Data processing agreement

This agreement forms part of the terms of service and applies to every organization whose people work in the Service. A countersigned copy is available on request. Where this agreement and the terms of service disagree about the processing of personal data, this agreement prevails.

We process personal data to run the Service for the organization. That is its member list, its teams, and the content its people create in the products it has unlocked. Processing lasts as long as the organization uses the Service.

The people are the organization's own members and the people it invites. The data are their name, their email address, what they may do in each product, the teams they sit in, and the content they create.

We process this data only to run the Service and only on the organization's instructions. Setting up what the organization has bought, supporting its people and keeping the Service secure are part of those instructions. We tell the organization if we consider an instruction to infringe the GDPR or other data protection law.

Named members of our team can open an organization for those purposes, and everyone we authorize is bound to confidentiality. Only those who administer organizations can read its member list, and nobody can sign in as one of its people. Every access is recorded with the person, the time and what was done, kept for one year, and readable by the organization's administrators on its own page.

We engage the service providers named in the privacy notice, each under an agreement pursuant to Article 28 GDPR. They process data in the European Union.

Our servers stand in Frankfurt, in data centers our hosting partner operates under its own agreement pursuant to Article 28 GDPR and the audits named in the privacy notice. Access is limited to the people who need it and every access by our team is recorded. We review these measures and keep them appropriate to the risk.

We tell the organization without undue delay after becoming aware of a breach of personal data it is responsible for, with what we know and what we are doing about it. We support the organization in meeting its own obligations under Articles 32 to 36 GDPR, including a data protection impact assessment, so far as the information is available to us.

We support the organization in answering the requests its people make, and we pass on any request that reaches us directly.

We give the organization the information it needs to show that this agreement is met, and we allow and contribute to audits it or an auditor it appoints carries out. An audit is announced in good time, and it may not disturb the Service or reach another organization's data.

When an organization is deleted, its content is deleted with it. Individual people can delete their own account at any time. At the end of the processing the organization chooses whether we return its data or delete it, and we delete any remaining copies unless the law requires us to keep them.

To ask for the agreement or about anything on this page, write to: dpa@techtropy.com.