Data Processing Addendum

The short version. You decide what your forms collect. We process responses only to run Kibble for you, keep them secure, and help you meet your obligations. We use the providers listed on our Subprocessors page and tell you before adding one. We'll let you know quickly about a breach, and we delete your data when you ask or when you leave. For transfers out of the EU, UK and Switzerland, the Standard Contractual Clauses apply.

This addendum is part of our Terms of Service and applies automatically, so there's nothing to sign. If your procurement process needs a countersigned copy, email [email protected].

This Data Processing Addendum ("DPA") is between Mirio, Inc. ("Kibble", "we") and the customer that has accepted our Terms of Service ("you"). Capitalized words not defined here mean what the Terms define them to mean.

#1. Definitions

• Data Protection Laws: all laws on personal data that apply to the processing of Customer Personal Data under the agreement. These include:
  • the EU General Data Protection Regulation ("GDPR");
  • the UK GDPR and Data Protection Act 2018;
  • the Swiss Federal Act on Data Protection ("FADP");
  • the California Consumer Privacy Act ("CCPA") and other US state privacy laws.
• Customer Personal Data: personal data in Your Content that we process on your behalf. This is mainly Responses, plus the email addresses you set for notifications.
• Controller, processor, data subject, personal data, processing, supervisory authority: these have the meanings given in the GDPR. "Processor" includes a "service provider" and "contractor" under US state laws.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• Subprocessor: a third party we engage to process Customer Personal Data.
• SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

#2. Roles and scope

Roles. You are the controller of Customer Personal Data, or a processor acting for your own clients, and we are your processor. If you act for a client, you confirm that your client has authorized these instructions and our appointment, and you'll pass on any communication we need to send them.

Our own data is not covered. This DPA doesn't cover personal data we control for ourselves, such as your account details, billing and our own security logs. Our Privacy Policy covers that.

Details of the processing. Annex 1 describes the processing: its subject, duration, nature and purpose, and the types of data and data subjects.

#3. Processing only on your instructions

We process Customer Personal Data only on your documented instructions. Those instructions are:

• the agreement;
• how you set up and use the Service, such as your forms, triage settings, Destinations and deletions;
• other written instructions you give us that we accept as consistent with the agreement.

We also process Customer Personal Data where the law requires it. If so, we'll tell you first, unless that law forbids it.

We'll tell you promptly if we believe an instruction breaks Data Protection Laws. In that case we may pause the affected processing until you confirm or change the instruction.

#4. Your responsibilities

You're responsible for:

• having a lawful basis for the processing;
• giving data subjects the notices required, and getting any consent required, including for browser storage used by the attribution feature;
• the accuracy and lawfulness of Customer Personal Data;
• following the Acceptable Use Policy on sensitive data;
• the Destinations you choose.

#5. Confidentiality

We give access to Customer Personal Data only to staff and contractors who need it to provide, support or secure the Service. Everyone with access is bound by confidentiality obligations.

#6. Security

We'll implement and maintain the technical and organizational measures described in Annex 2 (our Security page), which protect Customer Personal Data to a level appropriate to the risk. We may update these measures, but we won't make them materially less protective.

#7. Subprocessors

General authorization. You authorize us to use Subprocessors. The current list, with what each one does and where, is on our Subprocessors page.

Notice of changes. We'll add a new Subprocessor to that page at least 15 days before it processes Customer Personal Data. To be emailed when the list changes, ask at [email protected]. In an emergency, for example to replace a failing provider to keep the Service running or secure, we may make the change first and give notice as soon as we can.

Objecting. You can object to a new Subprocessor on reasonable data protection grounds within the notice period, by emailing [email protected]. We'll try in good faith to resolve the objection, for example by offering a way to avoid that Subprocessor, such as turning triage off. If we can't resolve it, you may end the agreement for the affected part of the Service, and we'll refund any fees you've paid for the time after it ends.

Our obligations. Each Subprocessor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain responsible for our Subprocessors' compliance.

Destinations aren't Subprocessors. Services you connect as Destinations, such as Slack, your webhooks and your database, receive data because you instruct us to send it. They are your recipients, not our Subprocessors.

#8. Helping you with data subject requests

The dashboard lets you:

• find and delete every response submitted to a form with an email address;
• delete individual responses, or all of a form's responses;
• export responses.

Requests we receive. If a data subject contacts us about Customer Personal Data, we'll pass the request to you without undue delay and won't respond ourselves, except to say we've passed it on, unless you ask us to.

Other help. We'll give you reasonable help with requests you can't handle using the dashboard.

#9. Personal Data Breaches

If we become aware of a Personal Data Breach, we'll notify your Workspace owners without undue delay. As it becomes available, we'll tell you:

• the nature of the breach;
• the data and data subjects affected and roughly how many;
• the likely consequences;
• the steps we're taking.

We'll take reasonable steps to contain and fix the breach, and we'll help you with any notice you need to give to authorities or data subjects. Notifying you of a breach isn't an admission of fault.

#10. Impact assessments and consultations

Taking into account what information we have, we'll give you reasonable help with data protection impact assessments and with consultations with supervisory authorities about our processing.

#11. Deletion and return

While the agreement lasts, you can delete or export Customer Personal Data in the dashboard at any time, including deleting a site or the whole Workspace.

When it ends, you have 30 days to export Your Content, unless you deleted the Workspace yourself, which deletes its data straight away. We then delete Customer Personal Data from our live systems within 30 days. Backups are deleted as they expire, within a further 30 days. We keep data longer only where the law requires us to, and then only for that purpose and with this DPA still applying.

Sandbox projects. Responses sent to sandbox projects are deleted 72 hours after they're created.

#12. Information and audits

On request, we'll make available the information reasonably needed to show that we comply with this DPA. That includes:

• our Security page;
• our answers to a reasonable security questionnaire, once a year;
• relevant reports or certifications from our main hosting Subprocessors.

On-site audits. If that information isn't enough to show compliance, or a supervisory authority requires it, you may audit our processing, either yourself or through an independent auditor bound by confidentiality. The conditions are:

• at least 30 days' written notice;
• during business hours;
• no more than once in any 12 months, unless there's been a Personal Data Breach;
• at your expense;
• in a way that doesn't disrupt the Service or expose other customers' data.

#13. International transfers

Where data is. Kibble stores Customer Personal Data in the EU. Some processing happens in the US: by us, since Mirio, Inc. is a US company, and by the Subprocessors listed as US-based.

From the EU (EEA). For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the SCCs are incorporated into this DPA, and by accepting the Terms both of us are treated as having signed them. The SCCs apply as follows:

• Module Two (controller to processor) applies where you are a controller.
• Module Three (processor to processor) applies where you are a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general authorization) applies, with the notice period in section 7 of this DPA.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is determined by Clause 13(a).
• Clause 17: Option 1 applies; the governing law is that of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.
• Annexes. Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by our Subprocessors page.

From the UK. For transfers from the UK, the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner applies to the SCCs. Its tables are completed with the information in this section and the Annexes. Either of us may end it as allowed by its Section 19.

From Switzerland. For transfers from Switzerland, the SCCs apply with these changes:

• The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers.
• References to the GDPR include the FADP.
• "Member State" doesn't stop data subjects in Switzerland from bringing claims where they live.

Other mechanisms. Where a recipient is certified under the EU-US Data Privacy Framework or its UK and Swiss extensions, we may rely on that as well. If a transfer mechanism we rely on is invalidated, we'll work with you to put a valid alternative in place.

Conflicts. If the SCCs conflict with this DPA or the Terms, the SCCs win.

#14. US state privacy laws

Where the CCPA or another US state privacy law applies, we act as your service provider or processor. We will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside our direct business relationship with you;
• combine it with personal data from other sources, except as those laws allow.

We will:

• comply with those laws and give Customer Personal Data the same level of protection they require;
• tell you if we can no longer meet our obligations under them;
• allow you to take reasonable steps, through section 12, to make sure we use the data consistently with those laws, and to stop and fix any unauthorized use.

We understand these restrictions and will comply with them.

#15. General

How long this DPA lasts. This DPA applies for as long as we process Customer Personal Data.

Liability. Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs don't allow liability to be limited.

Which document wins. If this DPA conflicts with the Terms, this DPA wins on the processing of Customer Personal Data.

Changes. We may update this DPA to reflect changes in law or in the Service. We won't reduce your protections without the notice the Terms require.

#Annex 1: Description of the processing

The parties

	Data exporter	Data importer
Who	The customer, as identified in its Workspace	Mirio, Inc. (Kibble)
Contact	The Workspace owners' email addresses	[email protected]
Role	Controller, or processor for its own clients	Processor (or subprocessor)
Activities	Using Kibble to collect and handle form responses	Providing the Service

Data subjects:

• people who submit the customer's forms;
• people those submissions mention;
• people the customer chooses to notify of responses.

Types of personal data:

• Answers. Whatever the customer's forms ask for. Typically name, email address, company, role, phone number and free text, and answers to hidden fields set by the customer's site.
• Technical data. The address of the page with the form, without its query string. Where the visitor came from: a path on the same site, another site's domain, the visit's landing page and its campaign tags. Also the browser's user agent, the country, and a hashed IP address that's salted per site.
• Spam signals and checks. The spam score and its reasons, the email domain's type and mail records, duplicates on the same form, and submissions from the same hashed IP address on the same site in the past hour.
• Triage outputs, if triage is on: a summary, a category, a fit level and its reason, the facts the person stated, and spam advice. Also the customer's corrections to them.
• Delivery records. Whether each delivery to a Destination arrived, and a short excerpt of the Destination's reply.
• Notification addresses. Email addresses the customer chooses for notifications.

Sensitive data. None is intended. The Acceptable Use Policy forbids collecting credentials, payment card numbers, government ID numbers and HIPAA health information, and limits other special categories of data. Safeguards include:

• checks that refuse form fields that look like passwords, card numbers or social security numbers;
• the measures in Annex 2.

Frequency. Continuous, for as long as the customer uses the Service.

Nature of the processing:

• receiving, validating and storing responses;
• spam filtering and checks;
• AI triage, if turned on;
• delivering responses to the customer's Destinations;
• showing them in the dashboard;
• exporting and deleting them;
• backups.

Purpose. To provide the Service to the customer under the agreement, including keeping it secure and preventing abuse.

How long. For the term of the agreement, then as section 11 describes. Responses sent to sandbox projects are kept for 72 hours.

Subprocessors. As listed on the Subprocessors page, for the purposes and in the locations given there, for as long as the customer uses the Service.

Competent supervisory authority. As set out in Clause 13 of the SCCs, or for Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

#Annex 2: Technical and organizational measures

The measures are described on our Security page, which forms this Annex.

#Annex 3: Subprocessors

The list is on our Subprocessors page, which forms this Annex.