Data processing addendum

Roles

For data you upload, you are the controller and Statif is the processor. Statif is the controller of account and billing data it needs to run the service.

Scope of processing

Subject matter: statistical analysis of customer-supplied datasets. Duration: for the life of the account, plus the retention window. Nature: storage, parsing, computation, report generation. Data subjects and categories: as determined by you.

Instructions

Statif processes uploaded data only on your documented instructions, which are the actions you take in the product. We will tell you if an instruction appears to breach applicable data protection law.

Security measures

• Encryption in transit and at rest.
• Private storage buckets with per-owner access rules.
• Row-level security on every application table.
• Least-privilege administrative access with audit records.

Sub-processors

We use hosting, database, storage and email sub-processors under written contract. We will give notice before adding a new sub-processor that processes uploaded data.

Assistance

We will help you respond to data subject requests, carry out impact assessments and handle incidents. Personal data breaches affecting your data are reported to you without undue delay.

Deletion and return

On request or account closure, uploaded data and generated exports are deleted. Backups age out on their normal cycle.

Transfers

Where data leaves its region of origin, transfers rely on standard contractual clauses or an equivalent mechanism.