This agreement forms part of the Terms of Service between you (the controller) and DILENS LTD (the processor) under Article 28 UK GDPR and EU GDPR.
1. Subject matter and duration
DILENS LTD processes personal data contained in your questionnaires, checklist, answers and trust page documents, and visitor requests on your trust page, only to provide SureQuill. The agreement lasts as long as your account exists.
2. Types of data and data subjects
Business contact data (names, email addresses, roles) of your employees, your customers' contacts named in questionnaires, and visitors who request documents on your trust page. No special categories of data are intended to be processed.
3. Our obligations
We process the data only on your documented instructions, which are given by your use of the service. People with access are bound to confidentiality.
We help you answer requests from data subjects and with security, breach notification and data protection impact assessments, as far as our processing is concerned.
We tell you without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting your data.
At the end of the service we delete the data as described in the Privacy Policy, unless the law requires us to keep it. You can export it beforehand in the settings.
We give you the information needed to show compliance and allow audits by you or an auditor you appoint, with reasonable notice and at your cost.
4. Subprocessors
You authorise the following subprocessors. We will tell you by email at least 30 days before adding or replacing one; you can object, and if we can't resolve the objection you can end the agreement.
Supabase Inc.: Database, file storage and sign-in (EU (Ireland)).
Railway Corp.: Application hosting (EU region).
Anthropic PBC: AI drafting of answers (questionnaire text and checklist) (USA).
Stripe Payments Europe Ltd.: Payments and receipts (EU (Ireland), USA).
Resend Inc.: Transactional emails (USA).
Hostpoint AG: Domain and support mailbox (emails you send to our support address) (Switzerland).
Functional Software Inc. (Sentry): Error tracking without customer content (EU (Germany)).
5. International transfers
Where data leaves the UK or EU, transfers are covered by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
6. Technical and organisational measures
Encryption in transit (TLS) and at rest.
Separation of customers by row-level security in the database; files in private storage, served only to the signed-in owner.
Admin access only with two-factor authentication; every admin view is logged.
No customer content in application logs or error reports.
Automatic deletion of questionnaires 30 days after delivery; deletion on request and on account deletion.
Questionnaire text is treated as untrusted input and never changes how answers are drafted.