Data processing agreement

1. Parties and roles

The association is the controller, and RTA Twirling & Events Ltd (company 17174281, 128 City Road, London EC1V 2NX), which runs twirlr, is the processor, for the information in the Schedule. For twirlr accounts, the app, the feed, safety on twirlr and twirlr’s own billing, twirlr is a separate controller under its Privacy notice.

2. What twirlr will do

• Process the information only on the association’s documented instructions, which are this agreement, the platform agreement and what the association’s staff do in the console (including asking Polly to do something). If an instruction appears unlawful, we will say so.
• Make sure everyone at twirlr who can see the information is bound by confidentiality.
• Keep the information secure with the measures in the Schedule.
• Use other processors (sub-processors) only as described in section 3.
• Help the association answer its members’ requests to exercise their rights, including subject access and deletion. The console includes tools for these.
• Help the association with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account what we know.
• Tell the association without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its information, with the details the association needs.
• When the agreement ends, delete or return the information as section 5 says.
• Make available the information needed to show we meet these duties, and allow audits under section 6.

3. Sub-processors

The association gives general permission for twirlr to use these sub-processors. We will give at least 30 days’ notice of any new one, by email to the association’s admins, and the association may object on reasonable data protection grounds. If we cannot meet the objection, the association may end the agreement. We impose the same data protection duties on each sub-processor and remain responsible for them.

4. International transfers

twirlr’s database is in London. Where a sub-processor processes information outside the UK, twirlr makes sure there is a lawful transfer mechanism under UK GDPR Chapter V: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment where needed.

5. Ending: return and deletion

Within 30 days of the agreement ending the association may ask for a copy of its information in a common format (provided by our team). After that, twirlr deletes the association’s information within 90 days, except where the law requires us to keep it, information members hold in their own twirlr accounts as controller-to-controller data, and backups, which are overwritten in their normal cycle and kept secure until then.

6. Audits

On reasonable notice, and no more than once a year unless there has been a breach or a regulator asks, the association may audit twirlr’s compliance with this agreement, first by written questions and documents, and if needed by an independent auditor bound by confidentiality, at the association’s cost.

7. twirlr staff access

A small number of twirlr staff with platform access can see association information, including safeguarding records, to provide support and keep the service running, and can sign in to the association’s console for up to an hour at a time. Each sign-in records who, when and why, in the association’s own audit log.

8. The association’s duties

The association confirms it has a lawful basis for the information it puts into twirlr and tells its members about it, including that twirlr and the sub-processors above process it. For health information and DBS records it confirms it meets the conditions in Article 9 and 10 UK GDPR and the Data Protection Act 2018, including an appropriate policy document where required.

Schedule: the processing