Data processing agreement

Last updated: [date]

This agreement is part of the Terms of service between the customer ("controller") and [Company name] ("processor", "HiveVote").

1. Subject and duration

HiveVote processes personal data on the customer's behalf to provide the HiveVote service for as long as the customer has an account, and until the data is deleted as described in section 8.

2. Nature and purpose

Hosting and showing the customer's feedback portals, roadmaps, changelogs and widgets; signing in the customer's users; sending the emails the service sends (sign-in codes, notifications, changelog emails); running the integrations the customer sets up.

3. Data and data subjects

• Data subjects: the customer's portal and widget users, and the customer's team members.
• Data: names, email addresses, profile pictures, identifiers from the customer's single sign-on, content they post (feedback, comments, votes, reactions, images), email preferences and subscriptions, IP addresses and technical logs, the audit log of team actions.
• No special categories of data are needed; the customer makes sure its users aren't asked for them.

4. Instructions

HiveVote processes the data only on the customer's documented instructions, which are these terms and what the customer configures in the service (settings, integrations, API and MCP access). HiveVote tells the customer if it believes an instruction breaks data protection law.

5. Confidentiality and staff

People at HiveVote who can access customer data are bound to confidentiality. Staff access customer projects only to provide support: read-only, for at most 30 minutes at a time, recorded in the project's audit log and HiveVote's staff log.

6. Security

HiveVote's technical and organisational measures include:

• Each customer's data is separated in the database by row-level security; every request runs in one project's scope.
• Sign-in by one-time email codes (stored hashed) or the customer's identity provider; portal sessions and API keys stored only as hashes; team sessions in httpOnly cookies.
• Secrets the customer gives HiveVote (single sign-on keys, webhook signing secrets, integration URLs) are encrypted at rest with rotatable keys.
• Encrypted connections (TLS) everywhere. Database backups are encrypted (age) to a key that isn't on the server and stored [location]; uploaded images are copied to [location].
• An audit log of team actions per project; a staff log of every HiveVote staff action.
• Rate limits and bot checks against abuse; outbound requests to customer-configured addresses go through a guard against requests into private networks.
• [Patch management, access control on servers, monitoring and incident response, as practised.]

7. Subprocessors

The customer authorises the subprocessors listed at /legal/subprocessors. HiveVote will announce new subprocessors [N days] ahead; the customer may object [and terminate if no solution is found]. HiveVote imposes the same data protection obligations on its subprocessors.

8. Deletion and return

• During the agreement the customer can download all of a project's data (Settings, Project) and delete projects, portal users and its account at any time. A deleted portal user is anonymized: their content stays as "Deleted user"; everything identifying them is erased.
• When the customer deletes its account, all its projects are deleted 14 days later; backups containing them are overwritten within [N days].

9. Assistance

HiveVote helps the customer answer data subjects' requests (the service has self-service export and deletion for portal users), and with security, breach notification and impact assessments, as far as it can reasonably be expected.

10. Personal data breaches

HiveVote notifies the customer without undue delay, [within N hours], after becoming aware of a breach affecting the customer's data, with what is known and what is being done.

11. Audits

HiveVote makes available the information needed to show compliance with this agreement [and allows audits by the customer or an auditor it chooses, at most once a year, on reasonable notice].

12. International transfers

[Describe where data is processed (e.g. Switzerland) and the safeguards for any transfer outside Switzerland/the EEA, e.g. Standard Contractual Clauses with Stripe and Cloudflare.]

Contact for data protection: [email]