Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the creator or organisation using Inkwave ("Controller"), and us ("Processor"). It applies when we process personal data on your behalf, mainly the data of your subscribers, readers and site visitors, and is required by Article 28 of the GDPR and UK GDPR. It takes effect when you accept the Terms; no signature is needed.

Inkwave is operated by Bose and Turing Innovations FZCO, a free zone company registered in the United Arab Emirates under IFZA trade licence 54549, with its address at IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates.

Email: hello@inkwave.space

2. Details of the processing

• Subject matter and duration: providing Inkwave to you, for as long as you use it.
• Nature and purpose: storing, sending, hosting and analysing your publication, emails and website, and processing your readers' payments.
• Data subjects: your subscribers, paying members, commenters, website visitors and team members.
• Personal data: email address, name, profile picture, fields and tags you add, subscription and payment status, poll and survey answers, comments, email opens and clicks, IP address, user agent, country and pages viewed.
• Special categories: none are required. Do not collect them through Inkwave unless you have a lawful basis and appropriate safeguards.

3. Your responsibilities

You decide why and how your readers' data is used. You are responsible for having a lawful basis, including any consent needed to send email, use cookies or add third-party tracking tools to your site, and for giving readers a privacy notice.

4. Our obligations

• Process personal data only on your documented instructions, which are these Terms, this DPA and your use of Inkwave's settings, unless the law requires otherwise, in which case we will tell you unless the law forbids it.
• Ensure anyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 6.
• Help you respond to data subject requests, including through the reader export and erasure tools built into Inkwave.
• Help you with security, breach notification, impact assessments and consultations with authorities, taking into account the nature of the processing.
• Make available the information needed to show compliance with this DPA and allow audits as set out in section 9.
• Tell you if we believe an instruction breaks data protection law.

5. Sub-processors

You give general authorisation for us to use the sub-processors on our sub-processors page. We will give at least 30 days' notice of any new or replacement sub-processor. You may object on reasonable data protection grounds; if we cannot address the objection, you may end the affected service and get a pro-rata refund of prepaid fees. We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain liable for their work.

6. Security measures

• Encryption in transit with TLS for all traffic.
• Authentication through Clerk; we do not store passwords.
• Access tokens, privacy links and support sessions stored only as hashes.
• Signed tracking links and verified webhook signatures.
• Role-based access within publications; staff access to accounts is time-limited, authorised and logged.
• Separate private and public file storage.
• Rate limiting, abuse screening and monitoring of our systems.

7. International transfers

We are based in the United Arab Emirates and our sub-processors process data in countries including the United States, Canada and India. For transfers of personal data from the EEA, UK or Switzerland to countries without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module Two where you are a controller, Module Three where you are a processor) and the UK International Data Transfer Addendum, which are incorporated by reference. Clause 7 (docking) does not apply, the optional Clause 11 wording does not apply, and Clauses 17 and 18 are governed by the law and courts of Ireland. Annex I is section 2 of this DPA, Annex II is section 6, and Annex III is our sub-processors page.

8. Personal data breaches

We will notify you without undue delay, and within 48 hours where we can, after becoming aware of a breach affecting your data, with the information you need to meet your own obligations.

9. Audits

We will answer reasonable written questions about our compliance. If that is not enough, or a regulator requires it, you may audit us once a year with 30 days' notice, during business hours, at your cost and under confidentiality.

10. Deletion and return

You can export and delete your subscribers at any time. When your account ends, we delete your personal data within 30 days, and from backups when they expire, unless the law requires us to keep it.

11. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, except where the law does not allow them. If this DPA conflicts with the Terms, this DPA applies; if it conflicts with the Standard Contractual Clauses, the Clauses apply. Questions: hello@inkwave.space.