NOBE

Mustand – ülevaatamisel, ei ole veel jõus See tekst ei ole jõus. Asutaja ei ole seda kinnitanud ja jurist ei ole seda üle vaadanud. Esiletõstetud [INFO MISSING: ...] märgid on veel täitmata andmed. Tekst on praegu ainult inglise keeles.

Data processing agreement

This agreement is between the customer (the "controller" of its own content) and [INFO MISSING: company name] (registry code [INFO MISSING: registry code], address [INFO MISSING: address], VAT number [INFO MISSING: VAT number]) (the "processor"). It applies to the personal data the processor handles for the customer while providing NOBE, and forms part of the terms of use.

What is processed

  • Subject matter: providing the team app, tasks, chat, knowledge assistant and AI features.
  • Duration: as long as the customer uses the service, plus the deletion periods below.
  • Data subjects: the customer's employees and other people it invites, and its clients who have client accounts or are named in content.
  • Kinds of data: names, emails, roles, messages, tasks, files, photos and anything else the customer puts in.

Instructions

The processor handles the data only on the customer's documented instructions, which are the terms of use, this agreement and what the customer's people do in the service. If the processor thinks an instruction breaks the law, it tells the customer.

Confidentiality

People at the processor who can access data are bound by confidentiality. Access is limited to what the work needs; the staff panel shows counts only, not customer content.

Security measures

  • Company data separated in the database (row-level security), checked by tests.
  • Hashed passwords, hashed random session tokens, sign-in guess limits.
  • Private file storage; encryption at rest for door codes, lockbox codes, Wi-Fi passwords and guest details.
  • Verified backup before every database change; scheduled jobs protected by a secret.
  • The AI reads only the team channel and groups where it is switched on; never direct messages.
  • [INFO MISSING: add or remove measures so the list is true on the day it is signed.]

Sub-processors

The customer gives general permission for the sub-processors listed in the privacy notice. The processor tells the customer's owners in the app at least 30 days before adding or replacing one; the customer may object in that time, and if it cannot be resolved, may end the service.

[INFO MISSING: the final list and regions.]

Helping the customer

  • Requests from people about their data: the processor helps with export and deletion tools and, on request, in other ways.
  • Security and breaches: the processor tells the customer without undue delay after it becomes aware of a personal data breach affecting the customer's data. [INFO MISSING: a fixed number of hours.]
  • Impact assessments and consultations: reasonable help on request.

Deletion and return

The customer can export all its data at any time. When the customer deletes the company or the contract ends, the processor deletes the data after a 30-day grace period (the owner can cancel in that time), and backups are overwritten on their normal schedule.

Information and audits

The processor gives the customer the information needed to show that these duties are met and allows reasonable audits. [INFO MISSING: how often, notice and who pays.]

Liability and law

[INFO MISSING, with a lawyer: liability for this agreement and governing law; keep consistent with the terms of use.]