Data processing agreement

Draft text, pending legal review. It is not yet legally binding advice or a final contract. Text in square brackets is a placeholder that the operator has not configured yet.

Parties and roles

The customer is the controller and [not configured: ITSTHEM_LEGAL_ENTITY_NAME], [not configured: ITSTHEM_LEGAL_ADDRESS], is the processor. Contact: [not configured: ITSTHEM_LEGAL_CONTACT_EMAIL].

Subject matter and duration

The processor delivers vendor status alerts to the customer. Processing lasts until the customer erases the workspace.

Categories of data and data subjects

Email address, name, workspace and Slack identifiers of the customer's users.

Security measures

Slack tokens and webhook secrets are encrypted at rest. Connections use TLS. Data is stored and backed up in the European Union.

Sub-processors

The processor uses the sub-processors on the sub-processor page. Sub-processor list

Assistance, return and deletion

The customer can export and erase the workspace data in the app. Erased data leaves backups within 30 days.

Further clauses

[Remaining Article 28 clauses (instructions, confidentiality, audits, breach notification, international transfers, liability) to be supplied by legal review.]