Data Processing Agreement

In respect of Customer Personal Data, Customer is the controller and TribeROI is the processor.

Where Customer itself processes Community Member Data on behalf of a third party, Customer is a processor and TribeROI is a sub-processor. In that case Customer warrants that it has the third party’s authority to appoint TribeROI and to give the instructions set out in this DPA.

TribeROI is an independent controller in respect of personal data relating to its own commercial relationship with Customer, including account administration, billing, and service communications. That processing is governed by the TribeROI privacy notice and falls outside this DPA.

Community members have no direct relationship with TribeROI. Customer alone determines which individuals’ data enters the Service, from which sources, and for what purpose.

TribeROI will process Customer Personal Data only on Customer’s documented instructions, including for international transfers, unless required to do otherwise by law to which TribeROI is subject. Where such a legal requirement applies, TribeROI will inform Customer before processing unless the law prohibits it.

Customer’s complete and final instructions at the effective date are: the Agreement, this DPA including its Annexes, and Customer’s configuration and use of the Service. Additional instructions must be agreed in writing and may attract a reasonable charge where they fall outside the Service as configured.

TribeROI will not:

TribeROI will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. TribeROI may suspend the affected processing until the instruction is confirmed or withdrawn.

Customer warrants and undertakes that:

Lawful basis. It has a valid lawful basis under Applicable Data Protection Law for each category of Customer Personal Data it submits to the Service and for the processing described in Annex I.

Notice to members. It has provided community members with the information required by Articles 13 and 14 GDPR, including that their data is processed by a third-party analytics provider. Because community members have no relationship with TribeROI, TribeROI cannot discharge this duty and does not attempt to.

Connected Platform authorization.It is authorized to disclose data from each Connected Platform it connects, that the credentials it supplies are its own and lawfully held, and that its use of that data through the Service is permitted by that platform’s terms. Customer acknowledges that connecting certain platforms causes member email addresses to be disclosed to TribeROI.

Special category data. It will not submit to the Service, and will not connect a source whose ordinary content would constitute, special categories of personal data within the meaning of Article 9 GDPR or data relating to criminal convictions and offences. Customer acknowledges that free-text fields, tags, discussion topic titles ingested from Connected Platforms, and the interaction graph are technically capable of carrying such data, and that the Service applies no technical control preventing it.

Children. It will not submit data relating to individuals below the age at which consent applies under Applicable Data Protection Law. The Service applies no age verification.

Accuracy and legality. It is responsible for the accuracy, quality, and legality of Customer Personal Data and of the means by which it acquired that data.

Customer will not submit Customer Personal Data to any free-text field where it is not necessary for the purpose.

Customer is responsible for configuring roles and permissions within the Service so that access is limited to Authorized Users with a legitimate need.

TribeROI will ensure that each person authorized to process Customer Personal Data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, and has received appropriate training.

TribeROI personnel may access Customer Personal Data only where necessary for support, administration, or incident response. Administrative access is limited as described in Annex II section 3.

TribeROI will implement and maintain the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to data subjects.

TribeROI may update those measures provided the update does not materially reduce the overall level of security.

Annex II states the limits of each measure as well as its coverage. Customer acknowledges those stated limits.

Customer grants TribeROI general written authorization to engage the Sub-processors listed in Annex III Part A and at https://beta.triberoi.com/sub-processors, which is the canonical list.

TribeROI will give Customer at least 30 days’ notice before engaging a new Sub-processor. Customer may object within that period on reasonable data protection grounds. The parties will work in good faith toward a resolution. If none is reached, Customer may terminate the affected part of the Service without penalty for the remainder of the term.

TribeROI will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains liable to Customer for each Sub-processor’s performance.

Connected Platforms are not Sub-processors. They are sources from which the Service reads on Customer’s instruction using Customer’s own credentials. Customer holds the relationship with each. TribeROI does not transmit Customer Personal Data to them.

The Service provides Customer with the functionality described in Annex II section 14 to respond to data subject requests, comprising access, portability, erasure, restriction, and rectification.

Customer acknowledges the following characteristics of that functionality:

Restriction. A member placed under restriction is removed from all Customer-facing surfaces and retained unchanged. Statistics already computed are not recalculated. Processing does not cease entirely.

Erasure limits. Erasure does not reach the categories listed in Annex II section 15.

Connected Platform deletions. Where a member is deleted at the source, that deletion is not propagated to the Service. The Service retains what it ingested until Customer removes it. Customer is responsible for removing such records.

Objection and withdrawal of consent. The Service holds no consent flag. Where a member objects or withdraws consent, Customer must act on that through the erasure or restriction functionality.

Where TribeROI receives a request directly from a community member, TribeROI will acknowledge it within five business days, will not act on it, will refer the individual to Customer as controller, and will notify Customer that the request was received.

Taking into account the nature of the processing, TribeROI will provide Customer with reasonable assistance in responding to data subject requests which Customer cannot fulfil through the Service.

Customer authorizes TribeROI to process and store Customer Personal Data in the United States. All processing locations are set out in Annex I and Annex III. No location is configurable per customer.

Where Customer transfers personal data subject to the GDPR to TribeROI, the SCCs apply and are incorporated by reference:

For the purposes of the SCCs:

Where the transfer is subject to the UK GDPR, the UK Addendum applies and is incorporated by reference, with the SCCs as completed above forming the addended clauses. TribeROI as importer may end the UK Addendum in accordance with its Table 4.

Where the transfer is subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, references to EU Member States include Switzerland, and the competent authority is the Federal Data Protection and Information Commissioner.

TribeROI will provide Customer with information reasonably necessary to complete a transfer impact assessment on request.

TribeROI will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will describe, so far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the full picture is not available, TribeROI will provide information in phases without undue further delay.

TribeROI will provide reasonable assistance to Customer in meeting Customer’s own notification obligations to supervisory authorities and data subjects.

Notification under this section is not an acknowledgement of fault or liability.

Customer may export Customer Personal Data through the Service at any time during the term.

Within 30 days of termination or expiry of the Agreement, TribeROI will delete Customer Personal Data, save where retention is required by law.

Deletion under 11.2 is subject to the limits in Annex II section 15, in particular that backups are overwritten on a rolling seven-day cycle and application logs on a rolling thirty-day cycle. Data remaining in those systems is not processed further and is deleted on expiry of the relevant cycle.

TribeROI will certify deletion in writing on request.

TribeROI will maintain records of its processing under this DPA and will make available to Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR.

Customer may audit TribeROI’s compliance no more than once per twelve months on 30 days’ written notice, subject to reasonable confidentiality undertakings, at Customer’s cost, and conducted so as not to disrupt TribeROI’s operations. A supervisory authority may audit where Applicable Data Protection Law requires it, without the frequency limit.

TribeROI will provide reasonable assistance with data protection impact assessments and with prior consultation of a supervisory authority, taking into account the nature of the processing and the information available to it.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Applicable Data Protection Law does not permit such limitation.

Nothing in this DPA limits a data subject’s rights under the SCCs or under Applicable Data Protection Law.

Order of precedence: (1) the SCCs; (2) this DPA; (3) the Agreement.