How Iris processes personal data on the Customer's behalf.
This DPA is entered into between Iris (Processor) and the Customer (Controller) under Article 28 of the EU General Data Protection Regulation (GDPR). It applies whenever Iris processes personal data on behalf of the Customer as part of the subscription service.
The Customer is the data Controller for personal data collected through the Customer's website (for example contact form submissions, booking data, newsletter sign-ups).
Iris is the Processor and acts only on the documented instructions of the Controller.
Iris processes personal data solely to provide the services described in the Service Description: hosting, maintenance, monitoring, backups, support and requested change work.
Typical data subjects: visitors, customers and prospects of the Controller.
Typical categories: name, email address, phone number, IP address, message content, booking data and any other personal data the Controller chooses to collect through their site.
The Controller must not use the service to process special categories of data (health, political opinions, biometric data, etc.) unless a separate written agreement is in place.
Processing continues for as long as the subscription is active. On termination, personal data is deleted or returned within 30 days, at the Controller's choice, unless retention is required by law.
The Controller authorises Iris to engage the sub-processors listed below. Iris will notify the Controller of any intended change to sub-processors at least 30 days in advance and give the Controller the right to object on reasonable data-protection grounds.
Iris hosts customer data in the European Union by default. Where a sub-processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses and any additional safeguards required by applicable law.
Iris implements appropriate technical and organisational measures, including:
Iris ensures that anyone with access to personal data is bound by a written confidentiality obligation.
Iris assists the Controller in responding to data subject requests (access, rectification, erasure, portability, restriction and objection) within a reasonable time and at no additional cost for standard requests.
Iris will notify the Controller without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting the Controller's data, together with the information the Controller reasonably needs to fulfil its own notification duties.
The Controller may, once per calendar year and with at least 30 days' notice, request information reasonably necessary to demonstrate Iris's compliance with this DPA. On-site audits can be arranged where legally required and are conducted during business hours in a way that does not disrupt the service.
On termination or on written request, Iris will delete or return all personal data processed on behalf of the Controller within 30 days, unless applicable law requires longer retention.
Liability under this DPA is governed by the liability clause in the Terms of Service, without prejudice to any mandatory statutory rights.
This document is a plain-language starter provided by Iris Studio. It does not constitute legal advice. Contact hej@iris-digitalstudio.com with any questions.