GDPR

MatterMore acts as your processor. You are the controller and decide why and how personal data is processed.

Our data processing agreement covers the processor terms the GDPR requires. We act only on your documented instructions, bind our personnel to confidentiality, apply appropriate security measures, use sub-processors only with notice, and delete or return your data when the work ends. We provide the information you need to verify our compliance on request.

Our infrastructure runs on Google Cloud Platform. Any transfer outside the EEA uses the EU Standard Contractual Clauses and the UK Addendum. With customer-side hashing, direct identifiers never leave your environment.

Employees send requests to you. We act on your instructions to access, correct or erase their data, and you can exclude any employee from analysis.

We supply what your DPIA needs: a data flow diagram, an architecture diagram, a field-level data inventory and an employee notice template.

We notify you of any breach involving your data within 48 hours of discovery.

Nothing we deliver makes an automated decision about an individual. People make those decisions.

We collect no special category data, such as health, ethnicity, religion or union membership.