Data Processing Agreement

1. What we process, and why

Subject matter

Providing the ReCourse complaints service to you.

Duration

For as long as you use the service, and until the data is deleted under section 8.

Purpose

Recording, managing and responding to complaints and incident reports made to your organisation, including advisory AI assessment of complaints against your published policy.

Data subjects

Complainants, people who report incidents, your staff, and third parties named in complaints.

Personal data

Names, email addresses, the content of complaints, messages, reports and attached files. This may include special category data and data about criminal allegations.

2. Your instructions

We process the data only to provide the service as you configure and use it, unless the law requires otherwise, in which case we will tell you first unless the law forbids it.

3. Confidentiality and access

Everyone at CyberReady who can access the data is bound by confidentiality. We access your organisation's data only to support you or to keep the service running, and every such access is recorded in your organisation's own audit log.

4. Security

Each organisation's data is kept separate from every other's. Complaint text is pseudonymised before it is sent for AI assessment. Data is encrypted in transit. We will tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.

5. Sub-processors

You authorise us to use these sub-processors. We will tell you before adding or replacing one, so you can object.

• Vercel: application hosting.
• Neon: database, in London.
• Amazon Web Services: file storage, in Ireland.
• Inngest: background job scheduling. It receives identifiers, not complaint text.
• Anthropic: AI assessment. It receives pseudonymised complaint text and your policy, in the United States, and does not use it to train models.
• Our email provider: notification emails, which never contain complaint content.

6. International transfers

Where a sub-processor processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

7. Helping you

We will help you respond to requests from data subjects, carry out impact assessments and meet your security obligations, as far as the service allows. The service's own erasure and export tools are the first means of doing so.

8. Deletion

When the service ends, we delete your organisation's data within 30 days, or return it to you first if you ask, unless the law requires us to keep it.

9. Audit

We will make available the information you need to show that this agreement is being met, and allow for reasonable audits by you or an auditor you appoint.