This Data Processing Agreement ("DPA") forms part of the Terms of Service between SONARIS LTD (trading as Sonaris), a company registered in England and Wales with company number 16223664, registered office 296 Coldharbour Lane, London, England, SW9 8SE ("Processor", "Sonaris") and the Customer ("Controller"). It applies where Sonaris processes personal data on the Customer's behalf ("Customer Personal Data") and meets the requirements of Article 28 of the UK GDPR.
1. Scope and roles
1.1 The Customer is the controller of Customer Personal Data and Sonaris is its processor. Where Sonaris processes personal data for its own purposes (account administration, billing, security, its own marketing, telemetry and legal compliance), it does so as a controller under its Privacy Notice, and this DPA does not apply to that processing.
1.2 The subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects, are set out in Schedule 1.
2. Instructions
Sonaris processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service, unless UK law requires otherwise (in which case Sonaris will tell the Customer first unless the law prohibits it). Sonaris will tell the Customer if it believes an instruction infringes data protection law.
3. Confidentiality and security
3.1 Sonaris ensures that personnel authorised to process Customer Personal Data are bound by confidentiality.
3.2 Sonaris implements the technical and organisational measures in Schedule 2 and keeps them appropriate to the risk.
4. Subprocessors
4.1 The Customer authorises Sonaris to use the subprocessors on the public subprocessor list. Sonaris imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains liable for their performance.
4.2 Sonaris will give at least 30 days' notice of a new subprocessor by updating the list and notifying Customer Administrators. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may end the affected Service and receive a pro-rata refund of prepaid fees.
5. Assistance
Taking into account the nature of the processing, Sonaris will assist the Customer, through the Service's export, correction and deletion features and otherwise on request, to respond to data subject requests, and with security, breach notification, data protection impact assessments and prior consultation. Sonaris will promptly pass on any data subject request it receives about Customer Personal Data and will not answer it except on the Customer's instructions.
6. Personal data breaches
Sonaris will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations, and will take reasonable steps to contain and remedy it.
7. International transfers
Sonaris may transfer Customer Personal Data outside the UK only under a lawful transfer mechanism: UK adequacy regulations (including the UK–US data bridge for certified recipients) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. Audit
Sonaris will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of its security measures and its subprocessors' certifications. Where that is not enough, the Customer may carry out an audit, at its own cost, on 30 days' notice, no more than once a year, during business hours, and subject to confidentiality.
9. Return and deletion
During the term the Customer can export Customer Personal Data at any time. When a workspace is closed, Customer Personal Data remains available for export for 30 days and is then deleted from the live Service. Copies in backups expire on a rolling schedule of up to 90 days and are not restored into live use without re-applying deletions. Sonaris may keep data only where UK law requires it, and then keeps it confidential and processes it only for that purpose.
Schedule 1 — Details of processing
- Subject matter and duration: provision of the Service for the term of the Terms, plus the deletion period above.
- Nature and purpose: hosting, storage, organisation, retrieval, transmission (including email sending), display, analysis on the Customer's instructions (including AI features the Customer chooses to use), backup and deletion, to provide the Service.
- Data subjects: the Customer's personnel and guests; its contacts, leads and clients; form respondents and people who book; campaign recipients; website visitors; storefront customers; and anyone else whose data the Customer puts into the Service.
- Categories of data: identity and contact details; business details; communications and messages; files and content; order, delivery and transaction details (not full card numbers, which Stripe processes); booking details; campaign delivery and engagement events; website usage data; AI prompts and outputs; any other data the Customer chooses to process.
- Special category data: not intended. The Customer must not put special category or criminal offence data into the Service unless it has a lawful basis and has assessed the risk.
Schedule 2 — Technical and organisational measures
- Encryption in transit (TLS) for all connections and encryption at rest by our hosting provider.
- Workspace isolation enforced in application authorisation and tested.
- Role-based access in the product; least-privilege access to production; multi-factor authentication for administrative access; audit logging of administrative actions, impersonation, exports and deletions.
- Passwords stored as salted hashes; secrets kept out of source code.
- Managed hosting with automated backups, patching and monitoring; dependency and vulnerability checks.
- Logging configured to avoid recording credentials, request bodies and message content.
- Defined retention and deletion schedules; data export available to Customers.
- Incident response procedure with a breach register.
- Staff confidentiality obligations and periodic access reviews.