Data processing agreement
Last updated
When you use poun, we handle personal data about your customers for you: subscribers, voters, form respondents. This agreement sets out how, as data protection law requires. It forms part of our terms of service and applies automatically once you use the service. You don’t need to sign anything.
The short version
- You're in charge of your customers' data. We only process it to run poun for you.
- We use the providers on our subprocessors page and tell you 30 days before adding one, so you can object.
- If there's a breach affecting your data, we tell you without undue delay and within 72 hours.
- When you leave, you can export everything, and then we delete it.
This summary helps you find your way. The full text below is what applies.
1. Definitions and scope
“Customer” means you, the poun customer. “We” means [legal name of the business]. “Data protection law” means every law that applies to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act. “Customer personal data” means personal data we process for you through poun. Other terms such as “controller”, “processor” and “personal data breach” have the meaning given in the GDPR.
This agreement applies to customer personal data. Data about you as our customer, such as your account and billing details, is covered by our privacy policy instead.
2. Roles
You are the controller of customer personal data (or a processor acting for your own client), and we are your processor (or sub-processor). Annex 1 describes the processing.
For US state privacy laws, we act as your service provider or contractor. We won’t sell or share customer personal data, keep, use or disclose it for any purpose other than providing poun to you, or combine it with personal data from elsewhere, except as those laws allow. We’ll tell you if we can no longer meet these obligations.
3. Your instructions
We process customer personal data only on your documented instructions. These terms, this agreement and how you set up and use poun are your instructions. If we’re legally required to process it any other way, we’ll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we’ll tell you. You’re responsible for having a lawful basis for the processing and for giving the people concerned the information the law requires.
4. Confidentiality
Only people who need access to provide, support or secure poun can access customer personal data, and they’re bound by confidentiality.
5. Security
We take the technical and organisational measures in Annex 2 to protect customer personal data. We may update them as long as protection doesn’t get weaker.
6. Subprocessors
You authorise us to use the subprocessors listed on our subprocessors page. We’ll give you at least 30 days’ notice before adding or replacing one, by updating that page and emailing your workspace owner. You can object on reasonable data protection grounds within that time. If we can’t resolve the objection, you can end the affected part of the service and get a refund of any prepaid fees for it.
Each subprocessor is bound by a written contract with data protection obligations at least as protective as these. We remain responsible to you for their work.
7. Requests from individuals
poun gives you tools to find, export and delete the data of a subscriber, contact or respondent. If someone contacts us directly about customer personal data, we’ll pass the request to you without answering it ourselves, unless you ask us to. If you need more help answering a request, we’ll give reasonable assistance.
8. Personal data breaches
If we become aware of a personal data breach affecting customer personal data, we’ll tell you without undue delay, and within 72 hours. We’ll tell you what happened, what data and people are affected, what we’re doing about it, and who to contact, adding details as we learn them. We’ll help you meet your own obligations to notify authorities and individuals. Telling you about a breach isn’t an admission of fault.
9. Impact assessments
If you need to carry out a data protection impact assessment or consult an authority about your use of poun, we’ll give you the information you reasonably need.
10. Deletion at the end
When your agreement with us ends, you can export customer personal data for 30 days. After that, we delete it within 30 days, and it leaves our backups within a further 30 days, unless the law requires us to keep it. You can delete individual records, or your whole workspace, at any time before that.
11. Audits
We’ll make available the information needed to show we meet this agreement, including answering a reasonable security questionnaire once a year. If that isn’t enough, or an authority requires it, you or an independent auditor bound by confidentiality may audit us, with 30 days’ notice, during business hours, without disrupting the service, and at your cost.
12. International transfers
Where customer personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission’s Standard Contractual Clauses (Decision 2021/914), which are incorporated by reference:
- Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor;
- clause 7 (docking) applies; under clause 9, option 2 (general authorisation) applies, with the notice period in section 6;
- the optional wording in clause 11 doesn’t apply;
- under clauses 17 and 18, Irish law applies and the courts of Ireland have jurisdiction;
- Annexes I and II of the clauses are completed by Annexes 1 and 2 below, and the competent authority is the one for your establishment.
For UK transfers, the ICO’s International Data Transfer Addendum applies alongside the clauses, with the tables completed using this agreement. For Swiss transfers, references in the clauses to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent authority.
13. Liability and order of precedence
Liability under this agreement is subject to the limits in the terms of service, except where data protection law doesn’t allow that. If this agreement conflicts with the terms, this agreement wins for customer personal data. If it conflicts with the Standard Contractual Clauses, the clauses win.
14. Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter and purpose | Providing poun to you: hosting status pages, feedback boards and forms, sending the emails you set up, checking uptime, and storing and exporting what's collected. |
| Nature | Collection, storage, organisation, display, sending, export and deletion, as you direct. |
| Duration | For as long as you use poun, then until deletion under section 10. |
| Data subjects | Your teammates; your status page subscribers; people who post, vote or comment on your boards; people who answer your forms; anyone else whose data you put into poun. |
| Personal data | Email addresses; names, if given; posts, comments and votes; form answers, which can include anything your forms ask; values passed in hidden fields; IP address and browser details, for spam protection and security; records of the emails sent to each person. |
| Special category data | Not intended. You must not collect it unless the law allows it and you've told us first (see the terms). |
| Frequency | Continuous. |
| Built-in retention | Unconfirmed subscribers deleted after 7 days; records of individual emails sent kept for 90 days; uptime check history kept for 400 days; everything else kept until you delete it. |
15. Annex 2: Security measures
- Every connection is encrypted with TLS (HTTPS), including the public pages on your own domain.
- Data is encrypted at rest by our database and storage provider.
- Every record belongs to one workspace, and every request checks that workspace’s access before reading or writing.
- Roles (owner, admin, member) limit what each teammate can do; billing and deleting a workspace need the owner.
- Team sign-in by password (stored only as a salted scrypt hash), one-time email links or Google, with rate limits on every sign-in endpoint.
- Our own access to production data is limited to the people who need it, using strong authentication.
- Public forms, votes and subscriptions are protected by bot checks and rate limits.
- Webhooks we receive are verified by signature. Secrets are kept out of the code.
- Changes are logged with a request ID, so we can trace what happened to any workspace.
- Daily backups by our database provider; dependencies are kept up to date.
- A written process for handling incidents, including the notice in section 8.
16. Annex 3: Subprocessors and contact
The current list is on our subprocessors page. For anything about this agreement, contact [contact email].