Data Processing Agreement

This Data Processing Agreement forms part of the SegmentStream Terms of Service and uses the same defined terms.

1. Scope and definitions

1.1 This DPA applies where we process Customer Personal Data on your behalf in providing the Service. It also applies where our staff process Customer Personal Data in providing professional services to you under a separate signed agreement, unless that agreement says otherwise. It does not apply to personal data for which we are a controller, such as account, billing and usage data, which our Privacy Policy covers.

1.2 In this DPA:

• “Data Protection Law” means the UK GDPR and the Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection, and any other data protection or privacy law that applies to the processing.
• “Customer Personal Data” means personal data contained in Customer Content.
• “Sub-processor” means a third party we engage to process Customer Personal Data.
• “Security Incident” means a breach of security of systems operated by us or our Sub-processors that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. It does not include unsuccessful attempts, such as blocked scans, failed sign-ins or denial-of-service attacks.
• “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in Data Protection Law.

2. Roles

2.1 You are the controller of Customer Personal Data, or a processor acting for another controller. We are your processor, or your sub-processor where you are a processor.

2.2 Where you act as a processor, you confirm that your instructions to us, including your appointment of us, have been authorised by the controller.

2.3 You, or the controller you act for, are the controller for the personal data of End Users of your Customer Applications. We have no direct relationship with them.

3. Our processing

3.1 We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first where the law allows. Your instructions are these Terms, this DPA, your configuration and use of the Service, and the actions of your Users, End Users, Agents and Customer Applications.

3.2 Annex 1 describes the processing.

3.3 We will tell you if we believe an instruction breaks Data Protection Law. We are not required to carry out an instruction that we believe is unlawful.

3.4 We do not sell Customer Personal Data, and we do not use it for our own purposes other than to provide, secure, support and bill for the Service and to comply with the law.

3.5 Where the California Consumer Privacy Act applies, we act as your service provider. We do not sell or share Customer Personal Data, and we do not keep, use or disclose it outside our direct business relationship with you.

4. Your obligations

4.1 You are responsible for the accuracy, quality and legality of Customer Personal Data and of how you obtained it.

4.2 You must have a lawful basis for the processing, give the notices and obtain the consents that Data Protection Law requires, and make sure your instructions comply with the law.

4.3 You decide what personal data to put in the Service, which Third-Party Services to connect, which AI features to use and how your Customer Applications collect data. You are responsible for assessing whether the Service and its security measures are suitable for that data.

4.4 You must not submit the categories of data banned by clause 5.7 of the Terms.

5. Confidentiality of staff

We make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

6. Security

6.1 We maintain the technical and organisational measures described in Annex 2. We may update them, provided the overall level of protection is not materially reduced.

6.2 You are responsible for the secure configuration and use of the Service on your side, as set out in clause 11.4 of the Terms.

7. Sub-processors

7.1 You give us general authorisation to engage Sub-processors. The current list is published at segmentstream.com/subprocessors.

7.2 We will give you at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data, by updating that page and emailing those who have subscribed to updates. We may act sooner where an urgent replacement is needed for security or continuity, and will tell you as soon as we reasonably can.

7.3 You may object on reasonable data protection grounds within 14 days of the notice. We will discuss your objection in good faith. If we cannot resolve it, your only remedy is to stop using the affected part of the Service or to close your account, in which case clause 9.6 of the Terms applies.

7.4 We impose data protection terms on each Sub-processor that are no less protective than this DPA in substance, and we remain responsible to you for their performance, subject to the Terms.

7.5 A Third-Party Service that you choose to connect, and any coding agent or other tool that you operate, is not our Sub-processor. You are responsible for your arrangements with it.

7.6 AI model providers are listed when we make their models available. Choosing or allowing a model is your instruction to use its provider. We will not route Customer Personal Data to a model provider that is not on the list.

8. International transfers

8.1 We may process Customer Personal Data in the United Kingdom, the European Economic Area, the United States and any other country where we or our Sub-processors operate.

8.2 Where Data Protection Law restricts a transfer of Customer Personal Data to us or to a Sub-processor, the transfer will be made under an adequacy decision or regulations, or under the SCCs and, where relevant, the UK Addendum, as set out in Annex 3.

8.3 If a transfer mechanism we rely on is invalidated, we will work with you in good faith to put a lawful alternative in place.

9. Requests from individuals

9.1 The Service gives you tools to access, correct, export and delete Customer Personal Data. You are responsible for responding to requests from data subjects.

9.2 If we receive a request from a data subject about Customer Personal Data, we will pass it to you where we can identify you as the controller, and we will not respond to it ourselves except to direct the person to you.

9.3 Where you cannot deal with a request using the tools in the Service, we will give reasonable help on request. We may charge for help that goes beyond what the Service provides.

10. Security Incidents

10.1 We will notify you without undue delay after we become aware of a Security Incident, using the email address on your account.

10.2 We will give you the information we reasonably have about the nature of the incident, the data affected and the steps we are taking, and we will update you as more becomes known.

10.3 A notification is not an admission of fault or liability. You are responsible for any notification you must make to regulators or data subjects.

10.4 Where a Security Incident was caused by you, your Users, End Users, Agents or Customer Applications, or by a Third-Party Service that is not our Sub-processor, we will still tell you if we become aware of it, but clause 10.2 does not apply and we may charge for help you ask for.

11. Assessments and regulators

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and prior consultation with a regulator, where Data Protection Law requires them and you cannot complete them without us. We may charge for help that is more than minor.

12. Return and deletion

12.1 You can export Customer Personal Data at any time while your account is active, and during the export period in clause 17.5 of the Terms.

12.2 We delete Customer Personal Data as set out in clauses 10.2, 10.3 and 17.6 of the Terms, unless the law requires us to keep it. Where it is kept, this DPA continues to apply to it.

12.3 We will confirm deletion in writing on request.

13. Audits

13.1 On request, we will give you the information reasonably needed to show that we comply with this DPA. This may take the form of our security documentation and any independent audit reports or certifications we hold at the time.

13.2 If that information is not enough to meet your obligations under Data Protection Law, or a regulator requires it, you may carry out an audit of our processing of Customer Personal Data, subject to the following:

• no more than once in any 12 months, unless a regulator requires it or there has been a Security Incident affecting your data;
• on at least 30 days' written notice, with a scope agreed in advance;
• during business hours, without disrupting our business or putting other customers' data at risk;
• carried out by you or by an independent auditor bound by confidentiality, who is not our competitor; and
• at your cost, including our reasonable costs of supporting the audit.

13.3 You must treat the results as our confidential information and share with us any finding of non-compliance. Audits of Sub-processors are limited to the reports they make available to us.

14. Liability

Each party's liability under this DPA is subject to the exclusions and limits in the Terms. Nothing in this DPA limits either party's liability to data subjects or regulators where the law does not allow it to be limited.

15. General

15.1 If this DPA conflicts with the rest of the Terms on the processing of Customer Personal Data, this DPA prevails. If the SCCs apply and conflict with this DPA, the SCCs prevail.

15.2 This DPA lasts for as long as we process Customer Personal Data.

15.3 This DPA is governed by the law that governs the Terms, except where the SCCs require otherwise.

15.4 We may update this DPA under clause 18 of the Terms, including to reflect changes in the law or in the Service.

Annex 1: Details of the processing

Annex 2: Security measures

• Each Workspace has its own database and its own cloud project, separate from other customers.
• Tenant isolation in the platform's own database is enforced at the database level.
• Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers.
• Secrets and connection credentials are held in a managed secret store, not in customer code.
• Access to the Service is controlled by roles and permissions. Credentials issued to Customer Applications are limited to their own Workspace.
• Our services authenticate to Google Cloud with short-lived identities and not long-lived keys.
• Staff access to production systems is limited to those who need it.
• Changes to access rights on customer Workspaces are recorded in audit logs.
• Source code is scanned for leaked secrets and known vulnerabilities.
• Errors in the Service are monitored.
• Staff and contractors are bound by confidentiality.
• Sub-processors are assessed before use and bound by written data protection terms.

Annex 3: Transfer terms

1. EU transfers. Where a transfer of Customer Personal Data from you to us is restricted by the EU GDPR, the SCCs are incorporated into this DPA as follows:

• Module Two applies where you are a controller. Module Three applies where you are a processor.
• Clause 7 (docking) does not apply.
• Clause 9: Option 2 (general written authorisation) applies, with the notice period in clause 7.2 of this DPA.
• Clause 11: the optional wording does not apply.
• Clause 17: Option 1 applies and the governing law is the law of Ireland.
• Clause 18(b): disputes go to the courts of Ireland.
• Annex I.A: you are the exporter and we are the importer, with the details in the Terms and in your account.
• Annex I.B: as set out in Annex 1 of this DPA.
• Annex I.C: the supervisory authority is the one that is competent for you under clause 13 of the SCCs.
• Annex II: as set out in Annex 2 of this DPA.
• Annex III: the Sub-processors listed at segmentstream.com/subprocessors.

2. UK transfers. Where a transfer is restricted by the UK GDPR, the SCCs apply as completed above and as amended by the UK Addendum, which is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in this Annex and in Annexes 1 and 2. In Table 4, neither party may end the UK Addendum because of a change to its approved form.

3. Swiss transfers. Where a transfer is restricted by Swiss law, the SCCs apply as completed above, with references to the EU GDPR read as references to the Swiss Federal Act on Data Protection, and with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.

4. Onward transfers. Where we transfer Customer Personal Data to a Sub-processor in a way that Data Protection Law restricts, we will make sure a lawful transfer mechanism is in place.