Roundware Data Processing Agreement
Draft — not yet in effect. Last updated: [DATE]. [LAWYER: review the whole agreement, and the transfer clauses in section 9 especially.]
This agreement is part of the Terms of Service between Halsey Solutions, LLC ("Roundware", "we") and the organization using Roundware ("you"). It applies whenever data protection law treats you as the controller of personal data in your projects and us as your processor. That's mainly the EU and UK GDPR, and similar laws such as California's. Nothing needs to be signed: it applies automatically. If your organization needs a signed copy, write to privacy@roundware.app.
The short version
- Your participants' data is yours to decide about. We handle it only to run Roundware for you, and only as you instruct (through your settings, the admin, or in writing).
- We keep it confidential, protect it, and only use the service providers listed on our Service providers page. We'll tell you 30 days before adding one, and you can object.
- We'll help you answer participants' requests, and tell you within 72 hours of learning about a security breach affecting your data.
- When you leave, you can export your data. We delete it 90 days after you close your account.
- Your data is stored in the USA. For European and UK organizations, the standard legal protections for transfers apply (section 9).
- We're small and can't be audited on-site, but we'll answer your questions honestly and our code is open for review.
1. What this covers
| What we do with the data | Store, play, show and process your projects' contributions and activity, and send the emails your projects need, so you can run your projects on Roundware |
| For how long | While you use Roundware, plus 90 days after you close your account (section 8) |
| Whose data | Your participants and listeners; and people your participants record or mention, if any |
| What data | Random device IDs; recordings, photos and text; where contributions were made; answers to your project's questions; names and email addresses, if participants give them; when and how the project was used, including listeners' locations if your project uses them; browser descriptions |
| Sensitive data | Roundware isn't designed for sensitive data, such as health information. A recording may contain anything a participant chooses to say, and you decide whether your project invites sensitive topics. If it does, tell us, and consider whether Roundware's safeguards are enough (see How Roundware is run) |
This agreement doesn't cover your team members' account details. For those we're the controller, under our Privacy Policy.
2. Your instructions
We process your data only on your instructions. Your instructions are these terms, your project settings and actions in the admin, and anything else you ask us in writing that we agree to. If we're required by law to do something else, we'll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you.
3. Confidentiality
Only people who need to, to run Roundware, can reach your data: today, that's one person. Anyone given access in the future will be bound to keep it confidential.
4. Security
We take reasonable technical and organizational measures to protect your data, suited to the risks and to a service of Roundware's size. They're described on the How Roundware is run page, including what we don't yet do. They include:
- encrypted connections;
- hashed passwords;
- limits on abuse;
- limited server access;
- error reports stripped of personal details;
- photos stored without location metadata;
- daily database backups.
We'll keep these measures at least as strong as they are now.
5. Service providers ("subprocessors")
You agree that we may use the service providers on our Service providers page. Each is bound to protect the data at least as well as this agreement requires. We stay responsible to you for them.
Before we add or replace a provider that handles your projects' data, we'll tell you by email at least 30 days ahead. If you object for a reasonable data protection reason, we'll talk it through. If we can't resolve it, you can close your account, and we'll refund any fees paid for the time you didn't use.
6. Helping you
We'll help you, as far as is reasonable for a service of our size:
- answer requests from participants: to see, correct, withdraw, delete or export their data. The admin lets you do most of this yourself; for the rest, write to us. If a participant writes to us directly, we'll pass the request to you, and won't answer it ourselves unless you ask us to;
- with data protection impact assessments, and with talking to data protection authorities, when the law requires it.
7. Security breaches
If we learn of a breach of security that affects your data, we'll tell you without undue delay, and within 72 hours at most. We'll say what happened, what data is affected, what we've done about it, and how to reach us. We'll keep you updated as we learn more, and help you meet your own duties to tell authorities and participants.
8. When you leave
You can export your data at any time while your account is open. When you close it, we keep your data for 90 days, so you can export it or reopen the account. Then we delete it, unless the law requires us to keep something. Deleted data leaves our backups within a further 7 days. If you ask, we'll confirm in writing that it's done.
9. Transfers outside Europe and the UK
We store all data in the USA. Where your data is protected by the EU GDPR, the UK GDPR or Swiss law, and its transfer to us needs safeguards, the European Commission's Standard Contractual Clauses (Module 2, controller to processor) apply. They're part of this agreement by reference: you're the "data exporter", we're the "data importer", and the details are in section 1. The UK Addendum applies for UK data, and the same with the necessary changes for Swiss data. Where the clauses and this agreement disagree, the clauses win.
[LAWYER: confirm the module, the optional clauses (docking clause 7; clause 9(a) option 2, general authorization, with 30 days' notice; clause 11 optional language not used; clauses 17–18, governing law and courts, Ireland [or another EU member state]); and whether Roundware should instead, or also, self-certify under the EU–US Data Privacy Framework.]
10. Questions and audits
We'll answer your reasonable questions about how we protect your data, including security questionnaires, once a year or after a breach. Roundware is too small to host on-site audits. Instead, the code that runs it is open source, and we'll explain anything in it. If a data protection authority requires an audit, we'll cooperate.
11. US state laws
Where California's or another US state's privacy law applies, we're your "service provider" or "processor". We won't sell or share your projects' personal data, or use it for anything other than providing Roundware to you, or combine it with other data, except as those laws allow.
12. Order of precedence
Where this agreement and the Terms of Service disagree about personal data, this agreement wins. The limits of responsibility in the Terms of Service also apply to this agreement, as far as the law allows.
13. Contact
Halsey Solutions, LLC — Roundware
Massachusetts, USA
Privacy and your data: privacy@roundware.app
Everything else: hello@roundware.app
Every change to this document, on GitHub. Reuse it, with credit, under CC BY 4.0.