Data processing terms.

These terms are part of the terms. They apply when the content you put into a workspace includes personal data and a data protection law, such as the GDPR or the UK GDPR, requires a written agreement between you and us.

For that content you are the controller and Media Yard LLC is your processor. For your own account details, such as your email address and billing reference, we are the controller, and the privacy notice applies.

Subject matter and purpose: running Campaign Fleet for you: reading your site, storing facts and drafts, checking them, and sending email you ask for.

Kinds of data: whatever your site and your workspace contain. Usually that is product information with little or no personal data. It may include names or contact details that appear on your pages, and the address a test email is sent to.

Whose data: people named on your public pages, and you.

How long: until you delete the workspace or your account.

Do not put special categories of personal data, such as health information, into a workspace. The product is not built for it.

We process the data only to provide the product and only on your instructions, which are these terms and what you do in the app. If the law requires us to do otherwise, we will tell you first unless the law forbids it.

Only the people who run the service can reach the data, and they are bound to keep it confidential.

We will help you answer requests from people exercising their rights, and help with assessments and regulator enquiries about this processing, as far as we reasonably can.

If we become aware of a breach affecting your data, we will tell you without undue delay, with what we know about what happened and what we are doing.

Each workspace’s rows can be read only by its members; that rule is enforced by the database itself and covered by automated tests.

All traffic is encrypted in transit. Access keys are stored only as a fingerprint. The credentials for the companies we use are held by our host and never in the code.

Every step an agent or a key takes is written to a ledger that cannot be edited.

We do not hold a security certification such as SOC 2 or ISO 27001.

You agree that we may use the companies listed on the subprocessors page. Each of them has data processing terms that form part of our agreement with it and include the standard contractual clauses. The links are on that page.

Before adding one we will update that page and email account holders at least 14 days ahead. If you object and we cannot resolve it, you may cancel.

The data is stored and processed in the United States. Where the law requires a safeguard for that transfer, the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 form part of these terms, with you as exporter and us as importer. For transfers from the United Kingdom they apply as amended by the UK International Data Transfer Addendum, version B1.0.

Module Two (controller to processor) applies. The optional docking clause and the optional redress wording are not used. For other companies, the general authorisation in clause 9 applies, with the notice period given above. The clauses are governed by the law of Ireland and disputes go to the courts of Ireland; for UK transfers, the law and courts of England and Wales.

The details the clauses’ annexes ask for are in these terms: the parties are you and Media Yard LLC; the processing is described under “What is processed, and why”; the security measures are under “How the data is protected”; the other companies are on the subprocessors page. The supervising authority is the one for the place where you are established.

By agreeing to the terms you and we are treated as having signed the clauses. If you need a countersigned copy, write to legal@campaignfleet.com.

On request, and no more than once a year unless there has been a breach, we will answer reasonable written questions about how we meet these terms.

You can delete a workspace, or your whole account, on the Account screen. It happens at once and we keep no copy, apart from what the law requires us or our payment provider to keep.

If these terms and the main terms disagree about personal data, these terms win.