This agreement is part of the developer terms between [COMPANY] ("Human Pass") and the organization using Human Pass ("you"). It sets out how each of us handles personal data, under the GDPR, the UK GDPR and US state privacy laws.
1. Roles
- Verification and uniqueness: Human Pass is an independent controller. We decide how people verify their IDs, how uniqueness is determined, and what is kept, under our own privacy policy. People enter a relationship with us when they create a Human Pass.
- What you receive: you are an independent controller of the data you receive (a site-specific ID, "verified human", and any attributes the person agreed to share with you), under your own privacy policy.
- Processing on your behalf: Human Pass is your processor only for the limited things we do for you: answering your status requests about IDs you hold, and computing usage counts for your billing. For that processing, sections 3–8 apply.
2. What you receive, and what you must not do with it
The data you receive is pseudonymous: it's designed so you can't learn who a person is. You agree not to try to re-identify people, to link their IDs across projects or with other organizations, or to use what you receive for any purpose other than managing accounts on your own services and complying with the law.
3. Processing on your behalf (Human Pass as processor)
| Subject matter | Status of site-specific IDs; aggregate usage counts |
|---|---|
| Duration | While you use Human Pass |
| Nature and purpose | Answering your status requests; billing |
| Personal data | Site-specific IDs you send us; counts (not personal data) |
| Data subjects | People who sign in to your services with Human Pass |
We process this data only on your documented instructions (these terms and your use of the service), keep it confidential, and make sure our staff are bound by confidentiality.
4. Security
We protect personal data with the measures in our security and privacy overview, including encryption, keys held in a hardware-backed key service, least-privilege access with recorded staff access, and per-site IDs.
5. Subprocessors
You authorize the subprocessors listed in our privacy policy (hosting, email, payments). We'll tell you at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds.
6. Assistance
We'll help you, as reasonably needed, to respond to people exercising their rights, and with data protection impact assessments and consultations with authorities, as far as they concern our processing.
7. Breaches
We'll tell you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting data we process for you, with the information you need to meet your own obligations.
8. Deletion and audits
When you stop using Human Pass, we delete the data we process for you, except where the law requires us to keep it. We'll make available the information reasonably needed to show compliance with this agreement, and allow audits by you or an auditor you appoint, on reasonable notice and at most once a year, unless a breach or an authority requires more.
9. International transfers
Where personal data is transferred from the EEA, the UK or Switzerland to the United States or another country without an adequacy decision, the European Commission's Standard Contractual Clauses (module [2 or 3, as applicable]) [and the UK Addendum] apply and are incorporated by reference.
10. Between controllers
Each of us is responsible for our own compliance as a controller, including having a lawful basis, informing people, and answering their requests. If a person asks one of us about data the other controls, we'll pass the request on promptly.
Contact
[COMPANY], [ADDRESS] · [PRIVACY EMAIL]