality. A report or a written answer will be provided where that is sufficient.
Liability
Liability under this addendum is governed by the signed proposal or the separate data processing agreement. Nothing in this baseline increases a limitation of liability beyond what the signed document says, or limits a liability that cannot lawfully be limited.
Term, conflict and contact
This addendum applies for the engagement and continues for as long as Madevyn holds the client's personal data. If it conflicts with the proposal on a data protection question, the signed data processing terms prevail for that question.
Questions about this addendum go to privacy@madevyn.xyz. A security incident should go to security@madevyn.xyz.