This agreement applies when Sway SRL ("the processor") processes personal data on behalf of a customer ("the controller") through openshield. It is part of the terms of service and meets article 28 of the General Data Protection Regulation (GDPR). It starts when the customer creates an account and lasts as long as the customer uses the service.
1. What is processed
- Subject: the moderation of images and texts that the controller sends to the API.
- Nature: automatic analysis in memory, which returns a decision and the reasons for it. Nothing in the content is kept.
- Purpose: to return the moderation result to the controller, and for no other purpose.
- Types of personal data: whatever the content holds, which the controller decides: faces and bodies in images, names, contact details or any other personal data in texts, and the optional reference (the
reffield) the controller attaches to a check. The processor does not ask for, and does not need, special categories of data, but moderated content can hold them. - Data subjects: the controller's users, and anyone who appears in the content.
- Duration: the content is forgotten when the answer has been sent. The result of each check (never the content) is kept in the decision journal for 7 days on the free plan and 30 days on paid plans, so that the controller can read it.
2. Instructions
The processor processes personal data only on the controller's documented instructions, which are these terms, the use of the API and the dashboard, and the settings the controller chooses (such as its workflows). If the processor thinks an instruction breaks data protection law, it tells the controller. Where the law requires the processor to process data otherwise, it tells the controller first, unless the law forbids it.
3. Confidentiality
The processor makes sure that the people who may process the data are bound by confidentiality.
4. Security (article 32)
The processor takes the technical and organisational measures that fit the risk, including:
- content is processed in memory only, with no copy kept in logs, queues or storage;
- connections are encrypted, and the systems of the service talk to each other through signed requests;
- API keys are stored as hashes, and a key is shown only once;
- account owners must use two-factor authentication before starting a paid plan;
- data at rest is stored in the European Union;
- access to the service's systems is limited and logged;
- abuse protection on the API and on sign-in forms.
5. Sub-processors
The controller gives a general authorisation for the sub-processors on the sub-processors page. The processor binds each of them by a contract that gives the same level of data protection as this agreement, and remains responsible for them towards the controller.
The processor tells the controller by email at least 30 days before it adds or replaces a sub-processor. The controller may object on reasonable grounds related to data protection within that time. If the parties cannot agree, the controller may end the subscription before the change takes effect, without any charge.
6. International transfers
Data at rest stays in the European Union. Some sub-processors are United States companies and handle requests outside the European Union. Those transfers rely on the EU-U.S. Data Privacy Framework, with the standard contractual clauses of the sub-processor's terms as the fallback. The privacy policy gives the detail.
7. Assistance
Taking into account the nature of the processing, the processor helps the controller:
- answer requests from data subjects (access, erasure and the other rights of chapter III of the GDPR). Because content is not kept, there is usually nothing to find; the processor says so, and helps with the journal;
- meet its duties on security, breach notification, impact assessments and prior consultation (articles 32 to 36), with the information it has.
8. Personal data breaches
The processor tells the controller of a personal data breach that concerns the controller's data without undue delay, and in any case within 48 hours of becoming aware of it, with what it knows: what happened, which data, the likely effects and the measures taken. It keeps a record of each breach, as article 33(5) requires.
9. Deletion and return
Content is not kept, so there is nothing to return. The controller can export its workflows, journal and usage from the dashboard. When the controller deletes its organization, its data stays available for 30 days so that it can take it out, and is then erased. Invoices and accounting records that the law makes us keep are the exception, and the processor handles them as controller.
10. Audits
The processor gives the controller the information needed to show that it meets article 28, and allows audits, including inspections, by the controller or by an auditor the controller appoints, once a year, with 30 days' notice, at the controller's cost and under confidentiality.
11. Contact
Sway SRL, Clos des Colombes 23, 1342 Limelette, Belgium. Email: contact@sway.events.