Data processing agreement

This agreement ("DPA") forms part of the terms of service between the customer ("you", the controller) and THIME Holding OÜ ("we", the processor). It applies when we process personal data on your behalf through ShowMeTheDocs, and it takes effect automatically when you accept the terms; no signature is needed. Terms such as "personal data", "controller", "processor" and "supervisory authority" have the meaning given in the GDPR (Regulation (EU) 2016/679) and, where it applies, the UK GDPR.

Where US state privacy laws (such as the CCPA) apply, we are your service provider: we process personal information only to provide the service, we do not sell or share it, and we do not combine it with other data except as the law allows.

• Subject matter and purpose: hosting and operating the compliance tracking service for you, including reminder emails to your vendors, document storage, reports and exports, and support; reading uploaded certificates and answering questions a user asks about their own organization's records, using an AI model provider, where those features are switched on.
• Duration: while your account is open, plus the deletion period in section 9.
• Data subjects: your employees and users; contact people at your vendors and subcontractors; individuals named in uploaded documents.
• Types of personal data: names, work email addresses, phone numbers and job titles if entered; vendor contact details; names and details appearing in certificates, licenses and similar documents; user activity records; IP addresses.
• Special categories: none intended. You must not upload them (see the terms, section 4).

We will:

• process personal data only on your documented instructions, which are the terms, this DPA and your use of the service's features; if we think an instruction breaks the law we will tell you;
• make sure everyone we authorize to process the data is bound by confidentiality;
• apply the security measures in section 5;
• help you, taking into account the nature of the processing, to answer requests from data subjects, and to meet your duties on security, breach notification, impact assessments and prior consultation;
• make available the information needed to show we comply with this DPA, and allow audits as described in section 8.

You are responsible for the lawfulness of the data you give us and for having a legal basis and any notices needed to share your vendors' contact data with us.

You give us general authorization to use the sub-processors below. Each is bound by written terms that give at least the same level of protection as this DPA, and we remain responsible for them.

We will email your account owner at least 15 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if we cannot offer a reasonable alternative you may cancel the affected service and receive a pro rata refund of the unused prepaid period. Where a sub-processor changes its own sub-processors, we will pass on its notice to your account owner within 5 business days of receiving it, and your right to object applies in the same way.

• Logical separation of each organization's records and files, enforced in the application and the database.
• Encryption in transit (TLS) and at rest for stored files and backups.
• Hashed passwords, expiring sessions, rate limiting and lockout against guessing; mandatory two-factor authentication and an audit log for our staff who access the back office.
• Private storage buckets, least-privilege cloud access and no customer data in application logs beyond what is needed to run and secure the service.
• Nightly backups with a 35-day retention and periodic restore tests.
• Malware and file-type checks on uploads, dependency vulnerability reviews, and security fixes applied on a priority basis.

We may update these measures if the overall level of protection is not reduced.

A plain-language overview of our security practices is on our security page.

We will notify your account owner by email without undue delay and, where possible, within 72 hours after becoming aware of a personal data breach affecting your data, including a breach at a sub-processor. The notice will describe what happened, the data and approximate numbers involved, the likely consequences and the steps taken, as far as known, and we will add details as we learn them.

If a data subject contacts us about data we process for you, we will point them to you and will not answer substantively without your instruction unless the law requires. You can use the in-app features (edit, delete, export) to handle most requests yourself; we assist with the rest.

On request, no more than once a year (or after a breach), we will give you the information reasonably needed to show compliance, such as a summary of our security measures and the relevant parts of our cloud providers' audit reports. If that is not enough for a supervisory authority or the law, you may carry out an audit on 30 days' written notice, during business hours, subject to confidentiality and without disrupting other customers. Each side bears its own costs.

You can export your data at any time. When your account is deleted, or on your written request after the agreement ends, we delete your personal data from our live systems within 30 days; it leaves backups within 35 days of that. We ask our sub-processors to delete the data they hold for us; where a sub-processor deletes automatically on its own schedule (for the AI model provider, within 30 days), we rely on that schedule. We may keep data that the law requires us to keep, such as billing records, and will protect it under this DPA.

You authorize the transfers needed to provide the service, including to the United States where our hosting is located. Where personal data subject to the GDPR, the UK GDPR or Swiss law is transferred to a country without an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), are incorporated by reference, with you as exporter and us as importer, and with these choices: Clause 7 docking clause applies; Clause 9(a) option 2 (general authorization, 30 days' notice); Clause 11 optional language does not apply; Clause 17 and 18: the law and courts of Estonia; the competent supervisory authority is the one for your establishment; Annexes I to III are completed by sections 2, 4 and 5 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies on the same basis, and for Swiss data the clauses apply with references to the GDPR read as references to Swiss law. Where we onward transfer data, we rely on our sub-processors' own transfer mechanisms.

If this DPA conflicts with the terms about personal data, this DPA prevails. The liability limits in the terms apply to this DPA to the extent the law allows. This DPA is governed by the law stated in the terms, except that the Standard Contractual Clauses are governed as stated in section 10. Contact us for data protection questions through the contact form; our address is Kotkapoja tn 2a-10, 10615 Tallinn, Estonia.