This data processing agreement ("DPA") is part of the terms of service between the customer that uses a Notulous workspace ("the customer", the controller) and [COMPANY NAME], [ADDRESS], KvK [KVK NUMBER] ("Notulous", the processor). It applies automatically to every workspace, so you don't need to sign anything. If your organisation needs a signed copy, email privacy@notulous.com.
Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Subject and roles
Notulous processes personal data for the customer in order to provide the Notulous service, as described in Annex 1.
The customer is the controller of that personal data, and Notulous is the processor. The customer is responsible for having a legal basis for the processing, and for the instructions it gives.
This DPA lasts as long as Notulous processes personal data for the customer, including the time needed to delete it after the subscription ends.
2. Instructions
Notulous processes the personal data only on the customer's documented instructions. These terms, this DPA, and what the customer and its users set up and do in the workspace are those instructions.
Notulous doesn't use the personal data for its own purposes, and doesn't sell it.
If the law requires Notulous to process the data otherwise, Notulous tells the customer first, unless the law forbids that.
Notulous tells the customer if it thinks an instruction breaks the GDPR.
3. Confidentiality
Notulous makes sure that everyone who can access the personal data is bound to confidentiality, and only accesses it where needed for the service, for support the customer asks for, or to keep the service secure.
4. Security
Notulous takes appropriate technical and organisational measures to protect the personal data, taking into account the state of the art, the costs, and the risks for data subjects. Annex 2 lists them.
Notulous may improve these measures over time, as long as the level of protection doesn't go down.
5. Sub-processors
The customer gives Notulous general permission to use sub-processors. Annex 3 lists the current ones.
Notulous announces a new or replaced sub-processor at least 30 days in advance, by email to the workspace's admins. The customer may object on reasonable grounds within that period. If the parties can't resolve the objection, the customer may cancel the subscription with a pro rata refund of a prepaid period.
Notulous gives each sub-processor the same data protection obligations as in this DPA, and stays responsible to the customer for its sub-processors.
6. Transfers outside the EEA
The workspace databases, files and backups are stored in the European Union. Where a sub-processor processes personal data outside the European Economic Area, Notulous makes sure an adequate safeguard is in place, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. Helping the customer
Requests from data subjects. Admins can view, correct, export and delete the data in the workspace themselves. Where they can't, Notulous helps the customer answer requests from data subjects. If a data subject contacts Notulous directly, Notulous passes the request on to the customer and doesn't answer it on its own.
Other obligations. Notulous helps the customer, where reasonable, with data protection impact assessments, prior consultation with a supervisory authority, and security, based on the information available to Notulous.
Help that goes beyond what the service already offers may be charged at our usual rates, after notice.
8. Personal data breaches
Notulous notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach that affects the customer's personal data.
The notification describes, as far as known: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Notulous adds information as it becomes available.
Notulous takes the measures needed to limit the breach and its consequences. Deciding whether to notify the supervisory authority or data subjects is up to the customer.
9. End of the processing
While the workspace is active, admins can export all of its data at any time.
After the subscription ends, Notulous keeps the data for 30 days so the customer can reactivate the workspace. Notulous then deletes it. Copies in backups are deleted within another 30 days.
If the law requires Notulous to keep some data longer, Notulous keeps only that data, protects it under this DPA, and deletes it when the obligation ends.
10. Audits
On request, Notulous gives the customer the information needed to show that it meets this DPA, such as a description of its security measures.
If that isn't enough, the customer may have an audit done once a year, by an independent auditor bound to confidentiality, after at least 30 days' notice, during office hours and without disturbing the service for other customers. The customer bears the costs of the audit.
11. Liability and precedence
The liability of the parties under this DPA follows the limits in the terms of service, as far as the law allows.
If this DPA and the terms of service conflict on the protection of personal data, this DPA prevails.
Dutch law applies to this DPA, and disputes go to the court named in the terms of service.
Annex 1: The processing
Purpose and nature
Providing Notulous to the customer: storing, showing, searching, sending (in notifications and integrations the customer turns on), exporting, backing up and deleting the data in the workspace.
Categories of data subjects
The customer's employees and other members of its workspace.
The customer's clients and other guests it invites.
People mentioned in the content the customer adds, such as contacts at a client.
Categories of personal data
Account data: name, email address, job title and role, profile picture, the company someone belongs to, settings, password hash, two-factor sign-in secret, and sign-in sessions.
Content: issues, comments, notes, documents and files, releases, boards, and everything users write in them, which may contain any personal data the customer chooses to add.
Time data: time entries, timers, hourly rates, and reports and invoice exports made from them.
Technical data: IP addresses and other request data in server logs.
The service isn't meant for special categories of personal data (article 9 GDPR) or data about criminal convictions. The customer decides whether to put such data in Notulous, and is responsible for doing so.
Duration
For as long as the subscription runs, and up to 60 days after it ends (30 days to reactivate, and 30 days more for the backups).
Annex 2: Security measures
Separation and storage
Every workspace has its own database and its own database login, which can only open that database. The workspace's database credentials are stored encrypted (AES-GCM).
The databases, files and backups are stored in data centres in Germany.
Passwords are never stored, only their Argon2 hashes.
Access
Users sign in with a password and, if they turn it on, a second factor (an authenticator app), or with Google.
Sign-in attempts are limited per account and per network address. Sign-in sessions can be ended by signing out.
Admins decide who can access the workspace and which projects users and guests see.
Access to the production servers is limited to authorised people, with personal SSH keys. The accounts at our hosting and service providers use two-factor sign-in.
In transit
All connections use HTTPS (TLS), with HSTS. The databases can't be reached from the internet.
Availability
Backups of every database are made every hour, stored apart from the servers, and kept for 30 days. Restoring them is tested regularly.
The servers get security updates automatically, and the software is updated at least once a month.
Organisation
Logs are kept for up to 30 days.
Security incidents are handled following section 8, and recorded.
Annex 3: Sub-processors
Hetzner Online GmbH, Germany: hosting of the servers, databases and backups, in Germany.
[OBJECT STORAGE PROVIDER], [COUNTRY]: storage of uploaded files and backups, in [REGION].
Mailtrap, [MAILTRAP COMPANY AND COUNTRY]: sending the emails of the service, such as invites and notifications.
Google Ireland Limited, Ireland: sign-in with Google, for users who choose it.
The customer's own integrations (such as Slack, or imports from Jira, Asana and Trello) are services the customer chooses and connects itself; they are not sub-processors of Notulous.