Data processing agreement

Last updated

This agreement applies when an organisation (the “customer”) uses Kaavit and its boards hold personal data. It forms part of the terms of service and takes effect when the organisation is created. The customer is the controller of that data and Severi Reivinen, who provides Kaavit (“we”), is its processor, as Article 28 of the GDPR requires.

What is processed
Subject matter and purpose Hosting and providing the collaborative whiteboard to the customer’s members and guests
Duration While the organisation exists, then until deletion as described below
Nature of processing Storing, displaying, synchronising, exporting and deleting board content, and, when a user asks, sending part of a board, and any file attached to the request, to an AI provider
Personal data Names and email addresses of members, guests and invitees; board content, comments, images and files attached to AI requests, which may contain any personal data the customer’s users put there; records of who created and edited what
Data subjects The customer’s members and guests, the people they invite, and anyone described in board content

The customer must not put special categories of personal data (Article 9 of the GDPR) on its boards unless it has a lawful basis for doing so and has judged Kaavit’s security appropriate for it.

Our obligations

We:

  1. process the customer’s personal data only on its documented instructions, which are these terms and the customer’s use of the service, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it;
  2. make sure anyone with access to the data is bound to keep it confidential;
  3. take the security measures described below;
  4. use subprocessors only as described below;
  5. help the customer, as far as the service allows, to answer requests from data subjects exercising their rights;
  6. help the customer meet its obligations on security, breach notification, impact assessments and prior consultation, taking into account the nature of processing and the information we have;
  7. tell the customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting its data, with the information we have;
  8. delete the customer’s personal data when the organisation is deleted, as described below;
  9. make available the information needed to show we meet these obligations, and answer the customer’s reasonable written questions about them.

Security measures

  • All traffic is encrypted in transit with TLS.
  • Passwords are stored only as salted hashes.
  • Every request to a board is checked against the requester’s access to that board, and data is separated by organisation.
  • Images are stored in a private bucket and reached only through links that expire within minutes.
  • The database is backed up continuously and can be restored to a point in time.
  • Sign-up, sign-in and share links are rate limited against guessing.
  • Production systems are reachable only by the provider.

Subprocessors

The customer authorises us to use the subprocessors listed on the subprocessors page. We give each the same data protection obligations as this agreement, and we remain responsible for them. We update that page at least 30 days before adding or replacing a subprocessor. If the customer objects on reasonable data protection grounds and we cannot resolve the objection, the customer may delete the organisation.

Transfers outside the EU

The service’s servers and database are in the EU. Where a subprocessor processes data outside the European Economic Area, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework for a certified recipient, or on the European Commission’s standard contractual clauses.

Deletion

When an owner deletes the organisation, its boards stay recoverable for 30 days and are then removed. A deleted board is removed 30 days after its deletion. Copies in database backups are removed as the backups expire. A copy of the customer’s data before deletion can be requested at privacy@kaavit.com.

Liability and precedence

Each party’s liability under this agreement is as set out in the terms of service. If this agreement and the terms disagree on the processing of personal data, this agreement applies.