A to-do list for application review.
As part of the app review, Dataswyft has to set up a legal contract between your app and your users. This contract enables your users to give your app the permission and the right to be a tenant and to use a namespace within your users' own server database (each user has his/her own database). If your app is requesting for any other data from another namespace of their databases, a data debit must also be specified within the contract. This contract is set up by Dataswyft before your app goes live and will be autogenerated when your users sign in to your app.
Dataswyft requires information for the review and for the contract to be set up. We also require the application to declare the rating of application based on the Rating Assurance system. Below is a checklist that can help you prepare for review:
- Are you putting third-party data into the PDA? Make sure it belongs to the PDA user and that you have all the necessary permissions from the third-party data provider to be written into the PDA.
- If you also hold the data outside the PDA database, either ensure it's not identifiable or if it is, ensure it is secure. If the data is identifiable, note that your app rating for the first letter will go down to a B or lower. Also note that you would need to ensure you are compliant to data regulation for the data outside the PDA as Dataswyft cannot be responsible for that data.
- Be ready to accurately declare what data will be in the PDA, what data will sit on both your backend servers and the PDA, and what data will not.
- Be ready to declare any conditions imposed on a PDA user for the reuse and resharing of the data you place in their database.
- If you collect sensitive data, be ready to declare your data conduct in terms of collection, storage, usage, processing and sharing.
- If you are requesting for other namespace data (e.g. Google Calendar or Facebook), be ready to answer questions on duration, purpose and what specific data is required.
- Ensure your app meets the consumer law requirements of all applicable laws in any jurisdiction that you intend to offer your services.
- If you are sharing PDA data with third parties, ensure that the contract has been set up by Dataswyft for sharing. Dataswyft will not be responsible for any legal agreement outside of what your app is doing with the server owner's PDA data.
- Ensure the provision of essential goods or services (housing, food & medicine) is not dependent on your app as this would impact your user's acceptance of the data contract
- Ensure no other service contingent on the acceptance of this data contract of the PDA user's data usage by your app
- Ensure your app will not result in any prejudice or harm to the PDA user. Get a Privacy Impact Assessment and Data Protection Impact Assessment done if in doubt.
- Ensure your app and the data contract do not propose any specific or general risk
- Ensure you have all your app information (submitted within the Developer Portal). You won't be able to pass review if they are not included in the submission.
- Ensure you have a set of login credentials so that the review team can go through the entire user journey of the app. The list of information needed is available within the Developer Portal.
- Ensure a "Secured by Dataswyft" icon is on your marketing website.
- Ensure the PDA registration screen where your user enters an email to register for your app includes a link to the PDA Terms of Service and has a standard way of explaining a PDA; these must be clearly shown. Here are some examples:
- We use personal Data Accounts (PDAs) powered by the HAT Microserver technology to give you control and legal rights over your data. By proceeding you agree to:
- Learn how we protect your data
- Your PDA enables you to own data rights for reuse and sharing with applications.
If you need other features for the personal Data Accounts (children PDAs, elderly PDAs, or special PDAs for the health sector), please contact Dataswyft's support team.
All the best with your app!