Data processing agreement

This agreement is between the business that uses Gatwyn (“you”, the controller) and GATE A1 Limited, Hong Kong (“we”, the processor). It forms part of the terms of service and applies whenever we process personal data on your behalf. It follows Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. If it conflicts with the terms, this agreement prevails for personal data.

1. What we process, and why

• Subject matter and purpose: providing Gatwyn, a customer-support service: receiving, storing, showing and sending your conversations with your customers, and the features you switch on.
• Duration: while your workspace exists, then until deletion as set out in section 8.
• Data subjects: your customers and website visitors who contact you, and the members of your workspace.
• Personal data: names, email addresses, phone numbers, WhatsApp, Messenger and Instagram ids, the content of messages and attachments, notes, custom field values, marketing consent records, and order details read from a connected Shopify store.
• Special categories: we do not ask for them. If your customers send such data in a message, it is processed like any other message content; you decide whether your use of Gatwyn is suitable for it.

2. Your instructions

We process the data only on your documented instructions: these terms, this agreement and the settings you choose in your workspace. We will tell you if we believe an instruction breaks data protection law. We process data otherwise only where a law we are subject to requires it, and will tell you first unless that law forbids it.

3. Confidentiality

Everyone at GATE A1 who can reach your data is bound by confidentiality and reaches it only when needed to run, support or secure the service.

4. Security

We keep these technical and organisational measures in place (Article 32):

• Each workspace’s data is separated in the database by row-level security, checked by automated tests for every table.
• Connections are encrypted (TLS); stored files and backups are encrypted.
• Access tokens and other secrets are encrypted before they are stored; passwords are kept only as hashes.
• Separate database roles for the web service, sign-in, provisioning and backups, each with the least access it needs.
• Two-step verification available to every member, roles and permissions inside each workspace, and an audit log of sensitive actions.
• Logs never contain message bodies, passwords or tokens. Backups are encrypted and expire after 35 days.

5. Subprocessors

You authorise the subprocessors on our subprocessors page. Each is bound by data protection terms at least as protective as this agreement, and we remain responsible for them. We will email workspace owners at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we cannot address it, you may end your subscription before the change applies, with a refund of any prepaid, unused period.

6. Transfers outside the EU

We are in Hong Kong, the service runs in the United Kingdom and files and backups are stored in the United States. Transfers to the United Kingdom rely on the EU adequacy decision. Any other transfer of personal data from the EU or the UK to us or to a subprocessor is covered by the European Commission’s standard contractual clauses (Decision 2021/914; module two, controller to processor, and module three, processor to processor, as applicable), completed with the UK addendum for UK data. Those clauses are incorporated into this agreement by reference, with the details in section 1 and the measures in section 4 as their annexes; the supervisory authority is the one competent for you. If they conflict with this agreement, the clauses prevail.

7. Helping you

• Requests from people: you can find, export, correct and delete a customer’s data yourself in Gatwyn. If a request reaches us directly, we pass it to you without answering it ourselves.
• Personal data breaches: we will tell workspace owners without undue delay, and no later than 48 hours after we become aware of a breach affecting your data, with what we know and what we are doing; we will keep you updated.
• Impact assessments: we will give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.

8. When the service ends

You can export all workspace data at any time. When a workspace is deleted, its data and files are erased seven days later, and are gone from backups within 35 days, unless a law requires us to keep something.

9. Audits

We will make available the information needed to show we meet this agreement. You may audit us, or have an independent auditor bound by confidentiality do so, once a year with 30 days’ notice, or at any time after a breach or at a supervisory authority’s request. Written answers and documents come first; each party bears its own costs.

Contact

Questions about this agreement or about data protection: info@gatea1.com.