Our Privacy Policy has always said that when ToRun processes data on an organisation's behalf, a separate agreement governs it. That agreement is now a public page under Legal, in every language the site offers. It sets out who is responsible for what, the security measures in place, and what happens to the data when a contract ends.