Data Processing Addendum
In short: if the app you connect contains personal data about your users, you control that data and we process it only to perform your review, under the commitments below. Contact hello@safe2vibe.com if you need a signed copy.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Safe2Vibe and the customer ("Customer") and applies when Safe2Vibe processes Customer Personal Data in providing the Service.
1. Definitions
- Customer Personal Data: personal data contained in the apps, repositories, databases or content the Customer connects to the Service.
- Data Protection Laws: all laws that apply to the processing, including, where applicable, the EU and UK GDPR, the CCPA, Brazil's LGPD and Colombia's Law 1581 of 2012.
- Subprocessor: a third party engaged by Safe2Vibe that may process Customer Personal Data.
Other terms such as "controller", "processor" and "personal data breach" have the meaning given in the GDPR.
2. Roles
The Customer is the controller (or acts on behalf of the controller). Safe2Vibe is a processor and processes Customer Personal Data only on the Customer's documented instructions, which consist of the Terms, this DPA and the Customer's use of the Service.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter | Security, privacy and quality review of the Customer's app |
| Duration | The term of the Customer's subscription, plus the deletion period in section 9 |
| Nature and purpose | Read-only access, automated scanning and human review to identify and explain issues |
| Data subjects | The Customer's end users and staff whose data is present in the connected app |
| Categories of data | Whatever the Customer's app contains, typically names, emails, account identifiers and usage data |
| Special categories | Not intended. The Customer should tell us before connecting apps that hold health, financial or other sensitive data |
4. Safe2Vibe's obligations
Safe2Vibe will:
- process Customer Personal Data only to provide the Service and not for its own purposes, including not to train AI models;
- access only the data needed for the review and avoid copying it outside the Service;
- ensure that staff and Reviewers with access are bound by confidentiality;
- implement the technical and organizational measures described on our Security page;
- assist the Customer, as reasonably possible, with data subject requests, security, impact assessments and consultations with authorities;
- tell the Customer if it believes an instruction infringes Data Protection Laws.
5. Subprocessors
The Customer authorizes Safe2Vibe to use the Subprocessors listed on our Subprocessors page. Safe2Vibe will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for their performance. Safe2Vibe will give at least 30 days' notice before adding or replacing a Subprocessor, and the Customer may object on reasonable grounds; if we can't resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for it.
6. International transfers
Where Customer Personal Data is transferred to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) and, for the UK, the UK Addendum, which are incorporated by reference.
7. Personal data breaches
Safe2Vibe will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably needed for the Customer to meet its own obligations.
8. Audits
Safe2Vibe will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer may audit, at its own cost, no more than once a year, with 30 days' notice, during business hours and under confidentiality, unless an audit is required by an authority or follows a personal data breach.
9. Deletion and return
Within 30 days after the end of the Service, or earlier when the Customer disconnects an app, Safe2Vibe will delete Customer Personal Data, unless the law requires it to keep it. Review reports that don't contain Customer Personal Data may be kept for the Customer's account history.
10. Precedence
If this DPA conflicts with the Terms regarding Customer Personal Data, this DPA prevails. If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.