Data processing agreement
This agreement applies when you (the controller) store personal data of other people, such as your clients and their owners, partners or shareholders, in Hawl, operated by Inner Core Studios (the processor). It is part of the terms of service.
1. Subject and duration
The processor processes personal data only to provide the service to the controller, for as long as the controller’s workspace exists, and then deletes it as described in clause 9.
2. What is processed
- Data subjects: the controller’s clients, the owners, partners and shareholders of their businesses, and the controller’s team members.
- Personal data: names, email addresses, ownership shares, business and financial data from trial balances, zakat results and payments, and notes.
- Special category: because zakat is a religious duty, the data can reveal a religious belief (GDPR art. 9).
3. Instructions
The processor processes the data only on the controller’s documented instructions, which are given through the use of the service and this agreement, unless the law requires otherwise; in that case the processor informs the controller first where the law allows.
4. The controller’s responsibilities
The controller ensures there is a lawful basis for the processing, including explicit consent of the data subjects where data reveals a religious belief, and informs the data subjects.
5. Confidentiality and security
Everyone at the processor with access to the data is bound to confidentiality. The processor takes appropriate technical and organisational measures, including encrypted connections, hashed passwords, encrypted keys, and access limited to the workspace’s members.
6. Sub-processors
The controller agrees to these sub-processors: Cloudflare (hosting and database, database located in Western Europe) and Resend (email delivery). Stripe processes billing data of the controller’s own account only. The processor tells the controller at least 30 days before adding or replacing a sub-processor, and the controller may object. The processor imposes the same obligations on sub-processors and remains responsible for them. Transfers outside the European Economic Area rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
7. Helping the controller
The processor helps the controller to answer requests from data subjects, and with security, data protection impact assessments and prior consultation where needed. Most requests can be handled in the service itself: data can be viewed, corrected, exported and deleted.
8. Data breaches
The processor informs the controller without undue delay, and within 48 hours of becoming aware of it, of a personal data breach affecting the controller’s data, with the information the controller needs to meet its own obligations.
9. End of the agreement
When the workspace is deleted, the processor deletes the controller’s personal data from the database straight away and from backups and the database history within 30 days, unless the law requires it to be kept. Before deleting, the controller can export the data.
10. Audits
The processor makes available the information needed to show compliance with this agreement, and allows audits by the controller or an auditor it appoints, at the controller’s cost, with reasonable notice and no more than once a year unless there has been a breach.
11. Liability
The limitation of liability in the terms of service applies, except where the law does not allow it to.