Data Processing Agreement

4.1 Instructions

Process Personal Data only on the documented instructions of the Controller, unless required to do so by Applicable Data Protection Law, in which case the Processor shall inform the Controller of that legal requirement before processing (unless prohibited from doing so by law). For the purposes of this Agreement, the Terms of Service and the Controller's use of the Services constitute the Controller's documented instructions.

4.2 Confidentiality

Ensure that persons authorised to process Personal Data on behalf of the Processor are subject to appropriate confidentiality obligations (whether contractual or statutory) with respect to that Personal Data.

4.3 Security

Implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures include, without limitation: AES-256 encryption at rest; TLS 1.2 or higher for data in transit; row-level security at the database layer; multi-factor authentication for direct production access; and passwordless (magic-link) authentication for host accounts with no password database exposure. Further detail is available at meetwhenn.com/security.

4.4 Sub-processors

Not engage any Sub-processor without the prior written consent of the Controller, save that the Controller hereby provides general written consent to the engagement of the Sub-processors listed in Schedule 1 of this Agreement. The Processor shall: (i) impose on Sub-processors data protection obligations equivalent to those imposed on the Processor under this Agreement; (ii) remain fully liable to the Controller for the performance of each Sub-processor's obligations; and (iii) notify the Controller of any intended addition or replacement of Sub-processors with reasonable prior notice, giving the Controller the opportunity to object.

4.5 Data Subject Rights

Assist the Controller, by appropriate technical and organisational measures and to the extent possible, in fulfilling the Controller's obligations to respond to requests from data subjects exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection). Where a data subject makes a request directly to the Processor relating to Personal Data processed on behalf of the Controller, the Processor shall promptly forward that request to the Controller and shall not respond to the data subject except as instructed by the Controller or as required by law.

4.6 Assistance with Compliance

Assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of UK GDPR (including security of processing, breach notification, data protection impact assessments, and prior consultation with the Supervisory Authority), taking into account the nature of processing and the information available to the Processor.

4.7 Deletion and Return

At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of Services, and delete existing copies unless retention is required under Applicable Data Protection Law. Account data will be deleted within 30 days of account closure. Meeting participation data will be deleted within 90 days of a meeting being confirmed or expiring. Calendar free/busy data is never stored persistently; it is queried, used to compute availability, and immediately discarded.

4.8 Audit

Make available to the Controller all information necessary to demonstrate compliance with this Agreement, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. The Processor may require reasonable advance notice (not less than 30 days) for such audits, and may require that the auditor enters into a confidentiality agreement. The costs of any audit shall be borne by the Controller unless the audit reveals a material breach of this Agreement.

4.9 Breach Notification

Notify the Controller without undue delay, and in any event within 48 hours, upon becoming aware of a personal data breach affecting Personal Data processed under this Agreement. Such notification shall include, to the extent available: (i) a description of the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; (ii) the likely consequences of the breach; and (iii) the measures taken or proposed to address the breach. Where full details are not available within 48 hours, the Processor may provide information in phases.

4.10 No Unauthorised Use

Not use Personal Data processed under this Agreement for any purpose other than providing the Services, including without limitation for advertising, profiling, machine learning model training, or transfer to third parties outside the scope of this Agreement.

9.1 Governing law

This Agreement is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales in respect of any dispute arising out of or in connection with this Agreement.

9.2 Entire agreement

This Agreement, together with the Terms of Service, constitutes the entire agreement between the parties in relation to the processing of Personal Data and supersedes all prior representations, discussions, or agreements.

9.3 Amendments

The Processor may update this template periodically to reflect changes in Applicable Data Protection Law or the Services. Executed copies may only be amended by written agreement signed by both parties.

9.4 Severability

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.