Data processing terms

What this is, and whether it applies to you

When you put your staff’s records into tewo, you decide what is held and why, and we hold it on your instructions. In the GDPR’s words you are the controller and we are the processor; under India’s DPDP Act you are the data fiduciary and we are a data processor. That split is explained in the privacy policy. This page is the contract the law requires on top of the explanation.

It forms part of our terms and applies automatically to every customer the GDPR, the UK GDPR or the DPDP Act reaches. There is nothing to sign and nothing to request. If your procurement needs a copy executed on our side, write to hello@amionyx.com and you will have one.

Where this page and the terms disagree about personal data, this page wins.

What we process, and for how long

Subject matter

Running the tewo workspace you subscribed to.

Duration

For as long as your workspace exists, and then as set out under “Giving it back” below.

Nature and purpose

Storing, organising, displaying, transmitting and deleting the records you put in, so that the product’s features work — and nothing else.

Types of personal data

Names, contact details, employment terms and dates, departments and reporting lines, pay figures, leave and attendance, timesheets, performance reviews, assets issued, documents and photographs uploaded, chat messages and comments, CVs and application answers, enquiry and lead form answers, and the technical records listed in the privacy policy.

Categories of people

Your employees and contractors, your candidates and applicants, your clients’ contacts, and anybody who fills in a form you published.

Special category data

tewo has no field that asks for it. If you choose to record health, religion, caste, biometric or trade union information — in a document, a note or a custom field — you are the one deciding to, and you must have a lawful basis under Article 9 before you do.

Our instructions come from you

We process personal data only on your documented instructions, including about transfers out of the country. Your instructions are: these terms, the terms of use, the settings you choose in the product, and anything else you tell us in writing.

If the law compels us to process something beyond that, we will tell you before we do — unless the law forbids us from telling you, which happens.

If we think an instruction of yours breaks the law, we will say so rather than quietly carrying it out.

We do not use your data for our own purposes. We do not sell it, we do not pool it with other customers’ to build anything, and we do not use it to train AI models — ours or anybody else’s.

Who at tewo can see it

Only the people who need to in order to run or support the service, each of them under a binding duty of confidence that outlasts their time with us. We keep that group as small as the work allows.

The suppliers we use

You give us general written authorisation to use sub-processors. These are the ones we use today, each for the single job named:

tewo Mail runs on a mail server we operate ourselves, with the same hosting provider as the application — no other provider holds your mailboxes. If you connect your Google Business Profile, Google receives what that connection needs and nothing else.

Outside-mail monitoring — listing mail your staff send outside your company, and letting your Admin open one with a recorded reason — is processing you instruct, and you decide whether it happens. For a customer in the EU, EEA, UK or Switzerland it is off until your Admin turns it on and confirms that staff have been told, a data protection impact assessment is done, and any works council has agreed where that is required; the lawful basis for it is yours. The list is kept for 90 days and deleted when monitoring is turned off; the record of what was read is kept and cannot be altered.

Every one of them is bound by terms no weaker than these, and we remain answerable to you for what they do as if we had done it.

Before we add or replace one, we will tell you at least 30 days beforehand by email to the person who owns the workspace. If you object on reasonable data protection grounds within those 30 days, we will work with you to find another way — and if there is none, you may cancel and stop paying for what comes next.

Sending data out of the EU or the UK

Workspaces are hosted in India, and some suppliers above are in the United States. Neither has an adequacy decision for all purposes, so each transfer needs its own basis.

Ours is the European Commission’s Standard Contractual Clauses (Decision 2021/914, module two, controller to processor) together with the UK Information Commissioner’s International Data Transfer Addendum. Both are incorporated into these terms and take effect automatically, with Tewo Saas Solutions as data importer and you as data exporter. Where a clause there and a clause here disagree, the Clauses win.

If you want the Clauses signed as a separate document as well, ask us and we will sign them with you.

Keeping it secure

We maintain appropriate technical and organisational measures under Article 32. Concretely, and not as a list of adjectives: encryption of traffic in transit; a database reachable only from the application server; each company’s records separated from every other’s and every query scoped to the workspace asking; uploaded files served through links that expire rather than public addresses; no passwords anywhere, because signing in uses a one-time code to a mailbox; permissions granular enough that a person sees only what their role allows; and an append-only record of who changed what.

We review these as the product changes. Please read this alongside what the terms say plainly about the size of our team and our lack of a third-party certification: both statements are true at once, and you are entitled to weigh them together.

When something goes wrong

If personal data in your workspace is breached, we will tell you without undue delay and in any case within 48 hours of becoming aware of it — in time for your own 72-hour duty to your regulator, which is yours and not ours.

We will tell you what happened, what categories and roughly how many records were affected, what we think the consequences are, and what we are doing about it — sending what we know first rather than waiting until we know everything. We will help you with your notifications, and we will not notify your regulator or your people in your name unless you ask us to.

Helping you with the duties that stay yours

Some obligations are the controller’s and cannot be handed to us. What we will do is make them possible:

• Requests from your people. Access, correction, erasure, portability, restriction, objection — the product lets you answer most of them yourself. Where it does not, we will help, and at no charge. If such a request comes to us directly, we will not answer it: we pass it to you, tell the person we have, and leave the decision with you.
• Impact assessments and prior consultation. We will give you what you reasonably need about how tewo works to complete a DPIA or to consult your regulator.
• Security and breach duties. Articles 32 to 36, as set out above.

Showing you we are doing it

We will give you the information you reasonably need to show your regulator that this agreement is being kept.

You may audit us, or have an independent auditor do it, once in any twelve months — more often if a regulator requires it or after a breach that affected you. Give us 30 days’ notice, do it in working hours, do not disrupt the service or see another customer’s data, and bear your own costs. We will answer a reasonable written questionnaire instead if that settles it, because for most customers it does.

Giving it back, and deleting it

You can export your data at any time, yourself, for as long as the workspace is open — so you are never waiting on us to get it.

When the workspace closes, we delete the personal data in it, and tell our suppliers to do the same, within 90 days. Ask inside that window and we will return a copy first, or delete it sooner. What we keep after that is only what the law makes us keep — invoices and tax records — and nothing from inside the workspace.

Backups are overwritten on their own cycle rather than picked through; anything in one stays protected by these terms until it is gone.

Liability

The limits in our terms apply to this agreement too, and to both of us. They do not touch anything the GDPR or the DPDP Act puts beyond the reach of a contract — a regulator’s fine, or what Article 82 gives somebody whose data was mishandled.

Changes

We will only change these terms where the law changes, a supervisory authority requires it, or we add a supplier — and never in a way that weakens what you are owed. The date at the top moves with any change, and we will email the person who owns the workspace.

Questions about any of it go to Tewo Support at hello@amionyx.com.