1. Scope and roles
This Data Processing Agreement ("DPA") applies where MeriApply processes personal data on your behalf as part of the service described in our Terms of Service. For that personal data, you (or your institution, if you use MeriApply through one) are the data controller and Understify Ltd, trading as MeriApply, is the data processor. This DPA incorporates the UK GDPR and, where applicable, the EU GDPR.
2. Definitions
Terms such as "personal data", "processing", "controller", "processor", and "data subject" have the meanings given in the UK GDPR / EU GDPR. "Sub-processor" means a third party engaged by us to process personal data on your behalf.
3. Subject matter and duration
We process personal data you submit to MeriApply (such as your name, contact details, academic and employment history, and documents uploaded to your vault) for the purpose of preparing and submitting applications to scholarships, NHS employers, universities and grant bodies on your behalf, and for the related account and support functions described in our Privacy Policy. Processing continues for as long as you hold an active account, and for any period afterwards required by law or described in our Privacy Policy's retention section.
4. Processor obligations
We will:
- process personal data only on your documented instructions (including as set out in these Terms), unless required otherwise by law;
- ensure personnel authorised to process personal data are subject to confidentiality obligations;
- implement appropriate technical and organisational security measures (Section 7);
- assist you, where reasonably possible, in responding to data subject requests and in meeting your obligations relating to data protection impact assessments and prior consultation with supervisory authorities; and
- make available information reasonably necessary to demonstrate compliance with this DPA.
5. Sub-processors
We use the following categories of sub-processor to deliver the service:
- cloud hosting and infrastructure providers;
- the AI model providers used to draft and strategise applications;
- email delivery providers; and
- payment processing providers.
We remain responsible for each sub-processor's compliance with data-protection obligations equivalent to this DPA. We will give you reasonable advance notice of any new sub-processor that will process your personal data, and you may object on reasonable data-protection grounds by contacting us at the address in Section 13.
6. International transfers
Where personal data is transferred outside the UK or EEA, we rely on an appropriate transfer mechanism, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or a finding of adequacy, to ensure the transfer is lawful.
7. Security measures
We maintain technical and organisational measures appropriate to the risk, including encryption of personal data in transit and at rest, access controls limiting data access to personnel who need it, regular review of our security practices, and the ability to restore access to personal data in a timely manner following an incident.
8. Data subject rights
If we receive a request from a data subject relating to personal data we process on your behalf, we will promptly notify you and will not respond directly, except to confirm receipt and direct the data subject to you, unless required otherwise by law.
9. Personal data breach notification
We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, and will provide information reasonably available to us to help you meet any notification obligations you have to a supervisory authority or affected individuals.
10. Deletion and return of data
On termination of your account, we will delete or, if you request in writing within 30 days, return the personal data we process on your behalf, in accordance with the retention periods described in our Privacy Policy, unless applicable law requires us to retain some or all of it.
11. Audit rights
We will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and subject to confidentiality and reasonable limits on frequency and scope.
12. Liability
Each party's liability under this DPA is subject to the limitations of liability set out in Section 9 of our Terms of Service.
13. Contact
MeriApply is a product of Understify Ltd (Company Number: 16938284, registered in England and Wales). Durham County, United Kingdom.
Data protection enquiries: [email protected].