Snapshot 172149
Normalized text
Scripts and page chrome removed; this is what change detection compares.
This Data Processing Addendum and its Annexes (the “DPA”) form part of the SuprSend Terms of Service at https://www.suprsend.com/terms, together with any Order Form between you and SuprStack Inc (the “Terms”). It sets out how SuprStack Inc (“SuprSend”, “we”, “us”) Processes Customer Personal Data as a Processor on your behalf. If this DPA conflicts with the Terms, this DPA prevails to the extent of the conflict. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail. Sections 3 to 10 apply only where SuprSend acts as a Processor of Customer Personal Data in providing SuprSend. This DPA stays in force for as long as we Process Customer Personal Data under the Terms. Capitalised terms not defined here have the meaning given in the Terms. 1. Definitions Affiliate: an entity that controls, is controlled by, or is under common control with a party. California Personal Information: Customer Personal Data protected by the CCPA. CCPA: California Civil Code §1798.100 et seq., as amended by the California Privacy Rights Act of 2020. “Business”, “Consumer”, “Sell”, “Service Provider” and “Share” have the meanings given in the CCPA. Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing Personal Data. Customer Personal Data: Personal Data contained in Service Data that we Process as a Processor on your behalf. Customer Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data Processed by us or our Sub-Processors. It excludes unsuccessful attempts that do not compromise the security of Customer Personal Data, such as failed log-ins, pings, port scans and blocked denial-of-service attempts. Data Privacy Framework or DPF: the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, operated by the U.S. Department of Commerce, and the Principles that form part of them. Data Protection Laws: all data protection and privacy laws that apply to the Processing of Personal Data under the Terms, including European Data Protection Laws, the CCPA and other U.S. state privacy laws, and the laws of Australia, Canada, India, Japan and Singapore, each as amended or replaced. Data Subject: the individual to whom Personal Data relates. Europe: the European Union, the European Economic Area, Switzerland and the United Kingdom. European Data: Customer Personal Data protected by European Data Protection Laws. European Data Protection Laws: (i) Regulation (EU) 2016/679 (“GDPR”); (ii) Directive 2002/58/EC and its national implementations; (iii) the GDPR as retained in UK law by section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (iv) the Swiss Federal Data Protection Act and its Ordinance (“Swiss DPA”); each as amended or replaced. Instructions: your documented instructions to us about Processing Customer Personal Data, as described in Section 2(b). Permitted Affiliates: your Affiliates that use SuprSend under your Account, have not signed their own agreement with us, and act as Controller of Customer Personal Data. Personal Data: information relating to an identified or identifiable individual that is protected as personal data, personal information or personally identifiable information under Data Protection Laws. Processing: any operation performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment or combination, restriction, erasure or destruction. “Process” and “Processed” follow from it. Processor: a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of a Controller. Restricted Transfer: a transfer of European Data to a country that European Data Protection Laws do not recognise as providing an adequate level of protection. Standard Contractual Clauses or SCCs: the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (https://eur-lex.europa.eu/eli/dec_impl/2021/914), as amended or replaced. Sub-Processor: a third party or SuprSend Affiliate that we engage to Process Customer Personal Data. It excludes our own employees and individual contractors. UK Addendum: the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, as amended or replaced. 2. Customer responsibilities (a) Compliance with law. You are responsible for complying with Data Protection Laws in your own Processing of Personal Data. In particular, you are solely responsible for: the accuracy, quality and legality of Customer Personal Data and how you obtained it; giving required notices, obtaining required consents, and honouring opt-outs and preferences, including for marketing messages; having the right to send Customer Personal Data to us for Processing under the Terms; complying with laws that govern the messages you send through SuprSend, including consent, content and anti-spam rules; and where you integrate SuprSend’s mobile or web SDK: disclosing in your privacy policy the collection of push notification tokens and technical data (user agent, OS version, app version, SDK version); obtaining any consent required by law (including Article 5(3) of the ePrivacy Directive 2002/58/EC on storing or reading data on a user’s device) or by app-store rules (including Apple App Tracking Transparency and Google Play Data safety disclosures); and sending us only data you have a lawful basis to share. You will tell us without undue delay if you cannot meet these responsibilities. (b) Instructions. The Terms (including this DPA) and your configuration and use of SuprSend are your complete Instructions to us. You may give additional written Instructions during the Subscription Term, provided they are consistent with the Terms and lawful. You are responsible for ensuring your Instructions comply with Data Protection Laws. (c) Your security. You are responsible for deciding whether the security measures in Annex 2 meet your obligations under Data Protection Laws, and for your own secure use of SuprSend, including protecting your API Keys and User Logins and securing data in transit from your systems. (d) Sensitive data. As stated in §9.8 of the Terms, SuprSend is not designed for Sensitive Personal Information. You must not send protected health information subject to HIPAA unless a Business Associate Agreement with us is in place. 3. Our obligations as Processor (a) Instructions. We will Process Customer Personal Data only on your Instructions, unless applicable law requires otherwise. In that case we will tell you before Processing, unless the law prohibits it. We will inform you without delay if we believe an Instruction infringes Data Protection Laws. (b) Conflict of laws. If a legal requirement prevents us from following your Instructions, we will promptly tell you (where the law allows) and may pause Processing, other than storing and securing the affected data, until you give new Instructions we can follow. We are not liable for failing to provide the affected part of SuprSend during that pause. (c) Security. We will implement and maintain the technical and organisational measures in Annex 2 (the “Security Measures”). We may update them, provided the update does not materially reduce the overall protection of Customer Personal Data. (d) Confidentiality. Everyone we authorise to Process Customer Personal Data is bound by contractual or statutory confidentiality obligations. (e) Breach notification. We will notify you without undue delay after becoming aware of a Customer Personal Data Breach. Our notice will describe, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. We will update you as more becomes known and give reasonable help with any notices you must make to regulators or Data Subjects. Our notice is not an admission of fault. (f) Return and deletion. You can export Customer Personal Data through SuprSend at any time during the Subscription Term and for 90 days after it ends, in line with §8.5 of the Terms. We will delete Customer Personal Data after the 90-day period. Copies in backups will be deleted as backups expire under our normal rotation, within 35 days, and are kept isolated from further Processing until then. This does not apply where law requires us to keep the data. To request earlier deletion, email privacy@suprsend.com. 4. Data Subject requests SuprSend lets you retrieve, correct, delete and restrict Customer Personal Data yourself through the API and the application, which you can use to answer Data Subject requests. Where you cannot handle a request yourself, we will give reasonable help on your written request, including with enquiries from supervisory authorities. You will reimburse our reasonable costs for help beyond the self-service tools. If a Data Subject contacts us directly about Customer Personal Data, we will promptly forward the request to you and will not respond substantively without your Instruction, unless law requires it. 5. Sub-Processors (a) Authorisation. You authorise us to engage Sub-Processors. Our current Sub-Processors, their purpose and location are listed at https://trust.suprsend.com/subprocessors (Annex 3). They support hosting, data storage, analytics storage, observability and similar infrastructure, and may access Service Data including your end users’ data. (b) Vendors outside this list. Vendors that only support our own business operations (CRM, billing, support tooling) see account and contact details of your Users, which we handle as a Controller under our Privacy Policy. They do not Process Customer Personal Data and are not Sub-Processors under this DPA. (c) Your delivery vendors. Email, SMS, push, chat and other delivery providers that you connect to your Account under your own contract (“Vendor Services” under §6 of the Terms) act for you. They are not our Sub-Processors. (d) BYOC and self-hosted. Where SuprSend runs in your own cloud or is self-hosted, the infrastructure providers you choose are not our Sub-Processors, and you manage those relationships. (e) Notice of changes. You can subscribe to change notices by emailing privacy@suprsend.com. We will notify subscribers at least 30 days before a new Sub-Processor starts Processing Customer Personal Data. (f) Objection. You may object on reasonable data protection grounds within 30 days of our notice. We will discuss your concerns in good faith. If we cannot resolve them, we will either not use that Sub-Processor for your data or let you suspend or terminate the affected service without liability to either party. Fees incurred before suspension or termination remain payable. (g) Our responsibility. We will bind each Sub-Processor to written data protection terms at least as protective as this DPA, to the extent relevant to its service. We remain responsible for each Sub-Processor’s performance of those obligations. 6. Data locations and transfers (a) Hosting. Customer Personal Data is stored in the hosting region of your workspace, the United States or the European Union. (b) Access from other countries. SuprStack Inc’s engineering and support personnel may access Customer Personal Data from India to operate, support and secure SuprSend, using the access controls in Annex 2. Sub-Processors may Process data in the locations listed at https://trust.suprsend.com/subprocessors. (c) Lawful transfers. Each party will ensure that any transfer of Customer Personal Data out of its country of origin complies with Data Protection Laws. For European Data, Section 10 applies. (d) BYOC and self-hosted. Where SuprSend runs in your own cloud or is self-hosted, Customer Personal Data stays in infrastructure you control. We do not Process it on our hosted infrastructure unless you configure SuprSend to send it to us. 7. Demonstration of compliance (a) Reports. SuprSend is audited annually against SOC 2 Type II, and independent firms carry out penetration tests at least annually. On request, and under confidentiality, we will share our latest SOC 2 Type II report and a summary of our latest penetration test. Our hosting providers hold their own SOC 2 and ISO 27001 certifications. (b) Questionnaires. Once per calendar year, we will answer your reasonable written questions needed to confirm our compliance with this DPA. More frequent requests are allowed where you have reasonable grounds to suspect non-compliance, after a Customer Personal Data Breach, or where a supervisory authority requires it. (c) Audits. Where Data Protection Laws or a supervisory authority require an audit beyond the reports and answers above, you or an independent auditor bound by confidentiality may audit us. You will give at least 30 days’ written notice, agree the scope with us in advance, conduct the audit during business hours without disrupting our operations, and bear its cost. (d) BYOC and self-hosted. You are responsible for the security and compliance of the infrastructure you control. Our obligations in this Section cover only the SuprSend software and any systems we operate. 8. Additional terms for European Data (a) Scope. This Section applies only to European Data that SuprSend Processes on your behalf. (b) Roles. You act as Controller, or as Processor on behalf of another Controller, and SuprSend acts as Processor (or sub-processor). (c) DPIAs and prior consultation. Where you lack the information yourself and it is reasonably available to us, we will give reasonable help with data protection impact assessments and prior consultations with supervisory authorities required by European Data Protection Laws. (d) Transfers. We will not make a Restricted Transfer of European Data unless it is covered by a mechanism in Section 10 or another safeguard recognised by European Data Protection Laws. 9. Additional terms for California Personal Information (a) Scope. This Section applies only to California Personal Information that we Process on your behalf. (b) Roles. You are a Business and SuprSend is a Service Provider under the CCPA. (c) Restrictions. We will Process California Personal Information only to provide SuprSend under the Terms (the “Business Purpose”) or as the CCPA otherwise permits. We will not: (i) Sell or Share it; (ii) retain, use or disclose it outside the direct business relationship between us, or for any purpose other than the Business Purpose; or (iii) combine it with personal information we receive from others or collect ourselves, except as the CCPA permits a Service Provider to do. We certify that we understand and will comply with these restrictions. (d) Compliance. We will comply with the CCPA obligations that apply to Service Providers, provide the level of privacy protection the CCPA requires, and notify you if we can no longer meet those obligations. (e) Your rights. You may take reasonable and appropriate steps, consistent with Section 7, to ensure we use California Personal Information in line with your CCPA obligations, and, on notice, to stop and remediate any unauthorised use. (f) No sale. You disclose California Personal Information to us to receive SuprSend. It is not part of the price or any other consideration between us. 10. Transfer mechanisms for European Data Where Customer Personal Data is subject to a Restricted Transfer, the following apply. (a) Data Privacy Framework. SuprStack Inc self-certifies to the Data Privacy Framework. Where the DPF covers a transfer, we will rely on it to receive European Data in the United States and will protect that data at least to the level the DPF Principles require. We will tell you if we can no longer meet that requirement. (b) Standard Contractual Clauses. Where the DPF does not cover a transfer, or ceases to be valid, the SCCs are incorporated into this DPA as follows: Module Two applies where you are a Controller; Module Three applies where you are a Processor. Clause 7 (docking clause) applies. Clause 9: Option 2 (general written authorisation) applies, with notice given under Section 5. Clause 11: the optional language is deleted. Clauses 17 and 18: the governing law and courts are those named in the Terms or Order Form if they are of an EU Member State; otherwise Irish law and the courts of Ireland. Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA. The competent supervisory authority is determined under Clause 13 and Annex 1, Part C. (c) United Kingdom. For data subject to UK GDPR, the SCCs apply as in (b), as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed by the Annexes to this DPA. For Table 4, neither party may end the UK Addendum. Conflicts are resolved under Sections 10 and 11 of the UK Addendum. (d) Switzerland. For data subject to the Swiss DPA, the SCCs apply as in (b), with these changes: references to the GDPR mean the Swiss DPA; references to the EU, Union and Member State law mean Switzerland and Swiss law; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term “member state” does not exclude Data Subjects in Switzerland from suing in their place of habitual residence. (e) How SCC clauses are met. Our obligations under Clause 9 are met by Section 5. For Clause 9(c), you may receive copies of Sub-Processor agreements with commercial terms removed, where the Sub-Processor allows it, or a summary of their data protection terms. Audits under Clause 8.9 are carried out under Section 7. (f) Non-compliance. If we cannot comply with the SCCs, you will give us reasonable notice and a chance to cure before suspending transfers. If we do not cure, you may suspend or terminate the affected part of SuprSend without liability to either party. Fees incurred before suspension or termination remain payable. (g) Replacement mechanisms. If a supervisory authority or court requires a different transfer mechanism, that mechanism applies automatically to the extent it complies with European Data Protection Laws. Each party will sign any documents reasonably needed to give it effect. 11. General provisions (a) Updates. We may update this DPA from time to time and will post the updated version at this URL. If you have an active subscription, we will notify you of updates by in-app notice or email. (b) Severability. If any provision of this DPA is invalid or unenforceable, the rest remains in effect. (c) Liability. Each party’s total liability, together with its Affiliates, arising out of or related to this DPA and the SCCs is subject to the exclusions and limits in §11 (Limitation of Liability) of the Terms. That limit applies once, across the Terms and this DPA together. Nothing in this DPA limits a Data Subject’s rights against either party that cannot be limited under Data Protection Laws or the SCCs. (d) Governing law. This DPA is governed by the law and dispute resolution terms in §13.5 of the Terms (Delaware), except where Data Protection Laws or the SCCs require otherwise. (e) Notices. Notices to us under this DPA go to privacy@suprsend.com. Notices to you go to the Account owner’s email address or the contact in your Order Form. 12. Parties (a) Permitted Affiliates. By accepting the Terms, you enter into this DPA, including the SCCs where they apply, for yourself and on behalf of your Permitted Affiliates. In this DPA, “you” includes them. (b) Authority. The entity accepting this DPA confirms it is authorised to do so for itself and its Permitted Affiliates. (c) Exercising rights. Only the entity that is party to the Terms may exercise rights or seek remedies under this DPA, including on behalf of Permitted Affiliates, and it will do so for all of them together. That entity coordinates all Instructions and communications with us. (d) Combined audits. Audit or information requests for you and your Permitted Affiliates will be combined into a single request where reasonably possible. Annex 1: Details of Processing A. List of parties Data exporter Data importer Name The customer that accepted the Terms, for itself and its Permitted Affiliates SuprStack Inc Address As stated in the Order Form or Account 16192 Coastal Highway, Lewes, DE 19958, USA Contact As stated in the Order Form or Account Privacy Team, privacy@suprsend.com Activities Use of SuprSend to send and manage notifications Providing SuprSend under the Terms Role Controller, or Processor for another Controller Processor B. Description of Processing Categories of Data Subjects. Determined by you. Typically your end users and recipients of your notifications, including your customers, employees, contractors and partners, and users of your apps that integrate the SuprSend SDK. Categories of Personal Data. Determined by you. Typically: contact identifiers: name, email address, phone number, user ID, Slack and Microsoft Teams IDs; push notification and device tokens; technical data: OS version, app version, SDK version, user agent; notification preferences; delivery and engagement events: sent, delivered, seen, read, clicked and dismissed, with timestamps; and any other Personal Data you include in event properties, user properties or message content. Sensitive data. None intended. Under §9.8 of the Terms, SuprSend is not designed for Sensitive Personal Information, and protected health information may be sent only under a signed BAA. Frequency. Continuous, for as long as you use SuprSend. Nature and purpose. Receiving, storing, processing and routing data to create and deliver notifications through the channels and vendors you configure; showing logs and analytics; providing support; and keeping SuprSend secure and working. Retention. For the Subscription Term, then as set out in Section 3(f). Within the term, message logs and event data are kept according to your plan’s log retention period. Transfers to Sub-Processors. As listed in Annex 3, for the purposes stated there, for the Subscription Term. C. Competent supervisory authority For Module Two and Three transfers: the supervisory authority of the EU Member State where you are established. If you are not established in the EU, the authority of the Member State where your EU representative is established; if Article 27(2) GDPR exempts you from appointing one, the Irish Data Protection Commission, as the authority of a Member State where Data Subjects are located. For UK data, the Information Commissioner’s Office. For Swiss data, the Federal Data Protection and Information Commissioner. Annex 2: Security Measures SuprSend maintains the following measures, which are assessed annually in our SOC 2 Type II audit. More detail is at https://trust.suprsend.com. (a) Security program. A written information security policy, approved by management and reviewed at least annually, with named owners for security and privacy. (b) Hosting and physical security. SuprSend runs on AWS, Google Cloud Platform and Microsoft Azure in the United States and the European Union. We own no data-centre hardware. Physical and environmental controls are the hosting providers’ and are covered by their SOC 2 Type II and ISO 27001 certifications. (c) Logical separation. SuprSend is multi-tenant. Each customer’s data is scoped to its workspaces and is reachable only through the SuprSend application and APIs after authentication. Customers have no direct access to underlying infrastructure. (d) Customer authentication and access. Users sign in through our identity provider, with single sign-on available on eligible plans. Role-based access lets you limit what each User can view and change. API calls authenticate with workspace keys and secrets, which you can rotate. (e) Personnel access to production. Access is limited to engineering and support staff who need it, granted by role. Production access requires multi-factor authentication and is logged. Elevated access is granted just-in-time and expires automatically. Access rights are reviewed at least quarterly and removed promptly when staff change role or leave. Service credentials are kept in a secrets manager. (f) Network security. Production runs in private networks (VPCs) with security groups and firewall rules that allow only required traffic. A web application firewall protects public endpoints. (g) Encryption. In transit: TLS 1.2 or higher on all public endpoints, including the API, web application and SDK connections. At rest: databases, object storage and backups are encrypted with AES-256 or equivalent, using keys managed by our cloud providers. User passwords, where used, are stored as salted hashes. (h) Secure development. Code changes are peer-reviewed before merge. Automated tooling scans code and dependencies for known vulnerabilities. Production and test environments are separate. (i) Endpoint security. Company laptops use full-disk encryption, screen lock, automatic updates and anti-malware or endpoint detection tools. (j) Logging, monitoring and incident response. We log system, access and application events, and alert on anomalous activity. A written incident response plan defines roles, escalation and customer notification, and is tested at least annually. We keep a record of security incidents and their resolution. Customer notification follows Section 3(e). (k) Availability and recovery. Databases are replicated across multiple availability zones and backed up daily. Backups are encrypted and retained for 35 days. We maintain a disaster recovery plan and test it at least annually. (l) Vulnerability management. Infrastructure and applications are scanned for vulnerabilities weekly. Findings are fixed on a schedule based on severity. Independent firms run penetration tests of the SuprSend application at least annually. (m) People. Staff sign confidentiality agreements and complete security and privacy training at onboarding and annually. Background or reference checks are carried out where local law permits. (n) Vendor management. Sub-Processors are reviewed for security before onboarding and at least annually, and are bound by written data protection terms (Section 5). Annex 3: Sub-Processors Our current Sub-Processors, the service each provides, the data it handles and where it Processes it are listed at https://trust.suprsend.com/subprocessors. That list forms part of this DPA. Changes follow Section 5. Know more How we collect, use and protect personal dataPrivacy Policy The terms of using SuprSendTerms of Service Who we work with to run the serviceData Subprocessors There’s no better place for you to build notifications Join thousands of product & engineering teams using SuprSend to build and ship better notifications—faster. Start for Free Request demo By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information. PreferencesDenyAccept