1. Roles
The customer is the controller (or “business”) for personal information in its workspace. We are the processor (or “service provider”) and act only on the customer’s documented instructions, which include the Terms, the customer’s configuration of the service (such as its Autotask connection and write scope) and its users’ actions in the service. We will not sell or share that information, or use it for any purpose other than providing the service.
2. What is processed
Purpose: providing ProjectSmith, including synchronising with the customer’s Autotask instance, project, time, leave, capacity and billing workflows, and support. Duration: the subscription, then until deletion 30 days after a workspace deletion request (audit records as in section 9). People: the customer’s staff and contractors, and the contacts of the customer’s clients held in Autotask. Data: names, work contact details, roles, time and leave records, and project and ticket content. Customers should keep leave reasons generic and not put sensitive information in the service.
3. Our people
Everyone with access to customer data, including through our administration portal and support mailbox, is engaged by us as an employee or contractor and is bound by confidentiality. Access is limited to what is needed, and any platform-level access to a workspace’s data requires a recorded reason and is written to the audit log.
4. Security measures
We maintain the technical and organisational measures described on the Security page: tenant isolation tested on every change, encryption in transit and at rest, secrets and encryption keys in Azure Key Vault (accessed by managed identity only), multi-factor authentication, audit logging, private networking for the production database and file storage, encrypted and geo-redundant database backups, and secure development controls.
5. Sub-processors
The customer authorises the sub-processors on our sub-processors page. Each is bound by data protection terms at least as protective as this DPA. We will give at least 30 days’ notice before adding or replacing a sub-processor, and the customer may object on reasonable data protection grounds; if we cannot address the objection, the customer may cancel.
6. Location and transfers
Workspace data is hosted in Microsoft Azure, Australia East, with encrypted backup copies in Microsoft Azure, Australia Southeast. We are a US company, and limited data is processed in other countries by our staff and by sub-processors (sign-in identity, billing, email delivery, the support mailbox and network traffic). Transfers of UK and EU personal data are covered by the EU Standard Contractual Clauses and the UK Addendum where they apply; the full DPA containing them is available on request from privacy@getprojectsmith.com. Transfers of Australian personal information are handled consistently with the Australian Privacy Principles.
7. Assistance
We will help the customer respond to requests from individuals exercising their privacy rights, and with privacy impact assessments and regulator enquiries, as far as is reasonable given the nature of the processing.
8. Personal data breaches
We will notify the customer without undue delay after becoming aware of a breach affecting the customer’s personal information, with the information the customer reasonably needs to assess it and meet its own obligations, and will cooperate to contain and remedy it.
9. Export and deletion
The workspace Owner can export the workspace’s data from the app at any time before deletion. When the Owner requests deletion, the workspace’s data is permanently deleted 30 days after the request. Backups are shared across all customers and cannot be purged for one customer, so deleted data stays in encrypted backups until they age out, for up to 12 months, and is never restored except for disaster recovery. Data in the customer’s own Autotask instance is unaffected.
Audit records are kept after a workspace is deleted, as our security and compliance record of what happened in the service. They can include names and email addresses. We keep them for as long as required for security, legal and compliance purposes, and at least 12 months.
10. Information and audits
We will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. If we obtain an independent audit report, we will share it under NDA.