This agreement applies whenever we process personal data on your behalf — principally the feedback, votes and identity attributes your customers submit to your boards. It forms part of our terms of service and needs no separate signature, though we will sign a copy on request.
Roles and scope
You are the controller and we are the processor for workspace content. We process it only to provide the service, on your documented instructions, and for no other purpose.
Categories of data subject: your customers, prospects and employees who interact with your boards. Categories of data: identifiers, contact details, submitted content and the attributes you choose to send.
Security measures
Encryption in transit with TLS 1.2 or above and at rest with AES-256. Role-based access control internally, least-privilege production access with audit logging, mandatory review on code changes and annual penetration testing.
Backups are encrypted and tested by restore. Access to customer content by our staff requires a documented support reason and is logged.
Subprocessors
We engage subprocessors for hosting, transactional email, error monitoring and payments, each under written terms no less protective than this agreement. We maintain a current list and give notice before additions so you can object.
International transfers
Transfers out of the EEA, UK or Switzerland rely on the Standard Contractual Clauses with the UK addendum where relevant. EU-only processing and storage is available on request.
Incidents
We notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your workspace, with the facts known at the time and the steps we are taking.
Assistance, audits and deletion
We help you respond to data subject requests and to regulator enquiries. On request we provide our security documentation and, for enterprise agreements, support a reasonable annual audit.
On termination we delete or return personal data as you direct, subject to the retention windows described in our privacy policy.