This agreement forms part of the Signaaal Terms of Service. It applies automatically whenever HISO processes personal data for you, and it needs no signature. For a countersigned copy, write to support@hiso.io.
Words such as "controller", "processor", "personal data" and "data subject" have the meanings given in the GDPR.
1. Roles
You are the controller of personal data you put into Signaaal about your own users, or a processor acting for your customer. HISO is your processor. Annex I describes the processing.
This agreement does not cover data about people using the dashboard, where HISO is the controller. The Privacy Policy covers that.
2. Your instructions
We process personal data only on your documented instructions. Those are the Terms, this agreement, and your use and configuration of Signaaal.
If EU or Member State law requires other processing, we will tell you first, unless that law forbids it. We will also tell you if we believe an instruction breaks data protection law.
3. Your responsibilities
You are responsible for having a legal basis for the data you put into Signaaal, and for giving people the notices the law requires.
4. Confidentiality
Everyone we authorize to process personal data is bound by a duty of confidentiality.
5. Security
We maintain the technical and organizational measures in Annex II. We may change them, but not in a way that lowers overall protection.
6. Subprocessors
You give general authorization for us to use subprocessors. The current ones are listed at signaaal.com/legal/subprocessors.
We will email your organization's owners at least 30 days before a new subprocessor starts processing your data. We may give shorter notice in an emergency, and will explain why.
You may object on reasonable data protection grounds during the notice period. If we cannot resolve it within 30 days, you may end the affected part of Signaaal and we will refund the unused part of your paid period.
We bind each subprocessor to data protection obligations equivalent to these, and we remain liable for its work.
7. Helping you
If a data subject contacts us about your data, we will pass the request to you and will not answer it ourselves unless you tell us to. We will help you meet data subject requests, as far as reasonably possible.
We will also give you the information you reasonably need for data protection impact assessments, and for consulting a supervisory authority.
8. Personal data breaches
We will notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data. We will tell you what we know, including:
- what happened and which data and people are affected;
- the likely consequences;
- what we have done and propose to do.
If we do not have all of this yet, we will send it as we learn it.
9. Audits
On request, we will give you the information you need to show that we meet this agreement.
If that is not enough, you or an independent auditor may audit us. An auditor must be bound by confidentiality and must not be a competitor. Audits take place at most once in 12 months, unless a breach or a regulator requires otherwise. You must give at least 30 days' written notice, and you bear the cost. Audits happen in business hours and must not disrupt the service.
10. Transfers outside the EU
We transfer personal data outside the EU or EEA only under a valid safeguard in Chapter V of the GDPR. That means an adequacy decision or the European Commission's Standard Contractual Clauses.
11. Return and deletion
When the agreement ends, you may ask for a copy of your data as clause 11 of the Terms describes. We then delete it from live systems within 30 days and from backups within 60 days, unless EU or Member State law requires us to keep it. We will confirm deletion in writing on request.
12. Liability and law
The limits in clause 15 of the Terms apply to this agreement, except where data protection law or the Standard Contractual Clauses do not allow it. Danish law governs this agreement. On personal data, this agreement takes priority over the Terms.
13. Changes
We change this agreement in the way clause 18 of the Terms describes. Each version is dated, and earlier versions stay readable at signaaal.com/legal/dpa.
Annex I: Description of the processing
| Item | Description |
|---|---|
| Subject matter | Providing Signaaal to you |
| Duration | The term of the agreement, plus the deletion periods in clause 11 |
| Nature | Hosting, storing, displaying, sending and deleting data |
| Purpose | To let you publish updates, help your users, collect their feedback, and report incidents |
| Data subjects | Your users, your customers, and anyone who writes to you through Signaaal |
| Personal data | Names, email addresses, what people submit (such as comments, votes, questions, survey answers and support messages), IP addresses and browser details |
| Special categories | None intended; clause 5 of the Terms forbids them |
Annex II: Security measures
- Data travels over encrypted connections.
- Passwords are stored hashed, and API keys and invitation tokens are stored only as digests.
- Sign-ins are protected by two-factor authentication where turned on, and repeated failures are throttled.
- Access within an organization follows its roles.
- Every API request that presents a credential is recorded.
- Secrets are removed from logs and error reports.
- Private and public files are kept in separate storage.
- Every change passes automated checks before release.
Annex III: Subprocessors
The current list is published at signaaal.com/legal/subprocessors.