Data Processing Addendum

1. Subject matter and duration

The Processor processes personal data only to provide the Bravyn shared inbox and customer support service to the Controller, for the duration of the subscription and the deletion period described in section 10.

2. Nature and purpose

Receiving, storing, organizing, displaying and sending email messages; assigning conversations, recording statuses, notes and tags; applying routing rules configured by the Controller; computing response-time figures; backing up and securing the data; and providing support at the Controller’s request.

3. Categories of data subjects and data

• Data subjects: the Controller’s customers and other people who write to, or are written to from, the connected addresses; the Controller’s users.
• Data: names, email addresses, message content and attachments, metadata such as dates and headers, and any other data the senders include in their messages, plus notes and tags added by users.

The Controller should not use the Service to process special categories of data unless it has a lawful basis to do so and has informed the Processor in writing.

4. Instructions

The Processor processes personal data only on the documented instructions of the Controller, which consist of these Terms, this DPA and the Controller’s use and configuration of the Service. The Processor informs the Controller if it believes an instruction breaks applicable data protection law. The Processor does not sell the data, does not use it for advertising, and does not use it for its own purposes.

5. Confidentiality

People authorized by the Processor to process the data are bound by confidentiality obligations and access the data only as needed to provide the Service or support requested by the Controller.

6. Security

The Processor implements appropriate technical and organizational measures, including encrypted connections (HTTPS), password-protected accounts with role-based access, restricted internal access, and backups. Measures are reviewed as the Service evolves.

7. Sub-processors

The Controller authorizes the Processor to use sub-processors, such as its hosting provider and email delivery provider, under written terms that impose data protection obligations no less protective than this DPA. The list of sub-processors is available on request at contact@bravynllc.com. The Processor will notify the Controller of new sub-processors in advance; the Controller may object on reasonable grounds and, if no solution is found, cancel the affected Service.

8. Assistance

Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects, and with security, breach notification and impact assessments where required by law.

9. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with the information reasonably available, and keeps the Controller informed of the measures taken.

10. Return and deletion

During the subscription, admins can export conversations. At the end of the subscription the Controller may export its data for 30 days. After that period the Processor deletes the Controller’s data from the active systems, and from backups within their normal rotation, unless the law requires it to be kept.

11. Audits and information

The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA and answers written questions from the Controller. Any on-site audit is agreed in advance, at the Controller’s cost, with reasonable notice and confidentiality.

12. International transfers

The Processor is based in the United States. Where the Controller is subject to laws that restrict transfers of personal data to the United States, the parties will put in place the safeguards those laws require.

13. Precedence

In case of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.