Data processing addendum

Parties and scope

This addendum binds TariffTrust EI, France (“TariffTrust”, the processor), and the business that subscribes to TariffTrust (the “customer”, the controller). It applies to the personal data the customer and its members put in their workspace, to the extent that the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or a US state privacy law applies to it.

The processing

• Subject and purpose: providing TariffTrust as the terms of sale describe: estimates, saved results, declarations, portfolios, alerts, proof bundles, the assistant and the support requests made from the workspace.
• Duration: the subscription, then the retention the terms of sale set out.
• Data subjects: the customer's members and the people their workspace's content names.
• Personal data: names and email addresses, and what the customer enters in references, labels, descriptions, answers, conversations and support requests. TariffTrust does not ask for special categories of data, and the customer agrees not to enter them.

TariffTrust's commitments

• It processes the data only on the customer's documented instructions, which these terms and the customer's use of the service are, unless the law requires otherwise; it then tells the customer, unless the law forbids it. If it believes an instruction infringes data protection law, it tells the customer at once.
• The people it authorizes to process the data are bound to confidentiality.
• It keeps the security measures described in the privacy policy: encryption in transit and at rest, hashed passwords and keys, two-factor authentication, limited access to production data.
• It helps the customer answer the requests of data subjects, carry out impact assessments and consult authorities, as far as the nature of the processing allows.
• It tells the customer of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with what it knows of it.
• When the subscription ends, the customer may delete the workspace at any time, download what it keeps from the Billing page (its owner: the saved estimates, their proof bundles and the portfolios), or ask TariffTrust to return its data free of charge; otherwise it is deleted as the terms of sale set out.
• It makes available to the customer the information needed to show that these commitments are kept, and allows audits on reasonable notice, at most once a year unless a breach or an authority requires otherwise.
• For personal information a US state privacy law covers, TariffTrust acts as a service provider: it does not sell or share it, and does not retain, use or disclose it for any purpose other than providing the service or outside its direct relationship with the customer, except as that law allows.

What TariffTrust decides alone

As a separate controller, TariffTrust uses data on how the service is used, as the privacy policy describes, and the facts of an error it confirms as a test case of its engine, without the customer's references (terms of sale). The emails written to its addresses are its own too.

Subprocessors

The customer authorizes TariffTrust to use the following subprocessors, each bound by obligations equivalent to these; TariffTrust remains fully liable to the customer for them:

TariffTrust announces a new subprocessor on this page and by email to the workspace owners at least 30 days before it is used; a customer may object on reasonable grounds and, failing a solution, end its subscription before then.

Transfers

TariffTrust's subprocessors process the data in the United States, its mailboxes in France. For data the GDPR covers, the transfers to the United States rely on the standard contractual clauses adopted by the European Commission (Decision 2021/914, module three, processor to processor) in TariffTrust's contract with each subprocessor, or on its certification under the EU–US Data Privacy Framework; for a customer established outside the European Economic Area, module four of the same clauses (processor to controller) applies between it and TariffTrust, and is incorporated here by reference. For data the UK GDPR covers, they rely on the International Data Transfer Addendum of the UK Information Commissioner; for data Swiss law covers, on the adaptations it requires.

Contact

TariffTrust EI, France · privacy@tarifftrust.com