Data Processing Information (DPA)

1. Scope and roles

For your account and profile data we are the controller. For contact data you upload, you are the controller and we are your processor acting on your documented instructions, which include these Terms and your use of the product.

2. Subject matter, nature, and purpose

We process personal data to deliver the service's features: managing your profile and evidence, discovering vacancies, generating AI drafts, and organising outreach to your network.

3. Duration

Processing lasts while your account is active and for the retention periods described in the Privacy Policy.

4. Categories of data and data subjects

Identification and contact data, professional history and evidence, and the data of the contacts in your network that you choose to upload. The data subjects are you and the people in your network.

5. Our obligations as processor

• Process data only on your documented instructions.
• Ensure the confidentiality of authorised personnel.
• Apply appropriate technical and organisational measures.
• Assist you with data-subject requests and security.
• Delete or return data at the end, unless legally required to retain it.

6. Your instructions

We process data only to deliver the service and in line with your use. If an instruction would infringe data-protection law, we will tell you.

7. Confidentiality

Personnel with access to data are bound by confidentiality duties and access only what they need.

8. Security measures

• Encryption in transit.
• Per-workspace isolation.
• Access control and least privilege.
• Audit logging of security events.
• Backups and recovery procedures.

9. Sub-processors

We use the sub-processors listed on the dedicated page, under data-processing contracts. We will notify you of material changes so you can object on reasonable grounds.

10. Assistance

We help you meet data-subject requests (access, rectification, erasure, portability) through the product's export and deletion tools, and help you meet your security and impact-assessment obligations to a reasonable extent.

11. Breach notification

In the event of a security breach affecting personal data, we will notify you without undue delay with the information available to us so you can meet your obligations. Incidents: security@knownroute.com.

12. International transfers

Where a sub-processor handles data outside the EEA, we apply appropriate safeguards, such as the EU Standard Contractual Clauses.

13. Deletion or return

At the end of the service, we delete or return personal data on the retention schedule (purge after 30 days), unless legally required to retain it.

14. Audit

On reasonable request, we will provide the information needed to demonstrate compliance with these obligations, subject to confidentiality and security.

15. Signable DPA

This page summarises our processing commitments and is binding while you use the service. A separately signed Data Processing Agreement, with Standard Contractual Clauses where applicable, will be available once Nimavera completes incorporation; request one now at legal@knownroute.com and we will countersign as soon as the entity is formed.