Data Processing Agreement

1. About this agreement

This Data Processing Agreement (“DPA”) is between Muon Core Ltd, a company registered in England and Wales under company number 09995817, with its registered office at 28 Angel Close, Dukinfield, England, SK16 4XA (“we”, “us”), and the organisation that uses Plait under our Terms of Service (“you”). If you use Plait on your own, your personal organisation is “you”.

It forms part of the Terms of Service and applies automatically whenever we process Customer Personal Data for you. You do not need to sign anything. If you need a signed copy for your records, email [email protected].

This DPA sets out the terms required by Article 28(3) of the UK GDPR.

2. Definitions

• Data Protection Law means the UK GDPR, the Data Protection Act 2018, and any other law of the United Kingdom about the processing of personal data that applies to the processing under this DPA.
• UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
• Customer Personal Data means personal data in your organisation’s workspace that we process on your behalf to provide the Service, as described in Annex 1.
• Service means the hosted Plait service at app.plait.run, as described in the Terms of Service.
• Sub-processor means another processor that we engage to process Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data”, “personal data breach” and “processing” have the meanings given in the UK GDPR.

3. Roles

For Customer Personal Data, you are the controller and we are your processor.

For personal data we use to run our own business, such as account and sign-in details, billing and support correspondence, service emails, and security logs, we are a controller. Our privacy policy covers that data, not this DPA.

Agents run on executors that you or your users operate, on machines you control, and call AI providers you choose with your own credentials. Processing on those machines, and by those AI providers, is outside the Service and is not processing by us under this DPA.

You are responsible for having a lawful basis for the Customer Personal Data you put into the Service, and for giving data subjects the information Data Protection Law requires.

4. Your instructions

We process Customer Personal Data only on your documented instructions, including for transfers outside the United Kingdom, unless the law of the United Kingdom requires us to do otherwise. If it does, we will tell you before we process, unless that law forbids us to on important grounds of public interest.

Your instructions are this DPA, the Terms of Service, and your use and configuration of the Service, including the actions of your users and agents in your workspace. Any further instruction must be in writing and consistent with the Terms.

We will tell you straight away if we believe an instruction breaks Data Protection Law.

5. Confidentiality

We make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, whether by contract or by law, and processes it only as needed to provide, support and secure the Service.

6. Security

We take appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. They are described in Annex 2. We may update them over time, but we will not reduce the overall level of protection.

7. Sub-processors

You give us general written authorisation to use sub-processors. Our current sub-processors are listed on our sub-processors page.

Before we add or replace a sub-processor, we will update that page and email the administrators of your organisation at least 14 days in advance. If you have reasonable grounds relating to data protection to object, tell us within that period. We will work with you in good faith to find a solution. If we cannot, you may stop using the Service and close your organisation’s workspace.

We impose data protection obligations on each sub-processor that give at least the same protection as this DPA. We remain responsible to you for each sub-processor’s performance of those obligations.

8. International transfers

We host the Service and its database in London, United Kingdom. Where a sub-processor processes Customer Personal Data outside the United Kingdom, we make sure the transfer is protected by one of the following:

• UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) for certified US companies;
• the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses, issued by the ICO under section 119A of the Data Protection Act 2018;
• another safeguard permitted under Chapter V of the UK GDPR.

The safeguard for each sub-processor is shown on the sub-processors page.

9. Helping you meet your obligations

Taking into account the nature of the processing and the information available to us, we will help you, by appropriate technical and organisational measures:

• respond to requests from data subjects exercising their rights. If we receive such a request directly about Customer Personal Data, we will pass it to you without undue delay and not respond ourselves, except to tell the person to contact you;
• meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with the ICO, under Articles 32 to 36 of the UK GDPR.

During the beta, much of this help is given by email rather than through features in the Service. Email [email protected].

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any event within 48 hours. We will send the notice to the administrators of your organisation.

The notice will describe, as far as we then know: the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures we have taken or propose to take. Where we cannot give all of this at once, we will give it in stages as we learn more.

We will take reasonable steps to contain the breach and reduce its effects, and we will co-operate with you so that you can meet any duty to notify the ICO or data subjects. Telling you about a breach is not an admission of fault or liability.

11. Deletion and return

When the Service ends for your organisation, or when you ask, we will delete Customer Personal Data from our live systems within 30 days. It ages out of our database backups within a further 7 days. Before deletion, you can ask us for a copy of your workspace data in a commonly used, machine-readable format.

We may keep Customer Personal Data longer only where the law of the United Kingdom requires us to. Any data we keep stays protected by this DPA.

12. Information and audits

We will make available to you the information reasonably needed to demonstrate that we meet our obligations under Article 28 of the UK GDPR. We will answer reasonable written security and data protection questionnaires once a year, or more often after a personal data breach or where the ICO requires it.

Where that information is not enough, we will allow audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality. You must give at least 30 days’ written notice, agree the scope with us in advance, and conduct the audit during normal business hours without disrupting the Service or other customers’ data. Each party bears its own costs.

13. Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, including the separate limit there for loss of content and personal data breaches caused by our failure to keep your content secure or by our breach of this DPA. Nothing in this DPA limits either party’s liability to data subjects or to the ICO where Data Protection Law does not allow it to be limited.

14. Term, precedence and changes

This DPA lasts for as long as we process Customer Personal Data for you, including after the Service ends until the data has been deleted under section 11.

If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA wins.

We may update this DPA to reflect changes in the law, guidance from the ICO, or changes to the Service. We will not reduce the protection it gives Customer Personal Data. We will give at least 30 days’ notice of any material change by email to the administrators of your organisation. This applies instead of the change terms in the Terms of Service.

15. Governing law

This DPA, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Security measures

• Hosting and location. The Service and its database run on DigitalOcean’s managed platform in London, United Kingdom. Managed database storage and backups are encrypted at rest by the provider.
• Encryption in transit. Connections to the Service, between the Service and executors, and between the Service and its database are encrypted with TLS.
• Encryption of credentials. Integration credentials and other secrets you store in the Service are encrypted in the database with AES-256-GCM, using a key held separately from the database.
• Authentication. Users sign in through external identity providers (such as Google, GitHub and Microsoft), through your organisation’s own OIDC single sign-on, or with a passkey. The Service stores no passwords. Sign-in sessions expire after 30 days without use and after 90 days in any case.
• Access control. Workspace data is separated by organisation, and access to it is restricted to that organisation’s members. Executors authenticate with their own credentials and can act only for the organisation they are registered to. Access to production systems is limited to Muon Core personnel who need it.
• Backups. The database is backed up daily, with point-in-time recovery, and backups are kept for 7 days.
• Software supply chain. Changes to the Service are reviewed and tested in continuous integration before release. Released container images and desktop builds are produced by automated build pipelines, not by hand.
• Security reports. We accept vulnerability reports at [email protected] and investigate them promptly.