What you find in annex B
Annex B describes the purpose, which data subjects are involved, which data it holds and how we handle it. Think of organisation memory, documents and tasks, agents, connections and support. Read it together with the main text, because that is where the arrangements common to all products sit.
The chapters you are probably after
- what we use the data for and on whose instruction;
- who may get in and how we keep it shut;
- what happens when it goes wrong, and how a report runs;
- the parties we bring in, with the full list on sub-processors;
- return, export and erasure at the end;
- checking that we actually do it.
Which text wins
Under the order of precedence in the terms, the data processing agreement sits above the product terms and above public explanation such as this page. Where this explanation differs, the agreement applies. One thing we will not fill in on a page: if your organisation sits in the United Kingdom, a transfer of personal data out of the United Kingdom needs the right instrument, and which instrument that is is a question we have put to our lawyer rather than answered ourselves. Ask us before you sign, and you get the answer in writing or you get a plain no.
How the evidence fits
The agreement promises measures; the trust centre shows how we demonstrate them. The security evidence tracks per control which evidence exists, the logging protocol describes what gets recorded and the offboarding describes the route when you leave.