Data processing agreement

Draft. This agreement is a starting point for review by Sharkbyte Corp and its legal counsel, and is not in force until published without this notice.

This agreement is part of every subscription to a hosted plan of Sharkhex Spaces. It applies where Sharkbyte Corp ("Sharkbyte") processes personal data on behalf of the subscriber ("the client") in running the client's platform, under the General Data Protection Regulation (EU) 2016/679 and the laws that implement it.

Roles

The client is the controller of the personal data on its platform: it decides who uses the platform and why. Sharkbyte is the processor: it runs the platform for the client and processes that data only to do so.

Subject, duration and purpose

Sharkbyte hosts, operates, secures and updates the client's Sharkhex Spaces platform for as long as the subscription runs, and keeps the platform's data for 30 days after the subscription ends, so that the client may come back or take its data; it then deletes the data. The purpose is to provide the platform the client subscribed to, and nothing else.

The data and the people it concerns

• People. The client's users: its members, guests and the administrators it appoints.
• Data. Names, email addresses and the identities of sign-in providers; profile pictures and avatars; presence, positions in the office and the rooms visited; chat messages and shared files; on the 75-person plan, recordings of meetings, kept 45 days; and technical data such as IP addresses and device information in the platform's logs.
• Special categories. None are needed to use the platform. The client does not ask its users to share them on the platform.

Sharkbyte's duties

Sharkbyte:

1. processes the data only on the client's documented instructions, which are this agreement, the platform's settings the client chooses and the client's written requests, unless the law requires otherwise, in which case it tells the client first where the law allows;
2. ensures that the people who can reach the data are bound to confidentiality;
3. takes appropriate technical and organisational measures: the platform runs on servers of its own region, with its files in a storage bucket of its own, encrypted connections, access limited to the staff who operate it, and updates applied as they are released;
4. engages the subprocessors below, and tells the client of a new one at least 30 days before it starts, so that the client may object, and end the subscription if Sharkbyte cannot meet the objection;
5. helps the client, as far as it can, to answer the requests of its users to exercise their rights, and with security, impact assessments and consultations with authorities;
6. tells the client of a personal data breach on its platform without undue delay, and within 48 hours of learning of it, with what it knows and what it does about it;
7. deletes the data 30 days after the subscription ends, or hands it over before then if the client asks, and keeps no copy unless the law requires one;
8. makes available to the client the information needed to show that it meets this agreement, and allows audits by the client or an auditor it mandates, on reasonable notice and at the client's cost.

Subprocessors

Transfers

The platform's data stays in the region the client chose when it set up its workspace. Where a subprocessor processes data outside the European Economic Area, Sharkbyte relies on the standard contractual clauses of the European Commission, or another lawful basis for the transfer.

Liability

Each party's liability under this agreement follows the terms of service of the subscription.

Law

This agreement is governed by the laws of Romania, and its courts settle any dispute about it.