Data processing agreement

1. Details of the processing

• Subject matter and purpose: providing Clutched to the customer: storing content, sending and tracking proposals, contracts and invoices, collecting signatures, processing payments through providers the customer connects, AI features the customer uses, and support.
• Duration: for as long as the customer uses Clutched, and until the data is deleted under section 9.
• Data subjects: the customer’s clients and their contacts, signers and recipients of documents, and the customer’s own staff who use Clutched.
• Types of personal data: names, email addresses, job titles, phone numbers and postal addresses; company details; content of proposals, contracts and invoices; signatures with signing time, IP address and browser; document viewing activity; payment status; and anything else the customer chooses to add.
• Special category data: Clutched isn’t designed for it, and the customer shouldn’t upload it unless it’s necessary and lawful.

2. Instructions

We process personal data only on the customer’s documented instructions, which are these terms and the customer’s use and configuration of Clutched, unless the law requires otherwise (in which case we’ll tell the customer first, if the law allows). We’ll tell the customer if we believe an instruction breaks data protection law.

3. Confidentiality

Everyone we authorise to process the personal data is bound by confidentiality, and only people who need access to provide or support the service have it.

4. Security

We maintain appropriate technical and organisational measures, described on our security page, including encryption in transit and at rest, workspace isolation enforced by the database, role-based access, two-factor and single sign-on options, audit logging, reviewed and tested changes, and daily backups.

5. Subprocessors

The customer gives general authorisation for us to use subprocessors for hosting, database and file storage, email delivery and AI features. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for them. Customer data is stored in the UK. Details of current subprocessors are available to customers on request.

We’ll give account owners at least 30 days’ notice by email before adding or replacing a subprocessor. The customer may object on reasonable data protection grounds; if we can’t address the objection, the customer may cancel and receive a refund of prepaid fees for the remaining period. Services the customer connects itself (such as payment, accounting or CRM software) act under the customer’s own agreement with them and aren’t our subprocessors.

6. International transfers

Customer data is stored in the UK. Where a subprocessor processes it outside the UK or EEA, the transfer is protected by an adequacy decision or data bridge, or by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, which are incorporated by reference where needed.

7. Helping the customer

• Data subject requests: Clutched lets the customer find, correct, export and delete personal data. If we receive a request directly, we’ll pass it to the customer and won’t respond ourselves unless the customer asks us to.
• Impact assessments and consultations: we’ll give reasonable help with data protection impact assessments and with any consultation with a supervisory authority.

8. Personal data breaches

We’ll notify the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data, with the information the customer reasonably needs to meet its own obligations, and we’ll take reasonable steps to contain and fix it.

9. Deletion and return

The customer can export its data at any time in Settings. When the customer deletes its workspace, we delete the personal data from our live systems straight away; backups expire within 7 days. We keep data longer only where the law requires it.

10. Audits

We’ll make available the information reasonably needed to show compliance with this DPA, including our security policies and answers to security questionnaires. Where that isn’t enough, the customer may carry out an audit, at its own cost, once a year with 30 days’ notice, during business hours and under confidentiality, in a way that doesn’t compromise other customers’ data.

11. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law doesn’t allow that. If this DPA conflicts with the terms of service on data protection, this DPA takes priority.