Draft — to be reviewed by a lawyer before launch
Data Processing Agreement
Last updated: · Provided by [Company legal name] · Questions: [legal@your-domain]
A Data Processing Agreement (DPA) is available to every customer on request.
How to get it
Email [legal@your-domain] from the address of a workspace owner and tell us the name of the workspace. We will send the DPA for signature. [The signed-copy process, and a self-service download if wanted, are to be set up before launch.]
What it covers
Where the company that uses Loopin (the customer) is the controller of its people’s personal data and Loopin processes it for the customer, the DPA sets out, in line with the GDPR and similar laws:
- what is processed, for what purpose and for how long, and that Loopin acts only on the customer’s documented instructions;
- confidentiality of the people who handle the data, and the security measures described on the security page;
- the sub-processors Loopin uses, how the customer is told of a change, and the customer’s chance to object;
- help with requests from people (access, export, erasure), with impact assessments and with the customer’s own obligations; Loopin already provides workspace and per-person export, erasure of a person and deletion of a workspace;
- telling the customer without undue delay after Loopin becomes aware of a personal-data breach;
- the return or deletion of data at the end of the agreement, and the customer’s right to ask for evidence of compliance;
- the mechanism for transfers outside the country or region of the customer.
The agreement applies on top of the Terms of Service. This page is a summary and is not the agreement.