This page summarizes the data processing terms that apply when Umi processes personal data on behalf of a customer. Enterprise customers receive a full, signed Data Processing Agreement ("DPA").
1. Roles
For the Service, the customer is the data controller (or processor acting under a controller) and Umi is the data processor. Umi processes personal data only to provide, secure and support the Service.
2. Scope
The DPA covers personal data the customer uploads to Umi Data and Umi Cowork, and the account data of the customer's users. Processing instructions are defined by the customer's use of the Service and the DPA.
3. Our commitments
As processor, Umi commits to:
- Process personal data only on the customer's documented instructions.
- Keep confidential personnel bound to confidentiality obligations.
- Apply technical and organizational measures appropriate to the risk, as described on our security page.
- Assist the customer in answering data subject requests and, where applicable, completing data protection impact assessments.
- Notify the customer without undue delay of any personal data breach.
- Delete or return personal data at the end of the agreement.
4. Subprocessors
We use the subprocessors listed on the subprocessors page. We inform customers of changes and allow customers to object to new subprocessors before they are used.
5. Cross-border transfers
Transfers outside the customer's region are covered by the mechanisms described in the Privacy Policy.
6. Audit
Customers on qualifying plans may request an audit of our processing once per year. We support reasonable security questionnaires as an alternative.
7. Getting the full DPA
The signed PDF version of the DPA is available to customers on request.