Data processing terms

1. Roles and scope

The Customer is the controller (or a processor for its own client) of the personal data its reviewers and teammates put into the service. Greatness Digital is the processor (or sub-processor). The data is the reviewer's name and email, comments, screenshots, files, voice notes, screen recordings, and technical details such as browser, page and IP address, about the Customer's own reviewers and teammates. The purpose is to provide the service. The duration is the life of the account plus the retention periods in the privacy policy.

2. What we promise

• We process the data only on the Customer's documented instructions, which are these terms, the Terms of service and what the Customer does in the product. If we think an instruction breaks the law, we will say so.
• Everyone who can access the data is bound by confidentiality.
• We keep appropriate security measures, described on our security page.
• We use only the sub-processors listed, under written terms no less protective than these, and remain responsible for them. We give notice of changes as described on that page, and the Customer may object on reasonable data-protection grounds.
• We help the Customer answer requests from people about their data. The dashboard lets the Customer export and delete data itself; for anything else, write to privacy@greatnessdigital.com.
• We help the Customer with security, breach notification, impact assessments and consultations with authorities, taking into account the nature of the processing.
• We tell the Customer without undue delay, and within 72 hours where we can, after we become aware of a personal data breach affecting its data, with what we know.
• When the account ends, we delete the data as set out in the Terms of service and privacy policy (the Customer can download it first), unless the law requires us to keep it.
• We give the Customer the information needed to show we meet these terms, and allow reasonable audits by written request, no more than once a year, at the Customer's cost, with notice and without harming other customers.

3. International transfers

Our hosting providers are in the United States. Where the Customer sends personal data from the EEA, the United Kingdom or Switzerland, the Standard Contractual Clauses (module 2, controller to processor, or module 3 where the Customer is a processor) and the UK International Data Transfer Addendum are incorporated by reference, with the Customer as exporter and Greatness Digital as importer, and Annex I–III filled in by sections 1, 2 and the sub-processor list. We also rely on the Data Privacy Framework where a provider is certified.

4. California

We act as the Customer's service provider. We do not sell or share the personal data, do not use it outside the direct business relationship with the Customer, and do not combine it with other data, except as the law allows.

5. Customer's duties

The Customer must have a lawful basis to collect the data, give its reviewers the notices the law requires (including about recordings), and keep to the acceptable use policy, including not collecting health information.

6. Contact

Data protection: privacy@greatnessdigital.com. Security incidents: security@greatnessdigital.com.