Legal
Data Processing Terms
These terms explain the controller-and-processor arrangements that apply when a customer puts personal data into Madeivo and instructs us to process it on the customer's behalf.
1. When these terms apply
These Data Processing Terms form part of the Madeivo Terms of Service whenever Greyrock Enterprises Ltd, trading as Madeivo, processes personal data on behalf of a customer organisation as its processor. They do not change the position where Madeivo acts as an independent controller for its own account administration, billing, security, website or support activities.
The customer is the controller and Madeivo is the processor for Customer Personal Data. If another data-protection law applies to the same processing, the parties will interpret these terms so far as reasonably possible to meet the equivalent controller/processor requirements of that law.
2. Processing details
| Subject matter | Operating the Madeivo workspace and the customer-selected product, document, Passport, translation, integration and support functions. |
|---|---|
| Duration | For as long as the customer uses the relevant service, plus the limited period needed for deletion, backups, security records and any lawful retention after the service ends. |
| Nature and purpose | Hosting, storing, organising, retrieving, transmitting, backing up, securing, supporting, translating or publishing information as instructed through the service and enabled integrations. |
| Types of personal data | Names, work contact details, account or organisation information, supplier/manufacturer/contact details, information contained in supporting documents, and other personal data the customer chooses to enter, upload, connect or publish. |
| Categories of people | Customer users and staff, contractors, supplier or manufacturer contacts, other economic-operator contacts, and other individuals whose personal data the customer chooses to process through Madeivo. |
| Customer rights and duties | The customer decides the purposes and lawful basis, gives lawful instructions, provides required privacy information, keeps instructions and access appropriate, and can use the service or contact Madeivo to exercise its controller rights. |
Madeivo is not designed as a repository for special-category or criminal-offence data. Do not upload that kind of data unless it is genuinely necessary, lawful and appropriate for the service.
3. Your instructions
Madeivo will process Customer Personal Data only on the customer's documented instructions, including instructions about international transfers and the instructions given through account settings, product records, publishing actions, support requests and enabled integrations, unless UK law requires different processing. If the law allows us to tell you about such a requirement, we will do so before the processing.
If we believe an instruction infringes applicable data-protection law, we will tell you without undue delay and may pause the affected processing while the issue is resolved.
4. Confidentiality and access
People authorised by Madeivo to process Customer Personal Data are subject to appropriate confidentiality duties and receive access only where needed for their role. Madeivo applies access controls designed to keep one organisation's private workspace data separate from another organisation's data.
5. Security
Madeivo will maintain technical and organisational measures appropriate to the risks of the processing. Current controls include organisation-scoped access controls, hashed passwords, encryption for supported stored integration secrets, HTTPS in production, security and audit records, backup and restore procedures, and separation between private working data and deliberately published Passport information.
Security measures can evolve as the service changes. The Security & data page describes current customer-facing controls without claiming certifications or service levels that have not been established.
6. Subprocessors
The customer gives Madeivo general written authorisation to use subprocessors needed to provide the service. This can include infrastructure, email, payment, translation and customer-enabled integration providers, depending on the features the customer uses.
Each subprocessor agreement will impose data-protection obligations that provide the same level of protection required by these terms. Madeivo remains responsible to the customer for the subprocessor's performance of those obligations. Where required, we will give reasonable notice of an intended new or replacement subprocessor so the customer can raise a reasonable data-protection objection. If an objection cannot be resolved, the customer can stop using the affected feature or end the affected service.
Contact hello@madeivo.com for the current subprocessor information relevant to your account.
7. International transfers
Madeivo will not make a restricted transfer of Customer Personal Data unless an appropriate UK transfer mechanism is available. Depending on the transfer, that may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved EU standard contractual clauses, together with any required transfer assessment.
8. Rights requests and assistance
Taking account of the nature of the processing, Madeivo will provide reasonable assistance so the customer can respond to requests from individuals exercising their data-protection rights. If we receive a request that clearly relates to Customer Personal Data for which the customer is controller, we will normally direct the requester to the customer unless the law requires us to handle it differently.
9. Breaches, DPIAs and regulators
Madeivo will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and will provide information reasonably available to help the customer assess and meet its notification duties.
Taking account of the nature of the processing and information available to us, we will also provide reasonable assistance with data-protection impact assessments, prior consultation with a regulator and other controller compliance duties that relate directly to Madeivo's processing.
10. Return and deletion
When the relevant service ends, Madeivo will, at the customer's choice, delete or return Customer Personal Data and delete existing copies unless UK law requires storage. Copies held in routine backups may remain until they are overwritten through the normal backup cycle; while retained, they remain protected, are not restored except where needed for recovery and are not used for unrelated purposes.
11. Information and audits
Madeivo will make all information reasonably necessary to demonstrate compliance with these processor obligations available to the customer. Where that information is not enough to meet a genuine legal requirement, we will allow and contribute to a reasonable audit or inspection carried out by the customer or an independent auditor appointed by the customer, subject to appropriate confidentiality, security, scope and scheduling controls. Audits must not compromise another customer's data or the security of the service.
12. Priority, liability and contact
If these Data Processing Terms conflict with the general Madeivo Terms of Service on a controller/processor data-protection issue, these Data Processing Terms take priority for that issue. The liability provisions in the main Terms of Service apply to these terms unless separate written terms say otherwise.
Privacy and data-processing questions can be sent to hello@madeivo.com.