Data Processing Addendum — summary
This page summarizes the Data Processing Addendum ("DPA") that MRSLM Group LLC, a Florida limited liability company, offers to customers who need one, for example under the GDPR or UK GDPR. The full DPA is available on request at legal@docsalive.com and becomes binding only when signed by both parties. If this summary and a signed DPA conflict, the signed DPA controls.
Roles
You are the controller of personal data in Customer Content. DocsAlive acts as your processor and processes that data only on your documented instructions, which means to provide the Service.
Our commitments
- Confidentiality: people authorized to process the data are bound by confidentiality obligations.
- Security: we maintain the measures described on our Security page, including isolated execution, deletion of checkouts after each run, encryption in transit and least-privilege access.
- Subprocessors: our current subprocessors are listed in the Privacy Policy. We'll give notice before adding or replacing one, and you may object on reasonable grounds.
- Assistance: taking into account the nature of processing, we'll reasonably assist you with data-subject requests, data protection impact assessments (DPIAs) and consultations with authorities.
- Breach notification: we'll notify you of a personal-data breach affecting your data without undue delay. We aim to do so within 72 hours of becoming aware of it, and will provide the information reasonably available to us.
- Transfers: where required, transfers rely on the Standard Contractual Clauses (plus the UK Addendum where relevant).
- Deletion: at the end of the Service, we delete Customer Content unless the law requires us to keep it. Checkouts are already deleted after every run, and Health Check reports after 90 days.
- Audits: we'll make available the information reasonably necessary to demonstrate compliance, and allow reasonable audits on reasonable notice, subject to confidentiality.
Targets
Timeframes in this summary other than those required by law are operational targets. Binding commitments are only those in a DPA signed by both parties.
Limitations
Liability under the DPA is subject to the limitations in our Terms of Service, to the extent permitted by law.