Data Processing Agreement

This agreement (“DPA”) is between your firm (“you”, the controller) and Elargi (“we”, the processor). It is part of our Terms and applies automatically whenever you use Elargi, so there is nothing to sign. It sets out the terms required by Article 28 of the UK GDPR and the EU GDPR. If you need a signed copy for your records, email hello@elargi.com. Where this DPA and the Terms differ on personal data, this DPA wins.

1. What we process, and why

• Purpose: to let you request, collect, review, store and delete documents and information from your clients, and to send the requests and reminders you set up.
• People concerned: your clients and any second contact you add for them, people who use your public sign-up link, and your team members.
• Data: names, email addresses and phone numbers you enter or clients give; the files clients upload (which may include financial, tax and identity documents); their written answers and messages; and for e-signatures, the typed name, time, IP address and browser.
• Duration: while you have an account, plus up to 30 days for backups to expire after data is deleted.

2. Your instructions

We process this data only on your documented instructions. How you use Elargi (the requests you create, the settings you choose, the files you delete) is your instruction. We don’t use the data for anything else, unless the law requires it; if so, we’ll tell you first unless the law forbids that. If we think an instruction breaks data protection law, we’ll tell you.

3. Confidentiality and security

Everyone at Elargi who can access the data is bound by confidentiality. We keep the technical and organisational measures described on our Security page (encryption in transit and at rest, access limited to your account, two-factor sign-in, backups, deletion). We may improve them but won’t reduce the overall level of protection.

4. Sub-processors

You authorise us to use the providers listed on our Security page. We’ll email you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, we’ll try to resolve it; if we can’t, you can cancel your subscription before the change. Each sub-processor is bound by data protection terms that protect the data at least as well as this DPA, and we remain responsible to you for its work.

5. Transfers outside the UK and EU

Your data is stored in the EU. Some sub-processors (for example, the email provider) process it in the USA. Those transfers rely on the safeguards UK and EU law require, such as standard contractual clauses with the UK addendum, or the EU-US Data Privacy Framework and its UK extension where the provider is certified.

6. Helping you

• Requests from your clients: Elargi lets you find, export and delete a client’s data yourself. If a client contacts us directly, we’ll pass the request on to you and help you answer it.
• Breaches: if we become aware of a breach affecting your data, we’ll tell you without undue delay and within 48 hours, with what we know and what we’re doing about it, so you can meet your own 72-hour reporting deadline.
• Assessments: we’ll give you reasonable help with data protection impact assessments and with consulting a regulator.

7. Audits

We’ll give you the information you reasonably need to show that this DPA is being followed, and answer reasonable security questionnaires. If that isn’t enough, you or an auditor bound by confidentiality may audit us once a year with 30 days’ notice, at your cost.

8. When you leave

Before closing your account you can export your data and download each request’s files. When you delete your account, we delete your clients’ data straight away; copies in backups are gone within 30 days, unless the law requires us to keep something.

Operator note: set VITE_LEGAL_NAME and VITE_LEGAL_COUNTRY so this agreement names the processor and where it is run from, and have it reviewed before relying on it.