Data processing agreement

This data processing agreement ("DPA") is between the customer organisation that holds the Reachcanon account (the controller, "you") and Nimavera Inc. (in formation) (the processor, "we"). It forms part of the terms of service, applies automatically to every account from the moment personal data is processed, and needs no separate signature. If the two conflict on the processing of personal data, this DPA prevails.

It covers personal data we process on your behalf when providing the service ("customer personal data"). For your users' account data — name, email, sign-in and billing records — we are an independent controller, as the privacy notice explains.

Subject matter and purpose: crawling and testing the websites you nominate for accessibility, storing the results as evidence, sending the alerts you ask for and drafting statements. Nature: collection, storage, structuring, retrieval, transmission and erasure, by automated means. Duration: the term of your account, plus the deletion periods below.

Data subjects: your team members, and any person whose data appears on pages you have Reachcanon scan. Categories of data: names and work email addresses of team members; page titles, URLs and HTML snippets of up to 600 characters, which can contain names or contact details published on your site; and the session cookie or bearer token you supply for scanning behind a sign-in. No special categories of data are needed, and you should not point the scanner at pages that display them.

We process customer personal data only on your documented instructions — these terms, your settings and what you do in the product — including for transfers outside the EEA, unless the law requires otherwise, in which case we tell you first where the law allows. We tell you if we believe an instruction breaks data protection law. Everyone authorised to process the data is bound by confidentiality. We do not sell it, use it for advertising, or use it to train any model.

Taking into account the nature of the processing, we help you respond to requests from data subjects and meet your obligations on security, breach notification, impact assessments and prior consultation (Articles 32 to 36 GDPR). We make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits: we answer a reasonable written audit request once in any twelve months, or after a personal data breach, at your cost, with reasonable notice and without access to other customers' data.

Encryption in transit with TLS on every connection. Credentials you supply for scanning behind a sign-in are encrypted at rest with AES-256-GCM, are used only by the scan worker, and are never shown back in full. Passwords are stored only as bcrypt hashes; two-step verification is available to every user and required for our platform administrators. Each workspace's data is separated at the query level, and access by our staff is limited to what support and operations need and is recorded in an audit log. Database backups are taken daily, encrypted with AES-256-GCM before any copy leaves the server, kept for fourteen days and restore-tested.

The scanner identifies itself in its user agent, honours robots.txt, rate-limits its requests, does not submit forms or click controls, takes no screenshots and records no video. We are not certified to ISO 27001 or SOC 2 and do not suggest otherwise.

You give general authorisation for the sub-processors listed at /legal/subprocessors. We bind each one by written terms giving the same level of protection as this DPA, and remain responsible to you for their performance. We give at least 30 days' notice by email before adding or replacing one; if you object on reasonable data protection grounds and we cannot address the objection, you may terminate the affected service and we will refund any fees paid for the period after termination.

The application, the database and the backups are hosted in the European Union. Nimavera Inc. (in formation) is established in the United States, and some sub-processors are too (Cloudflare, Resend, Stripe). Where customer personal data is transferred to, or accessed from, a country without an adequacy decision, the transfer relies on the European Commission's standard contractual clauses (Decision (EU) 2021/914) — module 3, processor to processor, with our sub-processors, and module 2, controller to processor, between you and us, which are incorporated into this DPA by reference — together with the supplementary measures described above, such as encryption of credentials and backups. Where a recipient is certified under the EU–US Data Privacy Framework, that adequacy decision may be relied on instead.

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice goes to the workspace owners' email addresses and describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed; we add to it as we learn more. Notifying you is not an admission of fault.

You can export your scans, findings and statements as CSV or JSON at any time, which is how data is returned. Deleting a site deletes its scans, findings, statements and stored credentials at once. When the last member of a workspace deletes their account (Profile), the workspace and everything in it are deleted from the live system at once; customer personal data then leaves the backups as they expire, fourteen days later at most. The audit record that actions took place is kept, detached from the deleted workspace, and invoices are kept by Stripe and by us as tax law requires.

Each party's liability under this DPA is subject to the limitations in the terms of service, except where the GDPR or other mandatory law does not permit them. Nothing in this DPA limits the rights of data subjects. If your procurement needs a countersigned copy, write to support@reachcanon.com and we will sign this text.