Data Processing Agreement

This document forms part of the agreement between SIVO Hub and the subscribing organisation.

This agreement governs the personal data your organisation puts into SIVO Hub. For that data you are the controller and we are your processor. It is required by Article 28 of the GDPR and applies automatically to every customer: there is nothing to sign and nothing to request.

1. The parties and how this fits together

Controller: the organisation subscribing to SIVO Hub. Processor: CHRISTIAN CILIA, Malta.

This agreement is part of the Terms of Service and is accepted with them. Where it conflicts with the Terms on the handling of personal data, this agreement wins. “GDPR” means Regulation (EU) 2016/679 as it applies in Malta, together with the Maltese Data Protection Act and subsidiary legislation made under it.

Separately from this agreement we are a controller in our own right for a small set of data about the running of the account: who signed in, who was invoiced, who wrote to support. That is described in the privacy notice and is not covered here.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the SIVO Hub support desk software to the controller.
• Duration: for as long as the subscription lasts, plus the retention period in section 9.
• Nature and purpose: hosting, storing, organising, displaying, transmitting, backing up, and finally erasing the records the controller and its users create in the workspace, sending the notifications the controller configures, and keeping the service secure and accountable.
• Types of personal data and categories of data subject: Annex 1.

3. Processing only on your instructions

We process personal data in your workspace only on your documented instructions, which are: this agreement, the Terms of Service, and what your own users do inside the product. We will not process it for any other purpose, and in particular we will not use it to train models, to build profiles, to market anything to anyone, or to derive statistics about your business.

Where the law requires us to process it for another reason, we will tell you before doing so unless that law forbids us from telling you. If we consider an instruction from you to breach data protection law, we will say so.

We may open a record in your workspace only to investigate a fault you or the system reported, or to carry out something you asked us to do. When that happens it is written to the audit log in your own workspace, where your administrators can read it.

4. Confidentiality

Access to production systems is limited to people who need it to run the service, and they are bound by an obligation of confidentiality. SIVO Hub is operated by one person, so this is a short list rather than a policy applied to a department. If that changes, this section changes with it.

5. Security

We take appropriate technical and organisational measures under Article 32. They are set out, without decoration, on the security overview page, which also states the measures we do not have. That page is Annex 2 to this agreement, and we will not knowingly weaken what it describes during your subscription.

6. Subprocessors

You give us general authorisation to engage the subprocessors listed on the subprocessors page. Each is engaged under a written contract imposing data protection obligations no less protective than these, and we remain fully liable to you for their performance.

Before adding or replacing a subprocessor we will give you at least 30 days’ notice by email to an administrator on the account. If you reasonably object on data protection grounds within that period, tell us and we will work with you to find an alternative. If we cannot, you may terminate the affected part of the subscription and we will refund the unused part of any period you have paid for.

7. Helping you answer your data subjects

People whose data is in your workspace exercise their rights against you, not against us, and the product is built so that you do not need us in order to answer them:

• Access and portability: Company details in the product exports the entire workspace as spreadsheets plus the original uploaded files, at any time, with no notice to us.
• Rectification: your administrators can edit the records directly.
• Erasure: your administrators can delete tickets, assets and accounts, and can empty the recycle bin to erase them permanently.
• Restriction and objection: accounts can be suspended and access withdrawn.

If a request nevertheless reaches us directly, we will not answer it ourselves. We will pass it to you promptly and, where you ask, help you deal with it at no charge for anything reasonable.

8. Breaches, impact assessments and consultation

If we become aware of a personal data breach affecting your data we will notify you without undue delay and in any event within 24 hours of becoming aware of it, at the administrator addresses on your account. The notification will describe what happened, which categories and roughly how many records are affected so far as we know, the likely consequences, and what we are doing about it. We will send it even where those facts are still incomplete rather than waiting until they are not.

The 72 hour notification to the supervisory authority under Article 33 is yours to make. We will give you what you need to make it. We will also give you reasonable help with data protection impact assessments and prior consultations under Articles 35 and 36.

9. Deletion and return

• Take your own export before you leave. It is available to you at any time and does not depend on us.
• When the subscription ends, the workspace is retained in a locked state for 60 days. During that window you may ask us to reactivate it or to produce an export, and we will.
• After that window we delete the workspace and everything in it: all records and all uploaded files, including anything sitting in the recycle bin. Deleting a company from the platform removes the rows and the files together, and empties the folders they were stored in.
• Backups are the exception, and they are the honest exception. Copies of the database and files persist in encrypted-in-transit backup snapshots for up to 30 days on our own storage and, in an offsite copy kept without automatic pruning, for longer. Those snapshots are not accessible to the product and are not used for any purpose other than restoring the service after a failure. They are overwritten in the ordinary cycle. If a restore ever reinstates deleted data, we will re-apply the deletion.
• Entries in our own audit log recording that an action happened, and records we must keep for tax or accounting purposes, are retained under section 1’s controller relationship rather than deleted here. Concretely, that means the invoices we issued to you for your own subscription: deleting a workspace detaches them from it but does not destroy them, because they are our sales records and a business is required to keep those for years after the sale. The invoices you raised to your clients inside the product are your data, not ours, and they are deleted with everything else.
• The record of your acceptance of this agreement is also kept. Deleting a workspace detaches that record from it but does not destroy it: it keeps the accepting address, the organisation name, the time and which versions of which documents were accepted. It is retained for the establishment and defence of legal claims under Article 17(3)(e), on both sides, since it is equally the evidence of what we committed to, and for nothing else.

10. Information and audits

We will make available the information reasonably needed to show we are meeting these obligations. In the first instance that is this agreement, the security overview and the subprocessor list, together with any question you want to put to us in writing.

Where that is not enough, you may audit us, or appoint an independent auditor to, on 30 days’ notice, no more than once a year unless a breach or a regulator says otherwise, during working hours, without disrupting the service and without access to any other customer’s data. You bear your own costs and the auditor must be bound by confidentiality.

We hold no security certification. There is no ISO 27001 certificate, no SOC 2 report and no third-party penetration test to hand you in place of an audit. That is stated here rather than left for you to discover during procurement.

11. Where the data is

The application, its database, uploaded files and the primary backups are hosted in the European Union, and the offsite backup copy is held in Finland. Some of our subprocessors are companies incorporated outside the EEA, which means a transfer can occur. The subprocessors page names each one, says where it is incorporated, and states the transfer safeguard relied on. Where an adequacy decision does not apply, we rely on the European Commission’s standard contractual clauses as incorporated in that provider’s data processing terms.

12. Language

This agreement is written in English and the English version governs. Any translation is provided for convenience only, and where a translation and the English differ, the English applies. The product interface is available in other languages. The contract is not translated, because a mistranslated processing term is a different obligation from the one either party agreed to.

13. Liability and duration

This agreement takes effect when you accept the Terms of Service and lasts as long as we process personal data for you. The limits of liability in the Terms of Service apply to this agreement too, except where the GDPR does not permit them to.

Annex 1: What is actually processed

Built from the database schema rather than from a template, so it says what the product holds rather than what a document of this kind usually says.

Categories of data subject

• People in the controller’s organisation who hold an account: administrators and agents.
• People in the controller’s organisation who raise requests but do not answer them.
• Contacts at the controller’s own client businesses, where the controller records them.
• Anyone the controller’s users choose to name in a ticket, a message, a note or an attachment. This is open-ended by nature and is under the controller’s control, not ours.

Categories of personal data

• Account: name, work email address, role, status, sign-in method, invitation records, and the times of account creation and last sign-in.
• Requests: ticket subject, description, replies, status history, priority, assignee, and any manager email address entered on a ticket.
• Client records: client business name, contact name, contact email, telephone number, address and VAT number, as entered by the controller.
• Equipment: asset name, serial number, IP address, MAC address, notes, and which person holds each item.
• Work and money: time recorded against tickets with the person who recorded it, and the invoices and invoice lines built from it.
• Files: whatever the controller’s users attach to a ticket or an asset, and its filename.
• Security records: an audit log of significant actions with the acting account, IP address and browser identifier, and delivery records for notification email.

Special category data

SIVO Hub has no field intended for special category data under Article 9 and asks for none. It cannot prevent a user typing something of that kind into a free-text field or attaching it to a ticket. The service is not designed or assessed for special category or criminal offence data, and it should not be used to process it. If your use requires that, tell us before you rely on the product for it.

Annex 2: Security measures

The security overview, as it stands from time to time, is Annex 2.

Questions about this agreement: [email protected].