Data processing agreement
How we handle personal data in the spreadsheets you send to holysheet.
This data processing agreement (“DPA”) forms part of the terms of service between the customer (“you”) and holysheet, a sole trader business based in the United Kingdom (“we”). It applies automatically when you accept the terms; you don’t need to sign anything. If you need a signed copy, email legal@getholysheet.com.
1. Definitions
“Data protection law” means the UK GDPR, the Data Protection Act 2018 and, where they apply, the EU GDPR and laws implementing it. “Customer personal data” means personal data in the customer data (as defined in the terms) that we process on your behalf. “Controller”, “processor”, “personal data”, “personal data breach”, “processing” and “data subject” have the meanings given in data protection law.
2. Roles
You are the controller of customer personal data and we are your processor. Each of us will comply with data protection law. You’re responsible for having a lawful basis to process customer personal data and to send it to us, and for giving data subjects any notices required. Account and contact information about your users is covered by our privacy notice, where we act as a controller.
3. Processing on your instructions
We process customer personal data only on your documented instructions, unless the law requires otherwise (in which case we’ll tell you first, unless the law forbids it). Your instructions are: to provide the service under the terms, including as you use it through the workspace, API and add-ins. The subject matter, duration, nature and purpose of the processing, and the types of data and data subjects, are set out in Annex 1. We’ll tell you if we think an instruction breaks data protection law.
We won’t use customer personal data for any other purpose, including training or improving AI models, and we won’t sell it.
4. Confidentiality
Anyone we authorise to process customer personal data is bound by a duty of confidentiality.
5. Security
We maintain appropriate technical and organisational measures to protect customer personal data, taking into account the state of the art, costs, and the nature and risks of the processing. Annex 2 describes them. We may update them as long as the overall level of protection doesn’t go down.
6. Subprocessors
You give general authorisation for us to use subprocessors. The current ones are listed on our subprocessors page. We’ll give at least 30 days’ notice before adding or replacing one, by updating that page and emailing your workspace admins. If you object on reasonable data protection grounds, we’ll discuss it in good faith; if we can’t resolve it, you may end the affected service and we’ll refund any unused prepaid fees for it. We impose data protection obligations on each subprocessor that are at least as protective as this DPA, and we remain liable to you for their performance.
7. Helping you
- Data subject requests. If we receive a request from a data subject about customer personal data, we’ll pass it to you and won’t answer it ourselves unless you ask us to. We’ll give you reasonable help to respond, taking into account that we don’t store row text or answers.
- Impact assessments and consultations. We’ll give you reasonable information and help for data protection impact assessments and consultations with regulators that relate to our processing.
8. Personal data breaches
We’ll notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We’ll tell you what we know about its nature, likely consequences and the measures taken or proposed, and keep you updated as we learn more. We’ll take reasonable steps to contain it and reduce its effects. Notifying you isn’t an admission of fault.
9. Deletion at the end
We don’t retain row text or answers after a request finishes. When the terms end, we delete any remaining customer personal data within 30 days, unless the law requires us to keep it. Data in backups is deleted as those backups expire, and stays protected under this DPA until then.
10. Information and audits
We’ll make available the information reasonably needed to show we comply with this DPA, including answers to reasonable security questionnaires. If that isn’t enough, or a regulator requires it, you may audit our compliance once a year, on at least 30 days’ written notice, during business hours, at your own cost, and subject to confidentiality. Audits of our subprocessors are carried out by relying on their own independent certifications and reports.
11. International transfers
We may transfer customer personal data outside the UK or European Economic Area only where data protection law allows it: to a country covered by an adequacy decision or UK adequacy regulations, or with appropriate safeguards such as the EU standard contractual clauses with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. Where we rely on safeguards with a subprocessor, they’re part of our contract with that subprocessor.
12. General
Each party’s liability under this DPA is subject to the limits in the terms. If this DPA conflicts with the terms about personal data, this DPA wins. It lasts as long as we process customer personal data for you.
Annex 1: Details of the processing
| Subject matter | Providing the holysheet service: answering your questions about rows of text |
| Duration | For the term of the agreement. Each request’s row text is processed only while that request runs. |
| Nature and purpose | Receiving questions and rows, sending them to an AI model, and returning answers to you. Transmission, temporary processing in memory, and return of results. |
| Types of personal data | Whatever personal data you choose to include in rows and questions, such as names, contact details, and the content of messages, feedback, tickets or other text |
| Special category data | Not permitted under the terms unless agreed in writing |
| Data subjects | People mentioned in or connected with the rows you send, such as your customers, employees, users or correspondents |
Annex 2: Security measures
- Minimal retention. Row text and answers aren’t stored in our database. Our AI gateway is configured not to log or cache requests.
- Encryption. All connections use TLS. Our database is encrypted at rest by Cloudflare.
- Access control. Every request is authenticated with a signed-in session or an API key, and limited to the caller’s own workspace. Workspaces have admin and member roles. Session cookies are encrypted and protected against cross-site use.
- Key handling. API keys are shown once and stored only as one-way hashes. They can be revoked at any time.
- Separation. Production runs on separate infrastructure, a separate database and a separate sign-in environment from testing. Production changes go through a reviewed release process.
- Restricted access. Only we can access production systems, using accounts protected by multi-factor authentication.
- Providers. We use established providers with their own security programmes, listed on the subprocessors page.
- Monitoring and recovery. We check the service automatically every hour, and our database supports point-in-time recovery.
Annex 3: Subprocessors
See the subprocessors page.