Adendo de tratamento de dados

1. Roles

For personal data inside a workspace, the organisation that owns the workspace is the controller and Taktoria LLC is the processor. Each party complies with the data protection law that applies to it.

Where we act as controller instead, meaning account records, billing, and the logs we keep to run the service, the Privacy Policy governs rather than this agreement.

2. Subject matter and duration

We process personal data to provide the apps a workspace has subscribed to, for as long as the workspace exists. Processing ends when the workspace is deleted or the agreement ends.

3. Categories of data and data subjects

Data subjects are the workspace's own people and anybody they invite in:

• •Members: name, email, profile picture, authentication records, and whatever they write in the apps.
• •Event participants: a cookie token, an optional display name, the questions and votes they submit.
• •Recipients of notifications: email address and the content of the message sent to them.

4. Our obligations

• •We process personal data only on the controller's documented instructions, which include using the service as it is built.
• •People with access to it are bound by confidentiality.
• •We keep appropriate technical and organisational measures, described in the security section below.
• •We assist the controller with data subject requests, impact assessments and breach notifications, so far as the service allows.
• •On request we delete or return the data at the end of the agreement, unless the law requires us to keep it.

5. Security

• •Data in transit is encrypted with TLS; data at rest is encrypted by the underlying providers.
• •Passwords are stored only as hashes. Two-factor authentication is available to every account.
• •Every query in the product is scoped to one workspace, and access to an app additionally requires a seat.
• •Administrative access to production is limited to the people who need it and is authenticated individually.

6. Sub-processors

The controller gives general authorisation for the sub-processors listed in the annex below. We will give at least 90 days notice before adding or replacing one, and the controller may object on reasonable data-protection grounds.

7. International transfers

Where a sub-processor processes personal data outside the United States, the transfer relies on the Standard Contractual Clauses or another mechanism recognised under applicable law.

8. Personal data breaches

We will notify the controller without undue delay, and in any case within 30 days of becoming aware of a personal data breach affecting their data, with what we know and what we are doing about it.

9. Audits

On reasonable notice and no more than once a year, we will make available the information needed to demonstrate compliance with this agreement, and submit to an audit conducted by the controller or an auditor they appoint, at the controller's cost.

10. Annex: sub-processors

Each of these does one job. A workspace that does not use the feature does not reach the provider behind it.

• •Vercel: application hosting and content delivery, and cookieless page analytics and performance measurement.
• •Cloudflare: transactional email, and object storage for uploaded pictures.
• •PlanetScale: the managed MySQL database the product's records live in.
• •Stripe: payments, subscriptions and invoices.
• •Inngest: delivery of background jobs, including notification and digest emails.
• •Slack: only for a workspace that has connected it, and only the notifications it has asked us to post.
• •Google: only where a person chooses to sign in with a Google account.

11. Contact

Questions about this agreement, or a request for a signed copy: legal@taktoria.com.