Data Processing Agreement

1. What this covers, and what it does not

For your own account data we are the controller, and the privacy policy governs. This agreement covers the other thing you do here: putting personal data about other people into our systems: the contacts you name, their addresses and telephone numbers, what you wrote about them, and the letters, recordings and documents addressed to them. For that data you decide the purposes and we act on your instructions, so you are the controller and we are the processor.

This agreement forms part of the Terms of Service. Where the two conflict on data protection, this agreement wins.

2. Words used here

• Personal data: information about an identified or identifiable living person.
• Processing: anything done with it, including simply storing it.
• Data subject: the person the data is about. Here, usually somebody you named.
• Sub-processor: a company we use to process it on our behalf.
• GDPR: Regulation (EU) 2016/679, and the UK GDPR as it applies in the United Kingdom.

3. Subject matter, duration, nature and purpose

• Subject matter: storing, encrypting and conditionally delivering content and contact details you supply.
• Duration: for as long as your account exists, plus the deletion grace period, plus any period we are legally required to keep something.
• Nature: storage, encryption, transmission by email, access control, logging, and delivery to named recipients when the conditions you configured are met.
• Purpose: to make sure what you left reaches the people you chose.

4. What is processed, and about whom

Categories of personal data

• Names, email addresses, telephone numbers and relationships of the people you name
• Notes you write about them
• Content addressed to them: letters, recordings, photographs, documents, credentials
• Delivery records: what was sent, when, whether it arrived, when it was first opened
• Technical data of recipients who open the portal: IP address, browser, times of access
• Evidence of a death, which may include a death certificate and therefore health data

Categories of data subject

• Contacts, recipients and executors you name
• Trusted verifiers you ask to confirm a death
• Business successors and partners
• People mentioned inside the content you store
• The deceased account holder, once they have died

Special category data

You may store health information (medical notes, allergies, organ donation wishes), and a death certificate usually states a cause of death. If you store special category data it is your responsibility, as controller, to have a lawful basis for it under Article 9. Medical notes, allergies, a blood type and organ donation choices are encrypted by the application, and so is a death certificate uploaded with the first report of a death or by a trusted verifier; they are kept in the database or on private storage that is not served from the web. We release health information only to the people you named.

5. We act on your instructions

We process personal data only on your documented instructions, which for this service means: what you configure in the product, and what these terms say. If we are legally required to do something else, we will tell you first unless the law forbids it.

If we think an instruction breaks data protection law, we will tell you.

6. Security

The measures actually in place:

• AES-256-GCM encryption of most stored content, with the keys held by the service so that a release can happen after the account holder has died; the names, relationships and notes you keep about contacts, the names, birth dates and biographies in the family tree, box names, file names and the profile picture are not encrypted by the application (the privacy policy has the full list)
• TLS for data in transit
• Hashed passwords, optional two-factor authentication and passkeys
• Role-based administrative access, with every staff action written to an audit log
• Uploaded documents and media on private storage that is not served from the web
• Rate limiting and signed, expiring links for anything sent by email
• Automated destruction of failed background jobs, which can briefly hold decrypted text

What is not in place, stated plainly because a DPA that overstates its security measures is worthless: no ISO 27001 or SOC 2 certification, no external penetration test, no formal, documented disaster-recovery test schedule, and no browser-side encryption; the service holds the keys to what is stored.

7. Confidentiality

Everyone with administrative access is bound to confidentiality and keeps only the access their role needs.

8. Sub-processors

You authorise the sub-processors listed in the privacy policy. Each is bound by terms no weaker than these, and we stay liable for what they do.

We will give you at least 30 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds, you may export your data and close your account without penalty for the remainder of your term.

Privacy Policy

9. Helping you meet your own obligations

We will help you, as far as is reasonable, with:

• Requests from people you named who want access, correction or deletion (most of which you can handle yourself in the product)
• Security of processing, breach notification and impact assessments
• Passing on any request that reaches us directly, rather than answering it for you

If somebody you named contacts us directly, we will tell them to contact you unless answering ourselves is obviously the right thing to do: for example a simple request to be removed, or a request that reaches us after you have died, when there is nobody left to refer it to.

10. Personal data breaches

We will tell you without undue delay, and in any case within 72 hours of becoming aware, with what we know about what happened, who is affected, what the likely consequences are and what we are doing about it.

11. Transfers outside the EEA and the UK

Some sub-processors are in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum of the UK regulator, now the Information Commission, together with encryption of stored content. We do not rely on, and do not claim, any certification under a transatlantic adequacy framework.

12. Return and deletion

When your account is deleted, the content and the contact details you stored are destroyed after the grace period. The record of what was delivered and the audit trail survive, because they are the evidence that instructions were carried out and a request from one recipient cannot erase another person's proof.

You can export a readable copy yourself, at any time, before you go. The privacy policy says what the export leaves out.

13. Audits

We will give you the information you reasonably need to show that this agreement is being met. We do not currently hold an independent audit report, so what we can provide is documentation and answers rather than a certificate. If you need an on-site audit, write to us and we will agree scope and timing.

14. Governing law

The law named in the Terms of Service, without affecting any mandatory data protection law that applies to you.

Do you need a signed copy?

If your organisation needs this executed rather than accepted online, write to the privacy contact and ask. It will be signed by the entity named below.