{"id":4,"title":"GDPR","slug":"gdpr","content":"<div class=\"legal-container\"><h1>GDPR Compliance</h1><p>Last updated: August 2026</p><h2>Data Processing Agreement</h2><p>Causara acts as a data processor under UK GDPR. A Data Processing Agreement (DPA) is available on request for organisations that require one.</p><h2>Our Data Processing Commitments</h2><ul><li>Process personal data only on documented instructions from your organisation</li><li>Maintain appropriate technical and organisational security measures</li><li>Assist your organisation in fulfilling data subject rights requests within 30 days</li><li>Notify you of personal data breaches within 72 hours of becoming aware</li><li>Delete or return all personal data at the end of the contract</li><li>Use only sub-processors listed in our sub-processor register</li></ul><h2>Sub-Processors</h2><p>Our infrastructure is hosted on UK-based servers. Current sub-processors: Krystal UK (hosting). A full list is available on request.</p><h2>International Transfers</h2><p>Personal data is not transferred outside the UK or European Economic Area.</p><h2>Contact</h2><p>Data Protection Officer: <a href=\"mailto:dpo@causara.io\">dpo@causara.io</a></p></div>","meta_description":null}