This agreement forms part of the terms of service and applies when apls.ai processes personal data on behalf of the Customer.
Roles
Customer is the controller (data fiduciary). apls.ai is the processor (data processor).
Instructions
We process Customer personal data only on Customer’s documented instructions, including settings configured in the workspace, unless the law requires otherwise.
Confidentiality
Our staff with access to Customer data are bound by confidentiality obligations and receive security and privacy training.
Security measures
A dedicated database per workspace with encrypted credentials, documents encrypted with a per-workspace key, encryption in transit, role-based access, audit logging, field masking, daily backups with restore tests, vulnerability management and an annual external penetration test.
Subprocessors
Customer authorises the subprocessors listed on our subprocessors page. We give 30 days’ notice of new subprocessors, and Customer may object on reasonable grounds.
Data subject requests
We provide tools in the workspace for access, correction, export and deletion requests, and help Customer respond to requests it cannot handle itself.
Personal data breaches
We notify Customer without undue delay, and within 48 hours of becoming aware of a breach affecting Customer data, with the information Customer needs to meet its own obligations.
Transfers
Where Customer data is transferred outside the selected region, we use appropriate safeguards such as Standard Contractual Clauses or the UK Addendum.
Audits
We make our security documentation available on request and allow one audit per year on 30 days’ notice, at Customer’s cost.
Return and deletion
On termination we make Customer data available for export for 30 days, then delete it from production systems, and from backups within a further 35 days.
Annex: data and data subjects
Data subjects: employees, contractors, candidates and their emergency contacts or dependants.
Categories: identity and contact details, employment and payroll data, attendance and location at check-in, documents, and where enabled, face templates for check-in.