Data Processing Addendum

1.Scope and parties

This DPA forms part of the Terms from the moment the Customer starts using Team Workspace, and applies whenever we process Customer Personal Data. Nothing needs to be signed. If the Customer would like a countersigned copy, we will provide one on request.

Where this DPA conflicts with the Terms, this DPA controls for the processing of personal data. Where the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control.

2.Definitions

• "Data Protection Law" means every law on the protection of personal data that applies to the processing under this DPA, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP") and US state privacy laws such as the California Consumer Privacy Act ("CCPA").
• "Customer Personal Data" means the personal data in Team Workspace that we process on the Customer's behalf, as described in section 3.
• "Subprocessor" means a third party we engage to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Customer Personal Data. Unsuccessful attempts that do not compromise its security, such as blocked sign-in attempts or network scans, are not Security Incidents.
• "Standard Contractual Clauses" means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR, and "business" and "service provider" the meanings given in the CCPA.

3.What we process

This section also completes Annex I.B of the Standard Contractual Clauses.

4.The Customer's responsibilities

The Customer is the controller of Customer Personal Data, or a processor acting for its own customer, in which case it confirms that its instructions, and our engagement, are authorized by that controller.

The Customer is responsible for having a lawful basis for the processing and for the content its members share; for giving the notices and obtaining the consents Data Protection Law requires, including from people whose data appears in captures; for the instructions it gives and the settings its Admins choose; and for the accuracy of the member data it provides, including through single sign-on or SCIM.

Special categories of personal data, and data about children, should be shared through Team Workspace only after the Customer has assessed that it may do so, and only encrypted end to end.

5.Our obligations

• Instructions. We process Customer Personal Data only on the Customer's documented instructions: the Terms and this DPA, the Customer's use and configuration of Team Workspace, and any other written instructions we agree to, including on transfers. If the law requires us to process it in another way, we tell the Customer first, unless the law forbids that. We tell the Customer if we believe an instruction infringes Data Protection Law.
• No other use. We do not sell or share Customer Personal Data, use it for advertising, use it to train AI models, or combine it with other data, except as needed to provide Team Workspace or as Data Protection Law allows. We do not retain, use or disclose it outside our direct business relationship with the Customer. Under the CCPA and similar US laws we act as the Customer's service provider or processor, and we understand and comply with these restrictions.
• Confidentiality. Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality.
• Access to content. We access content in a workspace only to provide support the Customer asks for, to investigate security problems, abuse or reports of illegal content, or when the law requires it. We cannot read content that is encrypted end to end.
• Security. We implement the technical and organizational measures in Annex 2, which are appropriate to the risk. We may update them, provided the overall level of protection does not decrease.
• Assistance. Taking into account the nature of the processing and the information available to us, we help the Customer respond to requests from data subjects, and meet its obligations on security, breach notification, data protection impact assessments and prior consultation with authorities. Admins can do much of this themselves: view, download and delete shared items, and remove members. If a data subject contacts us about Customer Personal Data, we refer them to the Customer and do not answer the request ourselves unless the Customer asks us to.
• Records. We keep the records of processing that Data Protection Law requires of a processor.

6.Security incidents

We notify the Customer of a Security Incident without undue delay, and where feasible within 72 hours after becoming aware of it, by email to the workspace's Admins. The notice describes, as far as we know at the time, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. We provide further information as it becomes available, and take reasonable steps to contain and remedy the incident.

Notifying the Customer of a Security Incident is not an acknowledgement of fault or liability.

7.Subprocessors

The Customer authorizes us to engage Subprocessors. Our current Subprocessors are listed in Annex 3.

We give the Customer at least 30 days' notice before we add or replace a Subprocessor, by email to the workspace's Admins and on this page. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may end its Team Cloud subscription, and we refund the prepaid fees for the rest of its term.

We bind every Subprocessor by written contract to data protection obligations at least as protective as this DPA, and we remain responsible to the Customer for its performance.

8.International transfers

Customer Personal Data is stored in Cloudflare data centers in Europe. We and our Subprocessors may access and process it from other countries, including the United States, where we are established.

To the extent the Customer's use of Team Workspace involves a transfer of Customer Personal Data from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. For those clauses:

• the Customer is the data exporter and we are the data importer;
• the optional docking clause in Clause 7 applies;
• under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in section 7;
• the optional wording in Clause 11 does not apply;
• under Clause 13, the competent supervisory authority is the one competent for the Customer or, if the Customer has no establishment in the European Economic Area, the one of the Member State where its representative is established or, if it need not appoint one, of a Member State where the data subjects concerned are located;
• under Clauses 17 and 18, the law and courts of Ireland apply;
• Annex I is completed by sections 1 and 3 of this DPA, Annex II by Annex 2, and Annex III by Annex 3.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated. Its Tables 1 to 3 are completed by this DPA, in Table 4 neither party may end it, and its Mandatory Clauses apply.

For transfers from Switzerland, the Standard Contractual Clauses apply with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; the term "Member State" does not prevent data subjects in Switzerland from bringing claims where they habitually reside; and Swiss law governs to the extent the FADP requires.

If a transfer mechanism we rely on is invalidated, we will work with the Customer in good faith to put an alternative in place.

9.Audits and information

We make available to the Customer the information necessary to demonstrate compliance with this DPA, including answers to a reasonable security questionnaire once a year. If that information is not enough, or a supervisory authority requires it, the Customer or an independent auditor it appoints, bound by confidentiality, may audit our compliance once a year. Audits require 30 days' written notice, take place during business hours, must not disrupt our services or expose other customers' data, and are at the Customer's cost. Subprocessors are audited through the reports and certifications they make available.

10.Deletion and return

We delete the Customer Personal Data in a workspace when the Customer asks us to after its subscription ends, or when we delete a workspace that has been read-only for at least 90 days, which we do only after emailing its Admins at least 30 days in advance. Deleted data leaves our backups within 30 days. We keep Customer Personal Data beyond that only where the law requires us to, and then keep it confidential and process it only for that purpose.

11.Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent Data Protection Law allows. Nothing in this DPA limits the rights of data subjects under the Standard Contractual Clauses or Data Protection Law.

12.Term and changes

This DPA lasts for as long as we process Customer Personal Data. We may update it to reflect changes in the law, in regulators' guidance or in Team Workspace, but not in a way that materially reduces the protection of Customer Personal Data, unless the law requires it. We email Admins about a material change at least 30 days before it takes effect.

13.Annex 2: Security measures

• Encryption. Every connection to Team Workspace uses TLS, and Cloudflare encrypts stored data at rest. Members can encrypt items end to end on their own device, with keys that never reach our servers.
• Access control. Roles (Admin, Developer, Viewer) and sharing settings chosen by the Customer; single sign-on and SCIM; sign-in with email codes, passkeys or authenticator apps, with recovery codes; a recent sign-in required for sensitive changes; and security alerts by email.
• Sessions and secrets. Session cookies are HttpOnly, Secure and limited to our domain. Sign-in codes, tokens and recovery codes are stored only as hashes. Single sign-on credentials and authenticator secrets are encrypted.
• Data minimization. The apps remove common credential headers before upload by default. IP addresses used for abuse checks are stored only as keyed hashes. Shares can delete themselves on a date chosen when they are shared.
• Isolation. Shared content is displayed in a sandbox. Administrative interfaces cannot be reached without credentials, and administrative actions are logged.
• Availability and recovery. Team Workspace runs on Cloudflare's network, and its database can be restored to any point in the last 30 days.
• Abuse prevention. Rate limits, Cloudflare Turnstile on sign-in forms, automated checks against seat sharing, and an activity record Admins can review.
• People. Access to production systems is limited to the people who need it, under a duty of confidentiality.
• Incidents and vulnerabilities. A process for containing, investigating and notifying Security Incidents, and a published way to report vulnerabilities.

14.Annex 3: Subprocessors

The identity provider a Customer uses for single sign-on or SCIM is not our Subprocessor: the Customer chooses it and has its own agreement with it.

15.Contact

Routecore LLC publishes WireLens. Write to support@wirelens.app. We usually answer within one working day.

Routecore LLC 30 N Gould St, Ste N Sheridan, WY 82801 United States