Data processing agreement

This data processing agreement (“DPA”) forms part of the Terms of service between you, the customer (“Controller”), and [legal entity name] (“Processor”).

1. Subject matter

The Processor provides a shared support inbox. To do so it processes personal data contained in emails and chat messages that the Controller’s customers send, and in replies and notes the Controller’s team writes.

2. Categories of data and data subjects

• Data subjects: the Controller’s customers and prospects who contact them, and the Controller’s team members.
• Personal data: names, email addresses, message content, and anything else people choose to include in a message.
• Special categories: not intended. [Confirm.]

3. Processor obligations

The Processor will process personal data only on the Controller’s documented instructions, keep it confidential, apply appropriate security measures, and help the Controller respond to data subject requests.

4. Security measures

The measures in place today are described on our Security page. They include AES-GCM encryption of mailbox OAuth tokens, salted password hashing, hashed session tokens and API keys, and per-workspace isolation of data. [Attach as Annex II.]

5. Sub-processors

[Confirm the list, locations, and the notice period for adding new sub-processors.]

6. International transfers

[Describe transfer mechanisms, e.g. Standard Contractual Clauses.]

7. Breach notification

[Set the notification window and contents.]

8. Deletion and return

[Describe what happens to personal data when the agreement ends.]

9. Audits

[Describe how the Controller can verify compliance.]

To sign a DPA with Tikkaroo before this page is final, email hello@tikkaroo.com.