Data processing agreement

This data processing agreement ("DPA") is between the customer that accepts it ("you", the controller) and Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA ("we", the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing Programmable Apps. To accept it, email [email protected] from your account's address with your company name; we'll countersign and return a copy. It applies from that date, and to processing that has already taken place under your account.

1. What we process for you

• Subject matter and purpose: running the apps you make: calling the services you connected when one of your panels runs, showing the result to you, holding your apps, share links and domains, and counting how often your links are opened.
• Personal data: whatever the services you connect return to your panels, and the accounts of people you share a link with. What your apps show and who you share them with is decided by you, not by us. It must not include special categories of data (health, religion, politics, sexual orientation and the like) or data about children unless the law allows it and you have the safeguards it requires.
• Data subjects: your customers, contacts and staff whose records your connected services hold, and the people you share links with.
• Duration: panel results are not kept after they are shown unless you save a snapshot; 90 days for the link-open log; the life of your account for your apps and credentials, deleted within 30 days of its closure.

2. Our obligations as processor

• We process personal data only on your documented instructions, which are the Terms, this DPA, and what your apps do when you or the people you share them with run them. We'll tell you if we think an instruction breaks the law.
• We keep the personal data we process for you confidential, and everyone who works on the service is bound by confidentiality.
• We keep the security measures in section 5, and won't reduce them during the term.
• We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the service allows and given what we hold (which for the content of calls is nothing).
• We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we're doing.
• On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it.
• We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.

3. Your obligations as controller

You are responsible for having a lawful basis for the personal data your calls carry, for the rules you give your access keys, for the approvals you grant, for honouring the rights of the people concerned, and for your agreements with the services your apps call, and for having the right to show the data you share. You warrant that your instructions to us are lawful.

4. Subprocessors

You authorise the subprocessors below. We'll email account owners at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can't resolve it, end the affected service.

The services you connect and call with your own credentials are engaged by you directly and are not our subprocessors.

5. Security measures

• The arguments and responses of calls are handled in memory to deliver them; they are not written to a database, apart from a one-way fingerprint and the outcome in the activity log.
• Encryption in transit everywhere (TLS 1.2+); saved credentials encrypted at rest in a secrets vault; access keys stored as hashes and shown once.
• Every call is checked against the key's rules before it runs; writes can be held for a person's approval; each approval runs one call, once.
• Servers reachable only through Cloudflare; firewalling on ingress and egress; SSH by key only; no shared accounts.
• Access to production is limited to the people who operate the service, with logging.
• Error reports have credentials and arguments stripped before they leave the server.

6. Where data is processed

Our servers, database and authentication are in the United States, and our subprocessors are listed in section 4. Where you are established in the EU, the EEA or the UK, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.

7. General

If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 6 says otherwise. Questions: [email protected].