This sets out how aiylum processes personal data on a firm's behalf. It supplements the terms of service and, where the two disagree about processing, this wins.
The roles
The firm is the controller of its clients' personal data. aiylum is the processor. We process only on the firm's documented instruction, and using the product is the instruction – every act the product performs is one the firm asked for by configuring or operating it.
Where we are required by law to process something the firm has not asked for, we tell them first unless the law forbids it.
Subject matter and duration
Running immigration matters: holding case files, tracking dates, exchanging messages and documents with clients, and producing work product. For as long as the firm is a customer, plus the retention window.
The people and the data
Clients of the firm, their family members where the matter involves them, and the firm's own staff. Identity and contact data, immigration history, documents, case notes, correspondence, and payment records. Frequently special category data, because asylum matters concern religion, politics, sexual orientation and health by their nature.
What we undertake
Confidentiality. Everyone with access is bound by it.
Security. Encryption in transit and at rest, per-subject key material for identifying fields, role-based access inside a firm, hard tenant separation between firms, an append-only audit ledger, scanned uploads, and regular review of all of it. The security page describes the arrangement.
Assistance. We help the firm answer data subject requests, and we help with impact assessments and regulator correspondence.
Breach notification. Without undue delay after becoming aware, with what we know at the time rather than after an investigation completes.
Deletion or return. At the end, the firm chooses. Deletion destroys the key material, which is what makes the encrypted data unrecoverable.
Audit. The firm may audit, on reasonable notice. We will answer a questionnaire, provide what documentation we have, and arrange a call with an engineer.
Sub-processors
Listed on the subprocessors page, with what each does. We give notice before the list changes, and a firm may object.
Every sub-processor is bound to terms no weaker than these, and we remain answerable to the firm for what they do.
Transfers
Data is held in the United States. Where a firm is subject to a regime that restricts transfers out of it, we will put the appropriate mechanism in place – standard contractual clauses, the UK addendum, or a data localisation arrangement – and we will say honestly whether we can support the last of those before a firm commits.
Instructions that would be unlawful
We will not follow one, and we will say why.
---
*This page describes how the product is built and is written by the people who built it. It has not been reviewed by outside counsel, and it is not yet the executable addendum – ask us for the paper version before you rely on it.*