Data processing agreement

This agreement is part of the terms of service. It applies when your requests to the Onde API contain personal data of your users. For this data, you are the controller and Alatus Labs is your processor under Article 28 of the GDPR.

Your account data is not part of this agreement. We are its controller, and the privacy policy covers it.

The processing

• Data subjects. The people who use your products.
• Personal data. The search text and the positions in your requests, and the IP address of a browser that sends a request with a public key.
• Purpose. To answer each request and to apply the rate limits.
• Duration. The processing ends with each response. The rate limit keeps an IP address in memory, for a few minutes after its last request. The API stores no search text, positions, or IP addresses, and does not write them to its log. Our hosting provider writes the IP address of each request to its log, and deletes the log after 30 days.

Our obligations

• We process the data only to answer your requests. Your requests and these terms are your instructions.
• Only people who must operate the service have access, and they must keep the data confidential.
• All requests use HTTPS. Apart from the hosting log, the API keeps the data in memory only.
• We use subprocessors only in the categories that the privacy policy lists, and we name them on request. We tell you by email before we add or replace a subprocessor, and you can object. If we cannot resolve your objection, you can end this agreement when you delete your account. We bind each subprocessor to the same data protection obligations as this agreement.
• Transfers to the United States occur under the EU-US Data Privacy Framework or under the Standard Contractual Clauses.
• We tell you without undue delay when we know of a personal data breach that affects your data.
• We help you to answer requests from data subjects, and we give you the information that you need to show compliance with Article 28. Apart from the hosting log, we store no data from requests, so we have no such data to give or delete.

End of the agreement

The agreement ends when you delete your account. No data from your requests stays to return or delete. The hosting log expires after 30 days.

Contact

Email [email protected].