Data Processing Agreement

For the customer content stored in Ikonic, your organisation is the data controller and Ikonic Systems is the data processor. This agreement governs that processing and supplements our Terms of Service.

We process personal data only to provide the service, on your documented instructions, and for the duration of your subscription. We do not use your customer content for any other purpose.

Personnel authorised to process personal data are bound by confidentiality obligations and access data only as needed to deliver and support the service.

We apply encryption in transit, access controls, tenant isolation enforced in the data layer, and audit logging. Details are described on our Security page.

We use a limited set of sub-processors to run the service, each bound by data-protection terms. The current list is maintained on our Sub-processors page, and we notify customers of material changes.

We provide tooling and reasonable assistance to help you respond to data-subject requests (access, correction, deletion, export) that you receive as controller.

On termination, you can export your data, after which we delete or anonymise it within a commercially reasonable period, except where retention is required by law.

To request a signed DPA or ask questions, email info@ikonicsys.com.