Data processing agreement

Parties and scope

yof is provided by Mondaily Ltd (placeholder: the company is being registered in the United Kingdom). Company number: to be added after registration in England and Wales. Registered address: to be added after registration.

This agreement applies when yof processes personal data on your behalf: personal data that is in the code, sites, assistants or database catalogs you ask yof to check, and in the findings and reports made from them. You are the controller and we are the processor.

To get a signed copy, write to privacy@yof.io with your account email and company name.

What is processed

• Subject matter and nature: running the checks, reviews, fixes and reports you ask for on code, sites, assistants and database catalogs you control, and storing the findings and reports.
• Duration: as long as your account or contract runs, then until the data is deleted as described below.
• Types of personal data: any personal data that happens to be in that code, on those sites or in those catalogs (for example names and email addresses in source files or leaked keys tied to a person), always shown masked in findings.
• People the data is about: your own people and any person whose data is in the code, sites or catalogs you ask yof to check.

What we commit to

• We process the data only on your documented instructions, which are these terms and the settings you choose in yof, including for any transfer outside the UK or the EU. If we think an instruction breaks data protection law, we tell you.
• Everyone at yof who can reach the data is bound to confidentiality.
• We keep the data secure: encryption in transit, encrypted secrets, access only through server-side code with per-account isolation, read-only checks, logged access, and encrypted backups in the EU and Switzerland.
• You give general written permission for the subprocessors on the Subprocessors page. We tell you at least 30 days before adding or replacing one, so you can object; if we cannot meet a reasonable objection, you can end the affected service and get a refund of any prepaid period. Each subprocessor is bound by written terms that protect the data at least as much as these, and we remain responsible for it.
• We help you answer requests from the people the data is about, and with security, breach notices, impact assessments and consultations with an authority.
• We tell you without undue delay, and aim to within 48 hours, after we learn of a personal data breach that affects your data, with what we know and what we are doing about it.
• When the contract ends, you can export the data, and we then delete it within 30 days of the account being erased, and from backups as they expire (35 days at most), unless the law requires us to keep it. We confirm this on request.
• We give you the information you need to check we keep these commitments, and allow audits by you or an auditor you choose, with reasonable notice, at most once a year unless there was a breach or an authority asks.

Transfers

yof's database and the machines we run are in Frankfurt, Germany, with an encrypted backup copy in Switzerland. Where a subprocessor may process data outside the UK or the EU, the transfer relies on an adequacy decision (such as the EU and US Data Privacy Framework and its UK Extension for a provider that has joined it) or on the European Commission's standard contractual clauses (Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK data. Those clauses are part of this agreement where they are needed.

For data from the DIFC, ADGM, the United Arab Emirates, Saudi Arabia or Qatar, the same safeguards are used under the transfer rules of those laws, and we follow their processor rules as well.

If terms conflict

If this agreement and the standard contractual clauses conflict, the clauses win. If this agreement and the Terms of service conflict on personal data, this agreement wins.