Data processing agreement

This agreement is part of the terms of service. It applies to every organization whose people work in the Service. It is formed in electronic form (Article 28 (9) GDPR) when an authorized person accepts the terms of service for the organization. Where this agreement and the terms of service disagree on data protection, this agreement applies. Otherwise the terms of service apply, including for governing law, venue and changes to this agreement.

For its people's accounts, server logs, page statistics, the email log and support requests we are the controller ourselves, as the privacy notice describes. There is no joint controllership under Article 26 GDPR.

The subject is running the Service for the organization in the products it has bought. We store the data, compute with it, display it and transmit it to the people the organization authorizes. The purpose is the collaboration of the organization's people, the running of its seminars and simulations, and the support of the organization by our team. Processing lasts until the data is returned or deleted under this agreement.

The people concerned are the organization's members, the people it invites and people who appear in its content. The data are name, email address, the permissions per product, the teams and the content created, including uploaded documents. In the simulation, the moves, each person's current page and the time per page are added. Special categories of personal data under Article 9 GDPR are not the subject of the Service, and the organization does not bring them in.

We process this data only to run the Service and only on the organization's documented instructions. The organization gives instructions through the settings of the Service, by using its features, and in text form through its administrators to the address below. The instructions include setting up what it has bought, supporting its people and keeping the Service secure. The organization reimburses us reasonably for extra effort from instructions, audits or support that goes beyond running the Service, unless we are responsible for it. When one of the organization's people calls an AI feature, the organization thereby instructs us to transmit the text to the sub-processor in a third country named below. What one of the organization's people reads or changes through an agent credential or a connected app is processing on the organization's instruction, like their own use of the Service. The app is not our sub-processor. The organization is responsible for the lawfulness of the processing and for its people's rights, and informs its people under Article 13 GDPR. The annexes below add instructions for each kind of organization. If the law requires us to process data in another way, we tell the organization beforehand, unless the law forbids it. If we consider an instruction to infringe data protection law, we tell the organization and may suspend the instruction until the organization confirms or changes it.

The organization instructs us to form anonymous totals from the simulation's data, which name neither a person nor the organization.

Everyone we authorize to process data is bound to confidentiality, and only named members of our team can open an organization. We record each such access with the person, the time and what was done, keep the record for 365 days and show it to the organization's administrators.

The organization gives us general authorization to engage the following sub-processors. Each of them is bound by contract to the same data protection obligations as we are under this agreement. We remain liable to the organization for their performance. Except in the cases named here, we process the data only in the European Union or the European Economic Area. The organization allows a further transfer to a third country through the procedure for new sub-processors, and it takes place only under Chapter V GDPR. Ancillary services without a specific link to the Service, such as telecommunications, post and transport or maintenance, are no sub-processing. We keep confidentiality there too.

dataforest GmbH, Kriftel, Germany. Hosting of our servers in data centers in Frankfurt, Germany.

AhaSend B.V., Amsterdam, Netherlands. Sending of emails, processed in the European Union.

OpenRouter Inc., New York, USA. Passes text to the provider of the AI model in use when a person calls an AI feature. The model providers are further sub-processors of OpenRouter, may be located in the USA or another third country and may neither store the text nor use it for training. The transfer is based on the European Commission's standard contractual clauses (Article 46 (2) (c) GDPR).

If we want to add or replace a sub-processor, we tell the organization's administrators at least 30 days in advance by email. The organization may object for an important data protection reason before the change takes effect and states the reason. If we then find no reasonable solution, either side may terminate the affected products as of that date.

We take the technical and organizational measures under Article 32 GDPR described in the next section. We may change them as long as their level of protection is not lowered. On request we explain them to the organization in more detail, in confidence. Backups are stated in the annex on instances.

Every connection to the Service is encrypted with TLS, and servers and databases are not reachable from the internet directly.

Sign-in uses one-time codes by email, and roles and permissions decide what a person sees and may change.

Data is kept separate per organization, and every query is limited to the organizations of the requesting person.

The Service deletes simulation visits and access records automatically after the periods in the privacy notice.

If we learn of a breach of the data the organization is responsible for, we inform its administrators by email within 48 hours. The notice contains what Article 33 (3) GDPR requires, as far as known, and we add to it when we know more. We inform authorities and the people concerned only on the organization's instruction. We support the organization in its duties under Articles 32 to 36 GDPR, as far as we have the information.

We support the organization with appropriate measures in answering its people's requests under Articles 15 to 22 GDPR. A request that reaches us directly we forward to the organization without undue delay and do not answer ourselves. The same applies to requests from authorities and third parties about this data, as far as the law allows.

We give the organization the information it needs to show that this agreement is met. We allow audits by the organization or by an auditor it appoints who is bound to confidentiality, and we contribute to them. An audit is announced at least 14 days in advance and takes place in our business hours and, without a specific reason, a maximum of once a year. It may not disturb the Service or reach other organizations' data. Where a current audit report or certification, including our hosting provider's, answers the question, that evidence suffices.

Toward the organization we are not liable for processing that follows its instruction or a measure agreed with it. Otherwise the limitation of liability in the terms of service applies. Liability toward the people concerned under Article 82 GDPR is unaffected.

When an organization is deleted or the processing ends, the organization may request the return of its data in a common machine-readable format for 30 days thereafter. After that we delete the data with all copies, unless the law requires us to keep them. Backup copies follow within 7 days. We confirm the deletion on request. When a person deletes their own account, their contributions stay with the organization.

This annex applies to organizations that use the Service as business customers, as recorded for the organization. The people in the same simulation see which page the others are on and whether they have gone idle, and the simulation records page visits and moves per person. Only a facilitator the organization appoints sees the time per page, per person or only per company, as the organization decides in its settings. Where a works council exists, the organization obtains its agreement before it reads per person (Section 87 (1) no. 6 BetrVG). The organization does not use the Service to recruit, select, assess or monitor employees or job candidates, or to decide on their employment, tasks, promotion or dismissal.

This annex applies to universities, business schools and other organizations that use the Service in teaching, as recorded for the organization. In a simulation, the organization decides in its settings whether the instructor sees the time per page for each person or only the total per company. Where required, it obtains the agreement of its works council or staff council before it reads per person (Section 87 (1) no. 6 BetrVG).

An organization's data is held on the shared instance of the Service or, where agreed, on a dedicated instance with its own database and file storage. Only backups hold copies of it. dataforest backs up each instance daily and keeps the last 7 backups. A backup serves only to restore the instance.

An instance reports to us only operating totals that name no person and contain no content of an organization.

This agreement applies in German. The English version is a non-binding translation, and where the two differ, the German version applies.

To ask for the agreement or about anything on this page, write to: dpa@techtropy.com.