Data Processing Agreement

1. Roles

You are the controller of the personal data your firm and your clients put into Reqmora. Reqmora is your processor. For your own account, billing and staff login details, Reqmora acts as a controller under its Privacy Policy.

2. What we process

• Subject matter and purpose: collecting documents and answers from your clients, sending them requests and reminders, and showing your team what has arrived.
• Data subjects: your clients and their contacts, and people named in the documents your clients upload.
• Types of data: names, email addresses, phone numbers, business details, answers to your questions, and the contents of uploaded files. These may include financial information such as bank statements, payslips, invoices and receipts. Reqmora is not designed for special category data, and you should not ask clients to upload it.
• Duration: for as long as you use Reqmora, subject to the deletion rules in section 8.

3. Our obligations

• We process personal data only on your documented instructions. Your use of Reqmora, your settings, and these terms are your instructions. We will tell you if we believe an instruction breaks data protection law.
• Everyone at Reqmora who can access personal data is bound by confidentiality.
• We never sell personal data or use it for advertising, and we only use it to provide Reqmora.

4. Security

We keep appropriate technical and organisational measures in place, described on our Security page. They include:

• Encryption in transit (HTTPS/TLS) and at rest.
• Row-level security so each firm can only access its own records.
• Private file storage, served only through signed links that expire after 10 minutes.
• Checks on uploaded files, removing anything that looks like a program or script.
• A history of actions on every request, owner and member roles, and two-factor sign-in that owners can require.
• Automatic deletion of uploaded files after the retention period you choose.

5. Sub-processors

You authorise us to use the sub-processors below. Each is bound by written data protection terms at least as protective as this DPA, and we remain responsible for them.

We will email account owners at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that time. If we can't address the objection, you may cancel and receive a pro-rata refund of any prepaid fees for the unused period.

6. International transfers

Reqmora is operated from Sri Lanka, and personal data is stored in Singapore and handled by the providers listed above, some of which are in the United States. Where personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor), together with the UK International Data Transfer Addendum and the Swiss adjustments where they apply. Those clauses are incorporated into this DPA by reference, with you as data exporter and Reqmora as data importer. We use the same safeguards, or an adequacy decision or data privacy framework, with our sub-processors.

7. Helping you meet your obligations

• Data subject requests: you can view, correct, export and delete your clients' data from the dashboard. If a request reaches us directly, we'll pass it to you, and we'll help with anything you can't do yourself.
• Personal data breaches: we will notify account owners without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with the information you need to meet your own reporting duties.
• Impact assessments: we will give reasonable help with data protection impact assessments and consultations with supervisory authorities that relate to Reqmora.

8. Deletion

Uploaded files are deleted after the retention period you choose (30, 60 or 90 days). When your account is deleted, or 30 days after a trial or plan ends without renewal, we erase all personal data we process for you. Copies in our providers' encrypted backups are overwritten on their normal backup cycle. Download anything you need to keep before deletion.

9. Audits

On request, we will provide the information reasonably needed to show that we meet this DPA, including written answers to security questionnaires. If that is not enough to satisfy a supervisory authority or the law, we will allow a reasonable audit, at your cost, with at least 30 days' notice, no more than once a year, and under confidentiality.

10. General

The limits of liability in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms, this DPA wins on data protection matters, and the Standard Contractual Clauses win over both. We may update this DPA to reflect changes in law or in our sub-processors, and will email account owners about material changes before they take effect.