Data Processing Agreement
This agreement forms part of the Terms of Service between you (the “Controller”) and Skiwo AS (the “Processor”). It governs the personal data we process on your behalf when you use the service, as Article 28 of the GDPR requires. It applies on every plan, Free included, and needs no signature.
Roles
You are the controller of the personal data you and your users put into the service. Skiwo AS is the processor. On data protection, this agreement prevails over anything in the Terms that conflicts with it.
Details of processing
Subject matter: providing the service. Duration: for as long as the workspace exists, plus the time it takes to delete the data. Nature and purpose: storing, displaying, organising and sending what you put into the service, as its features do. Data subjects: the people whose data you put in, such as your staff, customers and contacts. Categories: typically contact details, the content of documents and messages, and records of use.
Instructions
We process personal data only on your documented instructions, including those you give through the product, unless the law requires otherwise. If it does, we tell you first where the law allows it.
Confidentiality
Everyone we authorise to process personal data is bound by confidentiality and accesses it only as needed to provide the service.
Security
We take appropriate technical and organisational measures, including encryption in transit and at rest, access control, separation between workspaces, logging and tested backups.
Subprocessors
You authorise the subprocessors we use to run the service: hosting and file storage in the EU, delivery of email and text messages, and, where a feature uses AI, an AI model provider. We give notice before adding or replacing one, and you may object on reasonable data-protection grounds. Each is bound by obligations equivalent to these.
A current list is available on request.
Helping you answer the people concerned
Taking the nature of the processing into account, we help you respond to requests from data subjects, including with the export and deletion tools in the product.
Helping you with your own duties
We help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us.
Personal data breach
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own notification duties.
International transfers
Your data is stored in the EU. Where a transfer outside the EEA is necessary, it is covered by the EU Standard Contractual Clauses or another lawful transfer mechanism.
Export and deletion
You can export your data with the export tools in the product for as long as you can sign in to the workspace. When the workspace is deleted, we delete the personal data in it, unless the law requires us to keep it, and the copies in our backups are overwritten as those backups expire.
Audits
We make available the information necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections by an auditor you mandate, on reasonable notice and subject to confidentiality.
Liability
The liability terms of the Terms of Service apply to this agreement.
A custom agreement
Where your plan or a separate agreement with us provides one, a workspace can have a data processing agreement of its own: on your template, or with terms agreed with you. The product's pricing page says which plan, if any, includes it. Until one is signed, this agreement applies.
Questions about this agreement: privacy@skiwo.com