How we process your organisation's data

Roles

Your organisation is the controller of personal data in its workspace. TheHyWing Ltd is the processor and acts only on your documented instructions: the terms, this agreement and your use of the application's settings.

Scope of processing

We process workspace data only to provide, secure and support Erikiimo.

• Data subjects: your members, invitees, alert recipients and people named in your records.
• Data: names, work email addresses, phone numbers for alerts, roles, facility addresses and coordinates, and anything your users enter or upload.
• Duration: while your workspace is active, then as set out under Return and deletion.

Our commitments

We will:

• Process personal data only on your instructions, and tell you if we believe an instruction breaks the law.
• Make sure everyone with access is bound by confidentiality.
• Keep data encrypted in transit and at rest, isolate each workspace, scan uploads for malware, log access and test backup restores.
• Help you answer data subject requests and carry out impact assessments where needed.
• Notify you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting your workspace.

Sub-processors

You authorise us to use the sub-processor categories listed in our privacy policy. Each is bound by written terms at least as protective as this agreement, and we remain responsible for them.

The current named list is available from support@erikiimo.io. We will give at least 14 days' notice of a new sub-processor, and you may object on reasonable data protection grounds.

International transfers

Workspace data is stored in the United Kingdom and the European Union. Any transfer outside Nigeria relies on safeguards recognised by the Nigeria Data Protection Act 2023 and other applicable law.

Audits

On request, once a year, we will provide written answers and evidence about our security controls. Further audits can be agreed in writing at your cost and with reasonable notice.

Return and deletion

Administrators can export workspace records at any time. When a workspace is closed, we delete or anonymise its data within 30 days, unless the law requires us to keep it. Encrypted backups expire within 35 days.

Order of precedence

If this agreement conflicts with the terms of service about personal data, this agreement applies.

Contact

Email support@erikiimo.io.