Data processing agreement

The controller is the person or company that owns the workspace (you). The processor is Biscuit Systems, MB, Laisves al. 110, 44253 Kaunas, Lithuania, company code 306824273 (we). For your own account data, such as your email address and billing details, we are the controller and the privacy policy applies instead.

• Subject matter and purpose: running your feedback boards, roadmap and changelog, the embeddable widget, and the emails that tell your users what happened to their ideas.
• Duration: for as long as your workspace exists, and up to 30 days afterwards for backups.
• Data subjects: the people who use your boards, and the members of your team.
• Categories of data: names and email addresses where given; the ideas, votes and comments they post; a one-way hash of a visitor's network address used to prevent duplicate votes; identifiers your own product hands to the widget; and email preferences. No special categories of data are intended, and you agree not to collect any through Petĩra.

We will:

• Process the data only to provide the service and as you instruct through the product's settings and features, never for our own purposes, and tell you if we believe an instruction breaks the law.
• Make sure the people who can access production systems are bound to confidentiality, and limit that access to what running the service requires.
• Keep the security measures in section 6 in place and improve them as the service grows.
• Help you answer requests from your users about their data, for example to delete their posts, and help with your own obligations on security, breach notification and impact assessments, to the extent the information is with us.
• Tell you without undue delay, and in any case within 48 hours of becoming aware, when a breach affects your data, with what we know about its nature, scope and the steps taken.
• Delete your data when the workspace is deleted, and let you export it at any time before that in JSON and CSV from Settings.
• Give you the information needed to show that these obligations are met, and allow an audit, by you or an auditor you appoint, with reasonable notice and at most once a year unless a breach or an authority requires otherwise.

You authorise us to use the following sub-processors. We will email workspace owners at least 14 days before adding or replacing one; if you object on reasonable grounds and we cannot accommodate you, you may delete your workspace and the terms on refunds apply.

Every sub-processor is bound by data protection terms at least as protective as these, and we remain responsible to you for their work.

The application and the database run in the European Union, and backups stay there. Where a sub-processor is outside the EU, or a global network is involved, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision, and we will tell you which on request.

• Everything travels over HTTPS; the database is reachable only from the application.
• No passwords are stored: sign-in is by Google or a single-use emailed link. Widget identities are signed by your own server with a secret only you and we hold.
• Votes from visitors are recorded against a one-way hash, never a raw network address.
• Daily encrypted backups, kept for 30 days, with the key held separately from the storage.
• Error reports contain stack traces and the page that failed, no personal data.
• Access to production is limited to the people who run the service.

You have a lawful basis for collecting feedback from your users, you tell them about it in your own privacy policy, you answer their requests, and you do not use Petĩra for data it is not built for, such as health, financial or children's data. You are responsible for what your team does with the access you give them.

This agreement lasts as long as the terms of service do, and section 10 of the terms on liability applies to it. It is governed by the same law. Where this agreement and the terms disagree on the handling of personal data, this agreement wins. If the GDPR requires a term that is missing here, that term is taken as included.

Changes to this agreement are announced the same way as changes to the terms, with at least 14 days' notice for anything that affects your rights. Questions about it, and requests for a countersigned copy, go to [email protected].