Data Processing Agreement

Last updated October 19, 2026

This page presents the customer data processing agreement in section 26 of our Terms and Conditions. It forms part of those terms when you accept them. The provisions below are the same agreement, with numbering adapted for this page. A separately executed agreement takes precedence as described below.

Our Privacy Policy explains how we handle account and service administration information. Acceptable-use rules are in section 12 of the Terms. For processing instructions, subprocessor details or a separately signed agreement, contact [email protected].

These terms form the data processing agreement between the customer identified in the service account or applicable order (‘Customer’) and ManyRows Pty Ltd (‘ManyRows’). They apply to personal data in Customer Content processed on Customer’s behalf under our Terms and Conditions. Customer is the controller, or an authorised processor acting for a controller; ManyRows is the processor or subprocessor respectively. A separately executed data processing agreement prevails where it conflicts with these processing terms. These processing terms prevail over the other service terms on the processing they cover.

1. Scope and duration

The subject matter is delivery of the hosted product data service. Processing includes collecting, organising, storing, retrieving, calculating, displaying, transmitting, backing up, correcting, restricting and deleting data to provide the features and support Customer instructs us to deliver. Processing lasts for the service relationship and the applicable return/deletion period below.

The people concerned may include Customer’s staff, contractors, collaborators, customers, suppliers and other people described in its records. Data types may include names, contact details, identifiers, assignments, comments, record and attachment contents, and authorship and change history. Customer chooses the content and purposes, must have authority and a lawful basis for its instructions, and must provide required notices. Before submitting special-category, criminal-offence or other specially regulated data, Customer must agree with us on its suitability and any additional safeguards.

2. Documented instructions

We process covered data only on Customer’s documented instructions, including for international transfers. Instructions consist of these terms, the applicable order, Customer’s authorised configuration and use of service features, and further written instructions accepted through support. We do not use this data for advertising, sale or model training. We promptly inform Customer if we consider an instruction to infringe applicable data protection law and suspend the affected instruction while it is resolved. Where Union or Member State law, or applicable UK law for UK processing, requires processing outside the instructions, we inform Customer of that requirement before processing unless that law prohibits notice.

3. Confidentiality and security

We ensure that people authorised to process covered data are bound to confidentiality, receive appropriate training and have access limited to their duties. We implement and maintain technical and organisational measures appropriate to the risks under Article 32, including access controls and tenant isolation, encryption in transit, protection of credentials and stored data, logging and incident handling, vulnerability management, backup and recovery procedures, and regular assessment of those measures. We do not materially reduce the overall protection during the service relationship.

4. Subprocessors

Customer gives general written authorisation to use the hosting, storage and transactional delivery providers identified in section 5 of the Privacy Policy for the covered processing. Payment providers acting independently and customer-selected recipients are distinguished there. We provide the actual subprocessor identities, functions and processing locations on request and keep that information current.

We notify Customer’s registered administrative contact at least 30 days before adding or replacing a subprocessor for covered data, giving an opportunity to object on reasonable data protection grounds. We work to resolve a timely objection; if we cannot, Customer may terminate the affected service before the change and receive a refund of prepaid unused fees for that affected service. We impose equivalent applicable data protection obligations on each subprocessor by written contract and remain responsible to Customer for its performance.

5. Assistance and requests

Taking account of the nature of processing and available information, we assist Customer through appropriate technical and organisational measures with individual rights requests and its obligations under Articles 32–36, including security, breach notifications, impact assessments and prior regulatory consultation. We promptly forward requests concerning covered data to Customer and act on its instructions unless applicable law requires otherwise. Customer’s authorised contact can request assistance at [email protected]. Automatic exports supplement the reviewed response and do not define its legal scope.

6. Personal data breaches

We notify Customer without undue delay after becoming aware of a personal data breach affecting covered data. We provide the nature of the breach, affected categories and approximate numbers where known, a contact point, likely consequences, and containment or mitigation measures. We supply further information in phases when necessary, cooperate with Customer’s assessment and response, and document the incident and corrective actions.

7. Return and deletion

At the end of processing, at Customer’s choice we return or delete covered personal data and delete existing copies unless Union or Member State law, or applicable UK law for UK processing, requires storage. Customer may use available exports and request assistance for data or evidence outside those exports. The standard lifecycle in section 13 of the Terms and Conditions applies unless a valid instruction or applicable agreement requires different handling. Any required retention is limited to its lawful purpose and protected from unrelated use.

Backup data awaiting scheduled expiry is isolated from ordinary use and remains protected by these terms. We reapply erasures, restrictions and revocations before restored data returns to service. On request we confirm completion, applicable backup expiry and any lawfully retained categories. Revoking credentials alone is not fulfilment of a deletion instruction.

8. Information and audits

We make available information needed to demonstrate compliance with these processing obligations and allow and contribute to audits and inspections by Customer or an auditor it appoints. We coordinate scope, confidentiality and reasonable scheduling to protect other customers and service security. Those arrangements do not prevent a necessary audit, restrict a regulator’s powers or delay an urgent response to a suspected breach.

9. International transfers and mandatory rights

Restricted international transfers require an applicable adequacy decision or valid transfer safeguards, with assessments and supplementary measures where necessary. We cooperate in executing the appropriate European Commission Standard Contractual Clauses and UK transfer instrument where required; these processing terms do not themselves replace or execute those instruments. Details and copies of applicable safeguards can be requested through our privacy contact, with confidential information protected.

Nothing in these terms limits rights or remedies of individuals or supervisory authorities under applicable data protection law, or overrides mandatory transfer clauses. These processing obligations continue while we or our subprocessors retain covered data.