Data processing agreement

This agreement applies whenever your use of Little Staff involves personal data that you are the controller of. It forms part of our terms of service, and where the two disagree about processing, this one wins.

You are the controller and [LEGAL ENTITY] is the processor. You decide what your agents do and what they may reach; we run the system that carries it out. Where we act as a controller in our own right, such as for your account and billing, the privacy policy governs instead.

Subject matter and duration. Providing Little Staff, for as long as your workspace exists, plus the thirty-day window described in clause 8.

Nature and purpose. Storing your workspace, running your agents, sending what they need to the model you chose, reaching the services you connected, and keeping a record of what was used.

Kinds of data. Whatever you put in, or point an agent at. Typically names, email addresses and message content; potentially anything in a document, mailbox or calendar you connect.

Whose data. Your people, and anybody your agents correspond with or whose information appears in what they work on.

Special categories. The service is not built for special category data under Article 9 or for criminal offence data under Article 10. You can put it in, and if you do, that decision and its consequences are yours.

We process personal data only on your documented instructions, which include the instructions you give through the product itself: an agent’s configuration, the tools it holds, the credentials you store and the approval rules you set.

If the law requires us to process something otherwise, we will tell you first unless that same law forbids it. If we think an instruction breaks data protection law, we will say so.

Everyone with access is bound to confidentiality. We keep measures appropriate to the risk under Article 32. In particular:

• Data is encrypted in transit, and at rest by our database provider.
• Credentials you store are sealed with AES-256-GCM before being written, and are never displayed again to anyone, including us.
• Each workspace is isolated. Access is decided on every request from who you are at that moment, rather than from anything stored, so losing access takes effect immediately.
• Agents run in isolated environments that cannot reach the network except where a policy allows it, and that refuse everything if the policy cannot be applied.
• Actions that change a workspace are recorded in an activity log you can read.

You authorise the sub-processors below. Each is bound by terms no weaker than these, and we remain responsible to you for what they do.

We will give you thirty days’ notice before adding or replacing one. If you object on reasonable data protection grounds, tell us within those thirty days and we will either propose an alternative or you may end the agreement and be refunded the unused part of your subscription.

Which model provider sees your data is your choice, made per agent when you pick its model, so that row of the table is under your control rather than ours.

Some sub-processors are outside the EEA, as the table says. Those transfers rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one applies. The application and the database are in Frankfurt, and the environments your agents work in are in Paris.

The product answers most of this without us being involved, which is faster than any promise we could make here. Your Data in the app gives you a complete copy of your workspace for a portability or access request, and closes it for an erasure request.

Beyond that we will help you respond to a data subject’s request, and with data protection impact assessments and prior consultation, so far as is reasonable and taking into account what we know. If a request reaches us directly we will pass it to you rather than answer it, unless you tell us otherwise.

You can take a copy at any time, on any plan, without asking us.

When you close a workspace your agents stop immediately, and thirty days later everything in it is permanently deleted. The thirty days are a grace period you can cancel within, deliberately, because deletion is otherwise irreversible.

What survives, and why. Records of what you were charged are accounting records we are required by law to keep for 10 years. We also keep a minimal record that the export or deletion happened, with the date, who asked and how many rows were removed, which is our own evidence under Article 5(2) that we did what this clause says. It holds no content of yours.

If we become aware of a personal data breach affecting your data we will tell you without undue delay, and in any case within seventy-two hours of becoming aware, with what we know, what we are doing and who to speak to. We will not wait until we have the full picture to tell you.

We will give you the information you reasonably need to show we meet Article 28, and allow an audit no more than once a year, on reasonable notice, during working hours, and in a way that does not put other customers’ data at risk. You bear the cost unless the audit finds we are not doing what this agreement says.

Write to [PRIVACY CONTACT EMAIL] about anything here, including to ask for a signed copy.