Snapshot 25287
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum | Productive
DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) forms a part of the Customer Terms of Service found
at https://www.productive.io/customer-terms-of-service/. The Order Form, Customer Terms of Service and
this Data Processing Agreement (along with standard contractual clauses appended to it) form the
agreement between the parties (further in the text: the “Agreement”).
By signing the DPA, Customer enters into this DPA on behalf of itself and, to the extent required
under applicable Data Protection Laws, in the name and on behalf of its Controller Affiliates (defined
below). For the purposes of this DPA only, and except where indicated otherwise, the term “Customer”
shall include Customer and Controller Affiliates.
All capitalized terms not defined herein shall have the meaning set forth in the Agreement.
In the course of providing the Services under the Agreement, Productive may Process certain Personal
Data (such terms defined below) on behalf of Customer, and where Productive Processes such Personal
Data on behalf of Customer, the Parties agree to comply with the terms and conditions in this DPA in
connection with such Personal Data.
HOW TO EXECUTE THIS DPA
This DPA forms an integral part of the Agreement, and for it to apply, there is no need to execute it
separately.
However, if Consumer requires a separate copy of the DPA, the following steps should be taken:
1. This DPA consists of the main body of the DPA, Schedule 1 and, where applicable, Standard
Contractual Clauses (Module 2 and/or Module 3 for EU transfers or UK Standard Contractual
Clauses for UK transfers)
2. This DPA has been pre-signed by Productive
3. To complete this DPA, Customer must complete the information in the signature box and sign it
4. Send the completed and signed DPA to Productive by email, indicating Customer’s organization
(as set out on the applicable Order Form), to [email protected]
For the avoidance of doubt, by signing the DPA, the Schedule 1 and the applicable Standard Contractual
Clauses are also accepted.
HOW THIS DPA APPLIES
If the Customer entity signing this DPA is a party to the Agreement, this DPA is an addendum to and
forms part of the Agreement.
If the Customer entity signing this DPA is not a party to the Agreement, this DPA is not valid and is not
legally binding. Such an entity should request that the Customer entity, which is a party to the Agreement,
executes this DPA.
1
Data Processing Addendum | Productive
1. DEFINITIONS
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common
control with the subject entity. “Control,” for purposes of this definition, means direct or indirect
ownership or control of more than 50% of the voting interests of the subject entity.
“Controller” means the entity which determines the purposes and means of the Processing of
Personal Data.
“Controller Affiliate” means any of Customer's Affiliate(s): (a) (i) that are subject to applicable Data
Protection Laws of the European Union, the European Economic Area and/or their member states,
Switzerland and/or the United Kingdom, and (ii) permitted to use the Services pursuant to the
Agreement between Customer and Productive, but have not signed their own Order Form and are not a
“Customer” as defined under the Agreement, (b) if and to the extent Productive processes Personal Data
for which such Affiliate(s) qualify as the Controller.
“Data Protection Laws” means all laws and regulations, including laws and binding regulations of the
European Union, the European Economic Area (“EEA”) and their member states, Switzerland and the
United Kingdom, applicable to the Processing of Personal Data under the Agreement.
“Data Subject” means the identified or identifiable person to whom Personal Data relates.
“Europe” means the European Union, the EEA, Switzerland and the United Kingdom.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“UK GDPR” means the GDPR as amended and incorporated into UK law under the UK European Union
(Withdrawal) Act 2018, and applicable secondary legislation made under that Act.
“Personal Data” means any Customer Data that relates to an identified or identifiable natural person, to
the extent that such information is protected as personal data under applicable Data Protection Laws.
“Processing” means any operation or set of operations which is performed upon Personal Data,
whether or not by automatic means, such as collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means the entity which Processes Personal Data on behalf of the Controller.
“Public Authority” means a government agency or law enforcement authority, including judicial
authorities.
“Security Practices Datasheet” means Productive’s Security Practices Datasheet, as updated from
time to time, and currently accessible at https://www.productive.io/security/.
“Productive” means the Productive entity, which is a party to this DPA, as specified in the section “HOW
THIS DPA APPLIES” above, being The Productive Company, Inc., a company incorporated in Delaware.
“Productive Group” means Productive and its Affiliates engaged in the Processing of Personal Data.
“Standard Contractual Clauses” means Standard Contractual Clauses for the transfer of Personal Data
to third countries set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on
standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation
(EU) 2016/679 of the European Parliament and of the Council, which can be found here, as updated from
time to time,
2
Data Processing Addendum | Productive
“UK SCCs” means the standard contractual clauses for the transfer of personal data to processors
established in third countries pursuant to European Commission Decision 2010/87/EU of 5 February
2010, which can be found here, as updated and/or replaced from time to time.
“Sub-processor” means any entity engaged by Productive or a member of the Productive Group to
Process Personal Data in connection with the Services.
2. PROCESSING OF PERSONAL DATA
2.1. Roles of the Parties.
The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is a
Controller or a Processor, Productive is a Processor, and that Productive or members of the Productive
Group will engage Sub-processors pursuant to the requirements set forth in section 4 “Sub-processors”
below.
2.2 Customer’s Processing of Personal Data.
Customer shall, in its use of the Services and provision of instructions, Process Personal Data in
accordance with the requirements of applicable Data Protection Law (including where the Customer is a
Processor, by ensuring that the ultimate Controller does so). Customer shall have sole responsibility for
the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal
Data.
2.3 Productive’s Processing of Personal Data.
As Customer’s Processor, Productive shall only Process Personal Data for the following purposes: (i)
Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by
Authorized Users in their use of the Services; and (iii) Processing to comply with other reasonable
instructions provided by Customer (e.g., via email or support chat) that are consistent with the terms of
the Agreement (individually and collectively, the “Purpose”). Productive acts on behalf of and on the
instructions of the Customer in carrying out the Purpose.
2.4 Details of the Processing.
All details of Processing are specified in Schedule 1 to this DPA.
3. RIGHTS OF DATA SUBJECTS
3.1 Data Subject Requests.
Productive shall, to the extent legally permitted, promptly notify Customer of any complaint, dispute, or
request it has received from a Data Subject under applicable Data Protection Law in relation to Personal
Data (a “Data Subject Request”).
Productive shall not respond to a Data Subject Request itself, except that the Customer authorizes
Productive to redirect the Data Subject Request as necessary to allow Customer to respond directly.
Taking into account the nature of the Processing, Productive shall assist Customer by appropriate
technical and organizational measures, insofar as this is possible, for the fulfillment of Customer’s
obligation to respond to a Data Subject Request as required by applicable Data Protection Laws.
In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data
Subject Request, Productive shall, upon Customer’s request, provide commercially reasonable efforts to
assist Customer in responding to such Data Subject Request, to the extent Productive is legally permitted
3
Data Processing Addendum | Productive
to do so and the response to such Data Subject Request is required under applicable Data Protection
Laws. To the extent legally permitted, Customer shall be responsible for any costs arising from
Productive’s provision of such assistance, including any fees associated with the provision of additional
functionality.
4. SUB-PROCESSORS
4.1 Appointment of Sub-processors.
Customer acknowledges and agrees that (a) Productive’s Affiliates may be retained as Sub-processors
through written agreement with Productive and (b) Productive and Productive’s Affiliates
respectively may engage third-party Sub-processors in connection with the provision of the Services. As a
condition to permitting a third-party Sub-processor to Process Personal Data, Productive or a Productive
Affiliate will enter into a written agreement with each Sub-processor containing in substance data
protection obligations that provide at least the same level of protection for Personal Data as those in this
DPA.
4.2 List of Current Sub-processors and Notification of New Sub-processors.
The current list of Subprocessors engaged in Processing Personal Data for the performance of the
Services, including a description of their processing activities and countries of location, is accessible via
https://www.productive.io/productive-subprocessors (“Sub-processor Lists”).
Productive will inform Customer of any intended changes concerning the addition or replacement of
Sub-Processors by updating its Sub-Processor webpage, which Customer acknowledges to be its
responsibility to check regularly.
4.3 Objection Right for New Sub-processors.
Customer may reasonably object to Productive’s use of a new Sub-processor (e.g., if making Personal
Data available to the Sub-processor may violate applicable Data Protection Law or weaken the
protections for such Personal Data) by notifying Productive promptly in writing within ten (10) business
days after being notified of Productive’s change of Sub-Processors in accordance with section 4.2. Such
notice shall explain the reasonable grounds for the objection. If Customer objects to a new
Sub-processor, as permitted in the preceding sentence, Productive will use commercially reasonable
efforts to make available to Customer a change in the Services or recommend a commercially reasonable
change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the
objected-to new Sub-processor without unreasonably burdening Customer. If Productive is unable to
make available such a change within a reasonable period of time, which shall not exceed thirty (30) days,
either party may terminate without penalty the applicable Order Form(s) with respect only to those
Services which cannot be provided by Productive without the use of the objected-to new Sub-processor
by providing written notice. Productive will refund Customer any prepaid fees covering the remainder of
the term of such Order Form(s) following the effective date of termination with respect to such terminated
Services, without imposing a penalty for such termination on Customer.
4.4 Liability.
Productive shall be liable for the acts and omissions of its Sub-processors to the same extent Productive
would be liable if performing the Services of each Sub-processor directly under the terms of this DPA.
4
Data Processing Addendum | Productive
5. SECURITY
Productive shall maintain appropriate technical and organizational measures for the protection of the
security (including protection against unauthorized or unlawful Processing and against accidental or
unlawful destruction, loss, or alteration or damage, unauthorized disclosure of, or access to, Personal
Data), confidentiality and integrity of Personal Data, as set forth in the Security Practices Datasheet.
Productive regularly monitors compliance with these measures. Productive will not materially decrease
the overall security of the Services during a subscription term.
Upon Customer’s request, and subject to the confidentiality obligations set forth in the Customer Terms of
Service, Productive shall make available to Customer (or Customer’s independent, third-party auditor)
information regarding the Productive Group’s compliance with the obligations set forth in this DPA in the
form of the security policies set forth in the Security Practices Datasheet.
Customers may contact Productive at [email protected] to request an on-site audit of Productive’s
procedures relevant to the protection of Personal Data, but only to the extent required under applicable
Data Protection Law. Customer shall reimburse Productive for any time expended for any such on-site
audit at the Productive Group’s then-current rates, which shall be made available to Customer upon
request. Before the commencement of any such on-site audit, Customer and Productive shall mutually
agree upon the scope, timing, and duration of the audit, in addition to the reimbursement rate for which
Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the
resources expended by Productive. Customer shall promptly notify Productive with information regarding
any non-compliance discovered during the course of an audit, and Productive shall use commercially
reasonable efforts to address any confirmed non-compliance.
6. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION
Productive maintains security incident management policies and procedures specified in the Security
page. Productive shall notify Customer without undue delay of any breach relating to Personal Data
(within the meaning of applicable Data Protection Law) of which Productive becomes aware and which
Productive is required to notify Customer under applicable Data Protection Law (a “Personal Data
Incident”). Productive shall provide commercially reasonable cooperation and assistance in identifying
the cause of such Personal Data Incident and take commercially reasonable steps to remediate the cause
to the extent the remediation is within Productive’s control. Except as required by applicable Data
Protection Law, the obligations herein shall not apply to incidents that are caused by Customer,
Authorized Users, and/or any Non-Productive Products.
7. GOVERNMENT ACCESS REQUESTS
7.1 Productive requirements.
In its role as a Processor, Productive shall maintain appropriate measures to protect Personal Data in
accordance with the requirements of Data Protection Laws, including by implementing appropriate
technical and organizational safeguards to protect Personal Data against any interference that goes
beyond what is necessary in a democratic society to safeguard national security, defense, and public
security. If Productive receives a legally binding request to access Personal Data from a Public Authority,
Productive shall, unless otherwise legally prohibited, promptly notify Customer, including a summary of
the nature of the request. To the extent Productive is prohibited by law from providing such notification,
Productive shall, as appropriate, use commercially reasonable efforts to obtain a waiver of the prohibition
to enable Productive to communicate as much information as possible, as soon as possible. Further,
5
Data Processing Addendum | Productive
Productive shall challenge the request if, after careful assessment, it considers that the request is
unlawful. As reasonable and appropriate, Productive shall pursue possibilities of appeal. When
challenging a request, Productive shall seek interim measures with a view to suspending the effects of the
request until the competent judicial authority has decided on its merits. It shall not disclose the Personal
Data requested until required to do so under the applicable procedural rules. Productive agrees it will
provide the minimum amount of information permissible when responding to a request for disclosure,
based on a reasonable interpretation of the request. Productive shall promptly notify Customer if
Productive becomes aware of any direct access by a Public Authority to Personal Data and provide
information available to Productive in this respect, to the extent permitted by law. For the avoidance of
doubt, this DPA shall not require Productive to pursue actions or inactions that could result in civil or
criminal penalties for Productive, such as contempt of court.
7.2 Sub-processors requirements.
Productive shall ensure that Sub-processors involved in the Processing of Personal data are subject to
the relevant commitments regarding Government Access Requests.
8. RETURN AND DELETION OF PERSONAL DATA
Upon termination of the Services for which Productive is Processing Personal Data, Productive shall,
upon Customer’s request, return all Personal Data in Productive’s possession to Customer or securely
destroy such Personal Data and demonstrate to the satisfaction of Customer that it has taken such
measures, unless applicable law prevents it from returning or destroying all or part of Personal Data. For
clarification, depending on the Service plan purchased by Customer, access to export functionality may
incur additional charge(s) and/or require purchase of a Service upgrade. Until Personal Data is deleted or
returned, Productive shall continue to comply with this DPA and its Schedules.
9. CONTROLLER AFFILIATES
9.1 Contractual Relationship.
The parties acknowledge and agree that, by executing the DPA in accordance with “HOW TO EXECUTE
THIS DPA”, Customer enters into the DPA on behalf of itself and, as applicable, in the name and on
behalf of its Controller Affiliates, thereby establishing a separate DPA between Productive and each such
Controller Affiliate subject to the provisions of the Agreement and this Section 9 and Section 10. Each
Controller Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the
Agreement. For the avoidance of doubt, a Controller Affiliate is not and does not become a party to the
Agreement, and is a party only to the DPA. All access to and use of the Services by Controller Affiliates
must comply with the terms and conditions of the Agreement, and any violation of the terms and
conditions of the Agreement by a Controller Affiliate shall be deemed a violation by Customer.
9.2 Communication.
The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all
communication with Productive under this DPA and be entitled to make and receive any communication in
relation to this DPA on behalf of its Controller Affiliates.
6
Data Processing Addendum | Productive
9.3 Rights of Controller Affiliates.
If a Controller Affiliate becomes a party to the DPA with Productive, it shall, to the extent required under
applicable Data Protection Laws, also be entitled to exercise the rights and seek remedies under this
DPA, subject to the following:
9.3.1 Except where applicable Data Protection Laws require the Controller Affiliate to exercise a
right or seek any remedy under this DPA against Productive directly by itself, the parties agree
that (i) solely the Customer that is the contracting party to the Agreement shall exercise any such
right or seek any such remedy on behalf of the Controller Affiliate, and (ii) the Customer that is
the contracting party to the Agreement shall exercise any such rights under this DPA not
separately for each Controller Affiliate individually but in a combined manner for all of its
Controller Affiliates together (as set forth, for example, in Section 9.3.2, below).
9.3.2 The parties agree that the Customer, which is the contracting party to the Agreement, shall,
if carrying out an on-site audit of the Productive procedures relevant to the protection of Personal
Data, take all reasonable measures to limit any impact on Productive by combining, to the extent
reasonably possible, several audit requests carried out on behalf of different Controller Affiliates
in one single audit.
10. LIMITATION OF LIABILITY
Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this
DPA, and all DPAs between Controller Affiliates and Productive, whether in contract, tort or under any
other theory of liability, is subject to the ‘Limitation of Liability’ section of the Customer Terms of Service,
and any reference in such section to the liability of a party means the aggregate liability of that party and
all of its Affiliates under the Agreement and all DPAs together.
For the avoidance of doubt, Productive’s and its Affiliates’ total liability for all claims from the Customer
and all of its Controller Affiliates arising out of or related to the Agreement and each DPA shall apply in
the aggregate for all claims under both the Agreement and all DPAs established under the Agreement,
including by Customer and all Controller Affiliates, and, in particular, shall not be understood to apply
individually and severally to Customer and/or to any Controller Affiliate that is a contractual party to any
such DPA.
11. EUROPEAN AND UK SPECIFIC PROVISIONS
11.1 Definitions.
For the purposes of this DPA, these terms shall be defined as follows:
“EU C-to-P Transfer Clauses” means Standard Contractual Clauses Module Two
(Controller-to-Processor).
“EU P-to-P Transfer Clauses” means Standard Contractual Clauses Module Three
(Processor-to-Processor).
11.2 GDPR.
Regarding EU transfers, Productive will Process Personal Data in accordance with the GDPR
requirements directly applicable to Productive’s provisioning of the Services.
7
Data Processing Addendum | Productive
Regarding UK transfers, Productive will Process Personal Data in accordance with the UK GDPR
requirements directly applicable to Productive’s provisioning of the Services.
11.3 Customer Instructions.
Productive shall inform Customer immediately (i) if, in its opinion, an instruction from Customer
constitutes a breach of the GDPR i.e. UK GDPR and/or (ii) if Productive is unable to follow Customer’s
instructions for the Processing of Personal Data.
11.4 Transfer Mechanisms.
If, in the performance of the Services, Personal Data that is subject to the GDPR or any other law relating
to the protection or privacy of individuals that apply in Europe is transferred out of Europe to countries
which do not ensure an adequate level of data protection within the meaning of the Data Protection Laws
of Europe, the transfer mechanisms listed below shall apply to such transfers and are directly enforced by
the parties to the extent such transfers are subject to the Data Protection Laws of Europe:
The EU C-to-P Transfer Clauses
Regarding EU transfers, where Customer and/or its Controller Affiliate is a Controller and a data
exporter of Personal Data and The Productive Company, Inc. is a Processor and data importer in
respect of that Personal Data, then the parties shall comply with the EU C-to-P Transfer Clauses,
which can be found here, and which form an integral part of this Data Processing Agreement;
and/or
The EU P-to-P Transfer Clauses
Regarding EU transfers, where Customer and/or its Controller Affiliate is a Processor acting on
behalf of a Controller and a data exporter of Personal Data and The Productive Company, Inc. is
a Processor and data importer in respect of that Personal Data, the parties shall comply with the
terms of the EU P-to-P Transfer Clauses, which can be found here, and which form integral part
of this Data Processing Agreement.
The UK SCCs
Regarding UK transfers, the parties shall comply with the terms of the UK SCCs, which can be
found here, and which form an integral part of this Data Processing Agreement.
11.5 Impact of local laws.
As of the Effective Date, Productive has no reason to believe that the laws and practices in any third
country of destination applicable to its Processing of the Personal Data, as set forth in the Sub-processor
Lists (https://www.productive.io/productive-subprocessors), including any requirements to disclose
personal data or measures authorizing access by a Public Authority, prevent Productive from fulfilling its
obligations under this DPA. If Productive reasonably believes that any existing or future enacted or
enforceable laws and practices in the third country of destination applicable to its Processing of the
Personal Data ("Local Laws") prevent it from fulfilling its obligations under this DPA, it shall promptly notify
Customer. In such a case, Productive shall use reasonable efforts to make available to the affected
Customer a change in the Services or recommend a commercially reasonable change to Customer’s
configuration or use of the Services to facilitate compliance with the Local Laws without unreasonably
burdening Customer. If Productive is unable to make available such a change within a reasonable period
of time, either party may, without penalty, terminate the applicable Order Form(s) with respect only to
those Services which cannot be provided by Productive in accordance with the Local Laws, by providing
written notice. Productive will refund Customer any prepaid fees covering the remainder of the term of
8
Data Processing Addendum | Productive
such Order Form(s) following the effective date of termination with respect to such terminated Services,
without imposing a penalty for such termination on Customer.
12. PARTIES TO THIS DPA
You are contracting with The Productive Company, Inc, 2093 Philadelphia Pike #3280, Claymont, DE,
19703 USA.
13. GOVERNING LAW
This DPA and any dispute or claim arising out of or in connection with it or its subject matter or formation
(including non-contractual disputes or claims) shall be governed by, and construed in accordance with,
the laws of Delaware, the United States of America.
The parties' authorized signatories have duly executed this DPA:
On behalf of The Productive Company, Inc.:
Signatory Name: Tomislav Car
Position: CEO
Address: 2093 Philadelphia Pike #3280, Claymont, DE, 19703, United States of America
Signature:
On behalf of Customer:
Customer Full Legal Name:
Signatory Name:
Position:
Address:
Signature:
9
Data Processing Addendum | Productive
SCHEDULE 1
DESCRIPTION OF DATA PROCESSING AND TRANSFER
ANNEX 1
A. LIST OF PARTIES
Data exporter(s):
Name: Customer as defined in the Agreement
Address: As defined in the Agreement
Contact person’s name, position, and As defined in the Agreement
contact details:
Contact details of the DPO: As defined in the Agreement, if applicable
Activities relevant to the data transferred Receipt of the services pursuant to the Agreement
under these Clauses:
Role: Controller for the purpose of Module 2 of the Standard
Contractual Clauses
Processor for the purpose of Module 3 of the Standard
Contractual Clauses
Data importer(s):
Name: The Productive Company, Inc.
Address: 2093 Philadelphia Pike #3280, Claymont, DE, 19703
USA
Contact person’s name, position, and Jan Varljen, director, email: [email protected]
contact details:
Contact details of the DPO: [email protected]
Activities relevant to the data transferred Provision of the Services pursuant to the Agreement
under these Clauses:
Role: Processor
10
Data Processing Addendum | Productive
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred:
Customer may submit personal data to Productive, the extent of which is determined and controlled
by Customer and which may include, but is not limited to, personal data relating to the following
categories of data subjects:
● Authorized Users;
● employees of Customer;
● consultants of Customer;
● contractors of Customer;
● agents of Customer; and/or
● third parties Customer conducts business with
● external meeting participants who are not Authorized Users or employees of Customer,
whose personal data may be processed through the Notetaker feature (e.g., voice
recordings, names, and statements made during meetings)
Categories of personal data transferred:
Any Personal Data comprised in Customer Data, as defined in the Agreement, especially:
o name and last name
o email address
o all other data that users or customers enter into Organization, such as: job position,
contact information of the user (phone number, address, and similar), picture
o any other data entered into Organization regarding Authorized Users, employees,
consultants, contractors, or agents of the Customer or other third parties Consumer
conducts business with
o audio recordings of video meetings captured through the Notetaker feature
o transcripts generated from audio recordings
o AI-generated meeting summaries, action items, and key points derived from
transcripts
o meeting metadata: meeting title, date, time, duration, and participant names
o voice characteristics contained within audio recordings (which may constitute
biometric data under certain jurisdictions)
Sensitive data transferred (if applicable):
Customer may submit personal data to Productive, the extent of which is determined and controlled
by Customer in compliance with applicable Data Protection Law, and which may concern the
following special categories of data, if any:
● racial or ethnic origin
● political opinions
● religious or philosophical beliefs
● trade-union membership
● genetic or biometric data
● health data
11
Data Processing Addendum | Productive
● sex life or sexual orientation.
Sensitive data are only collected if users enter it in the system, i.e. the data importer will not
request such data from the data exporter.
With respect to the Notetaker feature, meeting participants may discuss or disclose sensitive
personal data (such as health information, political opinions, or trade union membership) during
recorded meetings. Such data may be incidentally captured in audio recordings and transcripts
without the Customer or Productive specifically requesting it. The Customer, as data controller, is
responsible for assessing whether the use of the Notetaker feature is appropriate given the nature
of meetings being recorded, and for implementing appropriate safeguards.
Applied restrictions or safeguards that fully take into consideration the nature of the data
and the risks involved:
● such as for instance strict purpose limitation, access restrictions (including access only for
staff having followed specialized training),
● keeping a record of access to the data,
● restrictions for onward transfers or additional security measures.
Specific security measures can be found on our Security page.
The frequency of the transfer (e.g., whether the data is transferred on a one-off or
continuous basis):
Continuous basis (depending on the use of the Services by the Customer)
Nature of the processing:
The performance of the service pursuant to the Agreement, including collection, transfer,
organization, storing, archiving, sharing, and deleting Personal Data
Purpose(s) of the data transfer and further processing:
Productive will Process Personal Data as necessary to perform the services pursuant to the
Agreement and as further instructed by Customer in its use of the services.
Purposes are specified in clause 2.3 of this DPA.
The period for which the personal data will be retained, or, if that is not possible, the criteria
used to determine that period:
For the duration of the Agreement, and 5 years after the Agreement, unless otherwise agreed upon
in writing.
For transfers to (sub-) processors, also specify subject matter, nature, and duration of the
processing:
12
Data Processing Addendum | Productive
The Sub-processors will Process Personal Data as necessary to perform the services pursuant to
the Agreement.
The Sub-processors will Process Personal Data for the duration of the Agreement, unless otherwise
agreed in writing.
Identities of the Sub-processors used for the provision of the services and their country of location
are listed under the Sub-processor Lists accessible via
https://www.productive.io/productive-subprocessors/.
C. COMPETENT SUPERVISORY AUTHORITY
The competent supervisory authority/ies in accordance with Clause 13
● Agencija za zaštitu osobnih podataka, Selska cesta 136, Zagreb, Croatia
ANNEX II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Productive will maintain administrative, physical, and technical safeguards for the protection of the
security, confidentiality, and integrity of Personal Data uploaded to the Services, as described in the
Security Practices Datasheet applicable to the specific Services purchased by data exporter, and
currently accessible here, or otherwise made reasonably available by data importer. Data importer will not
materially decrease the overall security of the Services during a subscription term. Data Subject Requests
shall be handled in accordance with section 3 of the DPA.
In case of transfers to subprocessors, Productive requires that they take technical and organizational
measures to be able to provide assistance to the controller and, for transfers from a processor to a
sub-processor, to the data exporter.
All measures sub-processors take can be found on our processors page (see links to their security
pages).
13