Data Processing Agreement

For personal data your organization puts into Bosferi, your organization is the controller and Bosferi LLC is the processor. This covers data about your team members and about your own customers and contacts.

For data we collect to run our own business, such as account sign-in, billing and our marketing website, Bosferi LLC is the controller, as described in our Privacy Policy.

• Purpose. Providing the Bosferi apps and features your organization uses, including support and keeping the service secure.
• Duration. For as long as your organization uses Bosferi, plus the 30-day deletion window described below.
• Types of data. Names, contact details, roles, and any content you enter in the apps, such as messages, files, calendar entries, expenses, bookings and customer records.
• People concerned. Your team members and the people whose data you store in Bosferi, such as your customers, clients and contacts.

As your processor, we will:

• Process the data only on your documented instructions, which are these terms and your use of the product, unless the law requires otherwise. If we believe an instruction breaks data protection law, we will tell you.
• Make sure everyone at Bosferi who can access the data is bound by confidentiality.
• Protect the data with appropriate technical and organizational measures, described on our Security page.
• Help you answer requests from people exercising their rights, such as access or deletion, as far as the product allows.
• Give you the information you reasonably need for data protection impact assessments or consultations with a regulator.

If we become aware of a breach affecting your personal data, we will notify you without undue delay and in any case within 72 hours. We will share what we know about what happened, the data involved and the steps we are taking, and keep you updated as we learn more.

You authorize us to use the service providers listed on our Subprocessors page. Each one is bound by data protection terms at least as protective as this agreement, and we remain responsible for their work.

We update that page at least 14 days before a new subprocessor starts processing customer data. If you have a reasonable data protection objection, tell us within that period. If we can't resolve it, you may stop using the affected service and close your account.

Bosferi LLC is based in the United States. When personal data from the EU, the UK or Switzerland is transferred to us or to our subprocessors in another country, the European Commission's Standard Contractual Clauses apply, together with the UK Addendum where relevant, and are incorporated into this agreement.

We will make available the information needed to show we meet this agreement. If that isn't enough, you may audit our compliance once a year, with at least 30 days' notice, at your own cost, and in a way that doesn't disrupt the service or expose other customers' data.

While your organization uses Bosferi you can export or delete your data in the apps. When your organization is deleted, its data is permanently deleted after 30 days, unless the law requires us to keep it. Backups containing it are overwritten on their normal schedule.

Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law doesn't allow them to be limited.

Questions about this agreement or a request for a countersigned copy: [email protected].