Roles and contract
You are the controller. We are the processor.
- Controller. You determine why and how personal data is processed.
- Processor. We act only on your documented instructions.
- Data processing agreement. We sign a DPA with the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum. We can work from your own DPA.
- Sub-processors. We list them at mattermore.ai/sub-processors. We give notice before we add one.
Who does what
Each duty has one owner.
| You (controller) | MatterMore (processor) |
|---|---|
| Set the purpose and lawful basis. | Process data only on your documented instructions. |
| Approve every field we receive. | Take nothing outside the approved inventory. |
| Run the DPIA and consult employee representatives. | Supply the diagrams and inventory both need. |
| Tell employees and answer their requests. | Supply the employee notice and act on your instructions. |
| Hold the hashing key and decide who sees named data. | Never store names, emails or employee IDs. |
Retention and deletion
We keep your data while the work runs.
| Moment | What happens |
|---|---|
| End of engagement | We delete your data within 30 days after it ends, or sooner if you set a shorter period. |
| Backups | Backups roll off on their normal schedule. |
| Product improvement | We may use aggregated, anonymized data that identifies neither you nor any individual. |
| Sale | We never sell customer data. |
Incidents
We notify you of any breach involving your data within 48 hours of discovery.