This Data Processing Addendum ("DPA") supplements the Master Services Agreement between Morsegrid and Customer and applies whenever Morsegrid processes Personal Data (as defined in applicable Data Protection Laws) on behalf of Customer in connection with the Morsegrid product.
Roles of the parties
For Personal Data routed through the product, Customer is the Controller (or Processor, where Customer acts on behalf of a third party Controller) and Morsegrid is the Processor (or Sub-Processor). Each party will comply with the obligations applicable to it under Data Protection Laws.
Scope and instructions
Morsegrid will process Personal Data only on documented instructions from Customer, including with regard to international transfers, except where required to do so by applicable law. The MSA, the Order Form, and configuration choices made within the product constitute Customer's documented instructions.
Confidentiality
Morsegrid ensures that personnel authorized to process Personal Data are subject to written obligations of confidentiality that survive termination of their engagement.
Security measures
Morsegrid does not host Customer data. Its measures are least-privilege access to Customer systems, credentials that stay under Customer's control and that Customer can revoke at any time, and documented handover of every automation. These are described in the Trust Center at /security.
Sub-processors
Customer authorizes Morsegrid to engage the Sub-Processors that Morsegrid provides to Customer on request. Morsegrid will notify Customer at least 30 days in advance of any addition or replacement, and Customer may object on reasonable data protection grounds.
Data subject rights
Morsegrid will provide commercially reasonable assistance to enable Customer to respond to data subject requests, including via product features that allow Customer to access, correct, delete, or export Personal Data.
Personal Data Breach notification
Morsegrid will notify Customer without undue delay, and in any event within 24 hours, of becoming aware of a confirmed Personal Data Breach affecting Customer's Personal Data, and will provide updates as the investigation progresses.
International transfers
For transfers from the EEA, UK, or Switzerland to the United States, the parties incorporate the EU Standard Contractual Clauses (Module Two or Three, as applicable) and the UK International Data Transfer Addendum into this DPA.
Audits
Morsegrid does not host, store, or warehouse Customer data; automations run inside Customer's own systems using Customer-controlled credentials. Where required by Data Protection Laws, the parties will cooperate in good faith on reasonable audit requests at Customer's expense.
Return and deletion
On termination of the MSA, Morsegrid will, at Customer's choice, return or delete any Personal Data it holds and stop using its access to Customer systems, within 30 days of termination, except where retention is legally required.
Contact
Questions about this DPA can be sent to support@morsegrid.com.
Customers who sign a paid contract also receive an executed Master Services Agreement, Order Form, and DPA. Where they differ from this page, the signed documents control.