Data processing agreement

This agreement is part of the terms of service. It applies to every organization whose people work in the Service. It is formed in electronic form (Article 28 (9) GDPR) when an authorized person accepts the terms of service for the organization. A countersigned copy is available on request. Where this agreement and the terms of service disagree on data protection, this agreement applies. It applies for as long as we process data for the organization.

For its people's accounts, that is sign-in, session and account security, we are the controller ourselves. The same applies to server logs, page statistics, the email log and support requests, as the privacy notice describes. Everything the organization creates about its people in the Service, or that arises about them there, we process on its behalf. There is no joint controllership under Article 26 GDPR.

The subject is running the Service for the organization in the products it has bought. We store the data, display it and transmit it to the people the organization authorizes. In the simulation we evaluate it. When one of the organization's people calls an AI feature, an AI model processes the text concerned. The purpose is the collaboration of the organization's people, the running of its seminars and simulations, and the support of the organization by our team. Processing lasts as long as the organization uses the Service. It ends with return or deletion under this agreement.

The people concerned are the organization's members, the people it invites and people who appear in its content. The data are name, email address, the permissions per product, the teams and the content created, including uploaded documents. In the simulation, the moves, each person's current page and the time per page are added. Special categories of personal data under Article 9 GDPR are not the subject of the Service, and the organization does not bring them in.

We process this data only to run the Service and only on the organization's documented instructions. The organization gives instructions through the settings of the Service, by using its features, and in text form through its administrators to the address below. The instructions include setting up what it has bought, supporting its people and keeping the Service secure. When one of the organization's people calls an AI feature, the organization thereby instructs us to transmit the text to the sub-processor in a third country named below. In its settings, the organization decides whether the instructor sees the time per page for each person or only the total per company. The organization is responsible for the legal basis of this processing. It informs its people under Article 13 GDPR. Where required, it obtains the agreement of the works council or staff council, in particular for per-person reading (Section 87 (1) no. 6 BetrVG). If we consider an instruction to infringe data protection law, we tell the organization.

The organization instructs us to form anonymous totals from the simulation's data. These totals name neither a person nor the organization. The organization allows us to use them to improve the Service. They no longer contain personal data.

Everyone we authorize to process data is bound to confidentiality. Named members of our team can open an organization for the purposes stated. Only those who administer organizations can read its member list. Nobody can sign in as one of its people. We record every access with the person, the time and what was done, and keep the record for 365 days. The organization's administrators can read it on its page.

The organization gives us general authorization to engage the following sub-processors. Each of them is bound by contract to the same data protection obligations as we are under this agreement. We remain liable to the organization for their performance.

dataforest GmbH, Kriftel, Germany. Hosting of our servers in data centers in Frankfurt, Germany.

AhaSend B.V., Amsterdam, Netherlands. Sending of emails, processed in the European Union.

OpenRouter Inc., New York, USA. Passes text to the provider of the AI model in use when a person calls an AI feature. The model providers are further sub-processors of OpenRouter. They may be located in the USA or another third country and may neither store the text nor use it for training. The transfer is based on the European Commission's standard contractual clauses (Article 46 (2) (c) GDPR). The models currently in use: ….

If we want to add or replace a sub-processor, we tell the organization's administrators at least 30 days in advance by email and in the Service. The organization may object for an important data protection reason before the change takes effect. If we then find no reasonable solution, either side may terminate the affected products as of that date.

We take the technical and organizational measures under Article 32 GDPR described in the next section. Our servers stand in Frankfurt, Germany, in data centers of dataforest GmbH, Kriftel, Germany. dataforest works for us under its own agreement pursuant to Article 28 GDPR and with the certifications named in the privacy notice. We review the measures regularly and keep them appropriate to the risk. We do not lower their level of protection without telling the organization.

Sign-in uses one-time codes by email, not passwords. Roles and permissions per product decide what a person sees and may change. The server cuts every response to the authorized person before sending it.

Every connection to the Service is encrypted with TLS. Servers and databases cannot be reached from outside directly, only through a proxy that terminates the encryption. The market research suppression list is stored encrypted in addition.

Data is labeled per organization, and every query is limited to the organizations of the requesting person. No response contains another organization's data.

We record every access by our team to an organization with the person, the time and what was done. Its administrators can read the record. We keep page statistics only under a daily pseudonym whose key we delete the next day.

The Service enforces retention periods itself. It deletes simulation visits, access records, the email log and questions to the strategy fox automatically after the periods in the privacy notice. When an organization is deleted, its content is deleted with it.

Everyone on our team is bound to confidentiality, and only named people can open an organization. We report security incidents within the period stated above.

If we learn of a breach of the data the organization is responsible for, we inform its administrators by email within 48 hours. The notice states, as far as known, the nature of the breach, the people and data concerned, the likely consequences and the measures taken (Article 33 (3) GDPR). When we know more, we add to it. We support the organization in its own duties under Articles 32 to 36 GDPR, including a data protection impact assessment, as far as we have the information.

We support the organization with appropriate measures in answering its people's requests under Articles 15 to 22 GDPR. If such a request reaches us directly, we pass it on to the organization without undue delay. We refer the person to the organization instead of answering ourselves.

We give the organization the information it needs to show that this agreement is met. We allow audits by the organization or by an auditor it appoints who is bound to confidentiality, and we contribute to them. An audit is announced at least 14 days in advance. Without a specific reason it takes place a maximum of once a year. It may not disturb the Service or reach other organizations' data. Each side bears its own costs.

When an organization is deleted or the processing ends, the organization may request the return of its data in a common machine-readable format for 30 days thereafter. After that we delete the data with all copies, unless the law requires us to keep them. We confirm the deletion on request. Individual people can delete their own account at any time. Their contributions in the organization stay with it.

This agreement applies in German. The English version is a non-binding translation for convenience. Where the two differ, the German version applies.

To ask for the agreement or about anything on this page, write to: dpa@techtropy.com.