Data Processing Terms

These terms form part of the Terms of Service between the producer using Pourline (the producer) and Mayrose Future Company Limited, company number 724698, registered office 11 Shandon Park, Monkstown, Co. Dublin, A94 R265 (we). They set out how we handle personal data in the producer's business records on the producer's behalf, as Article 28 of the GDPR (and of the UK GDPR) requires. Using Pourline means agreeing to them. A signed copy is available on request from enquiries@mayrosefc.com.

1. Roles

For personal data in the producer's business records, the producer is the controller and we are the processor. The details of the processing are in Annex 1.

2. Instructions

We process that personal data only on the producer's documented instructions. The Terms of Service, these terms, and the producer's use and settings of Pourline (including switching connections on or off) are those instructions. We tell the producer straight away if we believe an instruction breaks data protection law. Where the law requires us to process data otherwise, we tell the producer first, unless the law forbids it.

3. Confidentiality

Everyone we allow to handle the producer's personal data is bound by confidentiality, and only those who need access to run, support or secure Pourline get it.

4. Security

We keep appropriate technical and organisational measures in place to protect the personal data, as Article 32 requires. The measures in place today are in Annex 2. We may improve them, but we won't reduce the overall level of protection.

5. Sub-processors

The producer gives us general authorisation to use the sub-processors in Annex 3. We tell producers by email at least 30 days before adding or replacing one. A producer may object on reasonable data protection grounds within that time; if we can't resolve the objection, the producer may end the agreement without penalty. We put data protection terms in place with each sub-processor that protect the data at least as well as these terms, and we remain responsible to the producer for their work.

6. Transfers outside the EU and UK

We keep each producer's records in its own region: the United States (Ohio) for US producers, and the European Union (Ireland) for Irish and UK producers. Where a sub-processor outside the EU or UK can reach personal data, the transfer is covered by the European Commission's Standard Contractual Clauses (the appropriate module), or the EU-US Data Privacy Framework where the sub-processor is certified, together with the UK International Data Transfer Addendum for UK data.

7. Helping the producer

We help the producer, as far as we reasonably can, to answer requests from people exercising their data protection rights, to keep the data secure, to deal with personal data breaches, and with any data protection impact assessment or consultation with a supervisory authority that concerns Pourline. If someone sends us a request about the producer's records, we pass it to the producer and don't answer it ourselves unless the producer asks us to.

8. Personal data breaches

If we become aware of a personal data breach affecting the producer's data, we tell the producer without undue delay, and aim to do so within 48 hours, with what we know: what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We keep adding information as we learn it, so the producer can meet its own duty to report within 72 hours where the law requires.

9. At the end

When the agreement ends, we give the producer an export of its records on request, in a common format, within the following 30 days, and then delete the producer's personal data from Pourline. Backup copies are overwritten within a further 30 days. We keep nothing unless the law requires us to, and then only for as long as it requires.

10. Information and audits

We give the producer the information it reasonably needs to show that these terms are met. A producer may audit our compliance, once a year or after a personal data breach, with 30 days' notice, at its own cost, by a qualified auditor bound by confidentiality. We may answer first with documents and certifications where they cover the question.

11. Liability and order of precedence

Liability under these terms is subject to the limits in the Terms of Service, except where the law does not allow a limit. On a data protection point, these terms take precedence over the Terms of Service.

Annex 1. Details of the processing

Annex 2. Security measures

• Encryption in transit (HTTPS) everywhere, and at rest in the database.
• Each producer's records walled off from every other producer's by row-level rules in the database itself, checked by automated tests on every change before it can go live.
• Sign-in by personal work email with a one-time code; access limited to the people the producer sets up; deleting records limited to the producer's administrator.
• Every change to an order and its lines logged with who made it and when.
• Connection keys for connected systems held on the server, in a part no user, browser or page can reach.
• Two-step sign-in on every account that runs Pourline (database, hosting and code).
• Pourline's pages load no fonts, code or tracking from third parties.
• Development and testing use made-up data only, and we don't put producers' customer or contractor details into AI tools.

Annex 3. Sub-processors