Data Processing Agreement

This Data Processing Agreement (the DPA) is the agreement required by Article 28 of the General Data Protection Regulation (GDPR) between a business that uses Snughall and us. It forms part of the Terms of Service for every Customer and Company that uses Snughall for a business, and applies from the moment that business's Company starts using Snughall. How we handle data as a controller in our own right is described in the Privacy Policy.

1. Parties and roles

• Controller: the business on whose behalf a Company is used (normally the business its Owner represents).
• Processor, we: Paweł Marciniak, running a business as Paweł Marciniak SOLIDCode, ul. Stanisława Lema 15 lok. 30, 80-126 Gdańsk, Poland, NIP 5833421194, REGON 388201516, [email protected], +48 514 393 722.

The Controller accepts this DPA by accepting the Terms of Service for the Company. If anything in this DPA conflicts with the Terms on how personal data is processed, this DPA prevails.

2. Subject, duration, nature and purpose

We process personal data only to provide Snughall to the Controller's Company as described in the Terms of Service: hosting the Company's virtual office, its members' accounts within the Company, chat, desks, notes, whiteboards, statuses, integrations and the other features the Company uses. Processing consists of collecting, storing, organising, displaying, transmitting and deleting data. It lasts for as long as the Company uses Snughall and until the data is deleted under section 11.

3. Types of data and data subjects

• Data subjects: the Company's Owners, Admins and Members, people invited to the Company, and people mentioned in its content.
• Types of data: names, email addresses, roles, invitations, presence and status, position in the office, chat messages, notes, whiteboards, information cards, desk details and personal details members choose to share, calendar free/busy blocks and Slack status if members connect them, and the technical data needed to provide these features.

Snughall is not meant for special categories of personal data (Article 9 GDPR) or data about criminal convictions. The Controller makes sure its members do not use Snughall for them.

4. Instructions

We process the data only on the Controller's documented instructions, including for transfers outside the European Economic Area, unless the law requires otherwise; in that case we tell the Controller before processing unless the law forbids it. The Terms of Service, this DPA and the Company's settings (such as how long chat is kept, who is invited or removed, and which integrations are connected) are the Controller's instructions. Further instructions can be sent by email. We tell the Controller at once if we believe an instruction breaks data protection law.

5. Confidentiality

Only people who need access to provide, secure or support Snughall can access the data, and each of them is bound by a duty of confidentiality.

6. Security

We take the measures required by Article 32 GDPR, including:

• encrypted connections (HTTPS) to Snughall;
• passwords stored only as hashes, and integration tokens stored encrypted;
• access to servers restricted to the people who run Snughall;
• Company data separated by Company in every request, so one Company cannot read another's;
• logs without IP addresses, request bodies or cookies;
• nightly database backups, kept for 14 days;
• prompt security updates of the software Snughall runs on.

7. Sub-processors

The Controller gives us general authorisation to use sub-processors. The current list is in section 5 of the Privacy Policy: OVHcloud (hosting and backups), Cloudflare (network), Postmark (email), Sentry (error reports) and ifirma (invoicing), and, for the features a Company chooses to use, Google, Microsoft and Slack.

We bind each sub-processor by contract to data protection obligations at least as strict as this DPA, and we remain responsible to the Controller for their work. We tell Owners by email at least 14 days before adding or replacing a sub-processor. The Controller may object for reasonable data protection grounds within that time; if we cannot resolve the objection, the Controller may end the agreement for the Company before the change, and we refund the unused part of any paid period.

8. Helping the Controller

Taking into account the nature of the processing, we help the Controller by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights (Chapter III GDPR), and with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Owners and Admins can already correct and remove most data themselves in Snughall; for anything else, email us.

9. Personal data breaches

We notify the Controller, by email to its Owners, without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the Company's data. The notice describes, as far as we know them, what happened, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We add further information as it becomes available.

10. Transfers outside the European Economic Area

Some sub-processors are based in the United States (see section 6 of the Privacy Policy). Transfers to them rely on the EU–US Data Privacy Framework where the sub-processor is certified, or on the European Commission's standard contractual clauses.

11. When the processing ends

When the Company stops using Snughall, the Controller may, within 30 days, ask by email for a copy of the Company's data in a common machine-readable format. On the Controller's request, and in any case within 90 days after the agreement for the Company ends, we delete the Company's personal data, unless the law requires us to keep it. Deleted data disappears from backups within 14 days.

12. Information and audits

We make available to the Controller the information needed to show that we meet the obligations of Article 28 GDPR, and allow and contribute to audits, including inspections, by the Controller or an auditor it appoints. Audits are agreed at least 30 days in advance, take place during business hours, respect the confidentiality of other customers' data and of our security, and are at the Controller's cost unless they reveal a material breach of this DPA.

13. The Controller's obligations

The Controller is responsible for having a legal basis for the processing, for informing its members and invited people about it (including by pointing them to the Privacy Policy), and for the lawfulness of the content its Company adds to Snughall.

14. Liability and final provisions

Liability under this DPA follows section 14 of the Terms of Service, except where the GDPR provides otherwise. This DPA is governed by Polish law, lasts as long as we process personal data for the Controller, and is published in English and Polish; if the versions differ, the Polish version prevails. We may change this DPA under section 16 of the Terms of Service.