Last update: June 2, 2021
The services are provided by involve.me, a service of stereosense GmbH (hereinafter referred to as “involve.me”), an Austrian company with registered address at Margaretenstraße 29/7, 1040 Vienna, company registered at the court Handelsgericht Wien with the commercial register nr.: FN 461219p.
involve.me may update this Data Processing Agreement at any time, without notification to you, and you should review this Data Processing Agreement from time to time by accessing the Site. Your continued use of the Site shall be deemed irrevocable acceptance of any such revisions.
This agreement is concluded for an indefinite period and may be terminated by either party with a notice period of three months. If, at the time of termination, one or more of the main contracts are still in force and the processor continues to process personal data on behalf of the Controller on the basis of these main contracts, the provisions of this agreement shall continue to apply until the regular termination of the main contract(s). The Controller may terminate this agreement without notice if the processor has committed a serious violation of data protection provisions or the provisions of this agreement. In particular, non-compliance with the obligations agreed to in this agreement and derived from article 28 GDPR constitutes a serious infringement.
In this agreement:
a. « Services » means the services provided to the Customer under the TOS ;
b. « Personal data » means any information relating to an identified or identifiable natural person (‘data subject’);
c. « Customer », « controller » or « you » means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
d. « Processor », « involve.me » or « we » means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
e. « Process/processing » means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction ;
f. « Sub-processor » or « Sub-contractor » means a third party subcontractor engaged by the processor which, as part of the subcontractor’s role of delivering the Services, Processes Personal Data of the Customer ;
g. « Technical and organisational security measures » means those measures aimed to ensure a level of security appropriate to the risk including inter alia the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
h. “Data Protection Laws” means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their Member states, applicable to the Processing of Personal Data under the Agreement.
This agreement shall apply to:
a. all Data sent from the date of this agreement by the Customer to involve.me for Processing;
b. all Data accessed by the involve.me on the authority of the Customer for Processing from the date of this agreement; and
c. all Data otherwise received by involve.me for Processing on the Customer’s behalf;
in relation to the Services.
In order to execute the Agreement, and in particular to perform the Services on behalf of Customer, Customer authorizes and requests that involve.me process the following Personal Data: Customer Information : information that we may collect from your use of the involve.me web sites and your interactions with us offline such as :
Contact information : name, home address, telephone or mobile number, email address, and passwords.
Financial information : credit card’s number and billing information (tax id, number of the payer VAT, billing address, billing email, where invoices are sent). Credit card number are handled by Stripe (our payment gateway), or other types of payement; involve.me only charges your credit card for payments.
Services Data : data that resides on involve.me, customer or third-party systems to which involve.me has provided access to perform services.
Data stored and processed by users, such as: source code for the application, databases that the applications use, files generated by applications, the history of operations performed by users.
Log File Information: Three types of logs are saved by involve.me’s system : Connection logs which are essentially logs from each request to each application. These connection logs may include information such as the web request, Internet Protocol (“IP”) address, browser type, referring / exit pages and URLs, number of clicks, domain names, landing pages, pages viewed and other such information. The second type of logs are analytics, which are produced by each application of our customers. involve.me does not have the control on the content of these logs. The control of application logs as Personal Data remains with the Customer. Timeline event logs which are a record of a alerts and notifications that can help involve.me to identify and diagnose the source of current system problems and help predict future problems.
Other contact information about the customer and employees, for example through its web sites, as part of that interaction.
Categories of Data Subjects: Data subjects include Customer’s representatives and end users, such as employees, job applicants, contractors, collaborators, partners, and customers of the Customer. Data subjects also may include individuals attempting to communicate or transfer Personal Data to users of the Services.
involve.me shall Process Personal Data solely for the provision of the Services, and agrees to:
a. Process and use Personal Data for the purposes set forth in this Agreement or only on documented instructions from the Customer and for no other purpose except with the express prior written consent of the Customer, or
b. Not divulge Data to third parties except to those of its employees, agents and subcontractors who are engaged in the Processing of the Data and are subject to the binding obligations or except as may be required by any law or regulation;
c.Implement appropriate technical and organizational measures to safeguard the Data from unauthorized or unlawful Processing or accidental loss, destruction or damage, and that having regard to the state of technological development and the cost of implementing any measures, such measures shall ensure a level of security appropriate to the harm that might result from unauthorized or unlawful processing or accidental loss, destruction or damage and to the nature of the Data to be protected;
d. Inform the Customer as soon as possible in the event of the exercise by Data Subjects of any of their rights under the data protection laws in relation to the Data, and, if necessary, assists the Customer in complying with the obligation to respond to those requests in consideration of the undertakings provided in article 7 ;
e. Not Process or transfer the Data outside of the European Union except with the express prior written authority of the Customer and ensure that such transfers are made in compliance with appropriate law.
The processor warrants to ensure that the employees responsible for processing are informed of the applicable data protection provisions. He shall obligate these employees [by written agreement] to maintain confidentiality for the duration of the employment and also after termination of the employment relationship, unless they are subject to an appropriate statutory obligation of confidentiality. The processor shall monitor compliance with data protection regulations in his company.
The processor assists the controller in ensuring compliance with the obligations pursuant to articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the processor. In particular, the data processor shall assist with the security of processing, the notification of a personal data breach to the supervisory authority, the communication of a personal data breach to the data subjects, the data protection impact assessment and, where appropriate, the consultation of the supervisory authority.
The Service Customer, as Data controller, must accept responsibility for abiding by the applicable data protection legislation. Notably, the Customer has an obligation to assess the lawfulness of the processing of personal data stored on the Platform.
a. The processor shall provide the controller with all information required to confirm adherence to the obligations stipulated under this agreement and laid down in article 28 GDPR. The processor shall specifically provide information about saved data as well as programs used for data processing.
b. The controller or third parties commissioned by the controller are entitled – generally upon appointment - to inspect compliance with the obligations arising from this contract and article 28 GDPR as well as to carry out on-site inspections at the processor’s premises. The processor makes this possible and contributes to it.
c. Upon request, the processor shall provide the controller with suitable evidence of compliance with the obligations pursuant to article 28 subsections 1 and 4 of the GDPR. This proof can be provided by the supply of documents and certificates which represent approved rules of conduct within the meaning of article 40 GDPR or approved certification mechanisms within the meaning of article 42 GDPR.
The Customer agrees that it shall ensure compliance at all times with the applicable data protection law, and, in particular, the Customer shall ensure that any disclosure of Personal Data made by it to involve.me is made with the data subject’s consent or is otherwise lawful. The control of Personal Data remains with the Customer, and as between the Customer and involve.me, the Customer will at all times remain the Data controller for the purposes of the Services, the TOS, and this Data Processing Agreement. The Customer is responsible for compliance with its obligations as Data controller under the applicable data protection Law, in particular for justification of any transmission of Personal Data to involve.me (including providing any required notices and obtaining any required consents), and for its decisions concerning the Processing and use of the data.
involve.me will grant Customer electronic access to the Platform environment that holds Personal Data to permit Customer to delete, release, correct or block access to specific Personal Data or, if that is not practicable and to the extent permitted by applicable law, follow Customer’s detailed written instructions to delete, release, correct or block access to Personal Data.
involve.me shall pass on to the Customer any requests of an individual data subject to delete, release, correct or block Personal Data Processed under the Agreement.
involve.me treats all Personal Data in a manner consistent with the requirements of the applicable data protection Law and this Data Processing Agreement in all locations globally.
Data is stored by involve.me in data centers located in Frankfurt, Germany managed by its subcontractor Amazon Web Services
410 Terry Avenue North
Seattle, WA 98109-5210
Data centers are located in
Analytics: With respect to data processed and stored by its subcontractor Intercom, Inc. in data centers in the United States of America for analytics purposes when you visit our website or use or product, involve.me shall ensure compliance to Process Personal Data originating from the European Economic Area (EEA) and/or Switzerland according to the relevant EU-US Privacy Shield Principles.
User Mailings: involve.me uses the services of Sendinblue – 55 rue d’Amsterdam, 75008 Paris, France, VAT number: FR80498019298 - for mailing customers and free users periodically. In the context of the Services provided to involve.me, Sendinblue is required to carry out personal data processing operations on behalf of involve.me. This processing is carried out for the duration of the contractual relationship between Sendinblue and involve.me. The processing carried out by Sendinblue on behalf of the User is described below:
- Storage of contact lists uploaded by Users
- Sending messages by email or SMS, whether automated or not
- Retention and analysis of email deliverability data
- Retargeting display
- Collection of unsubscriptions and User information affected
- Collection of consents (in the event that involve.me uses the Sendinblue form to retrieve contact data from their own site).
In this respect, Sendinblue declares that it offers sufficient guarantees as to the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR and ensures the protection of the data subject’s rights. Read their whole policy here
Payment Gateway: Stripe’s services in Europe are provided by a Stripe affiliate—Stripe Payments Europe Limited (“Stripe Payments Europe”)—an entity located in Ireland and subject to European law. In providing Stripe Services, Stripe Payments Europe transfers personal data to Stripe, Inc. in the US. To ensure the adequate protection of personal data, Stripe uses the European Commission’s Standard Contractual Clauses (“Model Clauses”) to allow for the lawful transfer of such data under the EU Data Directive. These Model Clauses cover all transfers of EU personal data between Stripe Payments Europe and Stripe, Inc., including user data and end-customer cardholder data. To learn more about the Stripe data transfers or to request a copy of their Model Clauses, please contact them at email@example.com.
Additionally for payment analysis purposes, the services of Profitwell operated by 200 OK, LLC are used, 109 Kingston Street (Fourth Floor), Boston, MA 02111, firstname.lastname@example.org. 200 OK, LLC processes the data of users from Payment Gateway Stripe in a proper manner and shall take appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data. The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. 200 OK, LLC complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States. 200 OK, LLC has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. Find their whole policy here.
Affiliate and referral tracking is handled through FirstPromoter, a services provided by Igil Webs SRL. (Romania). Igil Webs SRL. is tracking referral visitors and setting up the cookie, tracking referral leads and signups, and tracking referral sales and commissions/rewards. For this purpose, the service stores data from our affiliates, partners and/or brand ambassadors (promoters) and data from our leads/customers referred by our affiliates/promoters.
For Laravel platform error tracking involve.me employs the services of Flare run by Facade bv, with registered office at Samberstraat 69D, 2060 Antwerp, Belgium and registered under number BE 0729.961.919. Fin out more about their policies here.
Backup Storage is provided by:
With respect to Personal Data stored by involve.me in data centers in the EEA shall ensure compliance of its Sub-processors with the requirements of the applicable data protection law as follows:
(i) involve.me has entered into contracts with Sub-processors which provide that the Sub-processor will undertake data protection and confidentiality obligations consistent with applicable data protection laws;
(ii) further, where a Subprocessor processes Personal Data in or from a country that has not received an “adequacy” finding, involve.me will require the Subprocessor to execute Model Clauses incorporating security requirements consistent with those of this DPA.
involve.me shall not subcontract any of its processing operations performed on behalf of the Customer under the Agreement and the TOS without the prior written consent of the Customer.
Where involve.me subcontracts its obligations under the Agreement, with the consent of the Customer, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on involve.me under the Agreement. Where the subprocessor fails to fulfill its data protection obligations under such written agreement involve.me shall not be liable to the Customer for the performance of the sub-processor’s obligations under such agreement.
The Customer as Data controller may request that involve.me audit the Subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Data Controller in obtaining a third-party audit report concerning Subprocessor’s operations) to ensure compliance with such obligations. The Controller also will be entitled, upon written request, to receive copies of the relevant terms of involve.me’s agreement with Subprocessors that may process Personal Data, unless the agreement contains confidential information, in which case the involve.me may provide a redacted version of the agreement.
The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the Customer is established.
When Processing Personal Data on behalf of Customer in connection with the Services, involve.me shall ensure that it implements and maintains compliance with appropriate technical and organizational security measures for the Processing of such data. Accordingly, involve.me will implement the following measures:
a. To prevent unauthorized persons from gaining access to data processing systems in which Personal Data are Processed (physical access control), involve.me’s sub-processors such as Amazon Web Services shall take measures to prevent physical access, such as security personnel and secured buildings and factory premises.
b. To prevent data processing systems from being used without authorization (system access control), the following may, among other controls, be applied depending upon the particular Services ordered: authentication via passwords and logging of access on several levels.
For app.involve.me services: (i) logical access to the data centers is restricted and protected by firewall/VLAN; and (ii) the following security processes are applied: centralized logging and alerting, and (iii) firewalls.
c. To ensure that persons entitled to use a data processing system only have access to the Personal Data to which they have privilege of access, and that Personal Data cannot be read, copied, modified or removed without authorization in the course of Processing and/or after storage (data access control), Personal Data is accessible and manageable only by properly authorized staff, direct database query access is restricted, and application access rights are established and enforced.
In addition to the access control rules set forth above, involve.me implements an access policy under which Data Controller controls access to its Cloud Services environment and to Personal Data and other data by its authorized personnel.
d. To ensure that Personal Data cannot be read, copied, modified or removed without authorization during electronic transmission or transport, and that it is possible to check and establish to which entities the transfer of Personal Data by means of data transmission facilities is envisaged (transmission control), involve.me will comply with the following requirements: Except as otherwise specified for the Cloud Services, transfers of data outside the Service environment are encrypted (HTTPS). The content of communications (including sender and recipient addresses) sent through some email or messaging services may not be encrypted once received through such services. Data Controller is solely responsible for the results of its decision to use non-encrypted communications or transmissions.
e. To ensure that it is possible to check and establish whether and by whom Personal Data have been entered into data processing systems, modified or removed (input control), involve.me will comply with the following requirements: Personal Data source is under the control of the Customer, and Personal Data integration into the system is managed by secured file transfer (i.e., via web services or entered into the application) from the Customer.
f. To ensure that Personal Data is protected against accidental destruction or loss: back- ups are taken on a regular basis; back-ups are encrypted and are secured.
g. To ensure that Personal Data which is collected for different purposes may be Processed separately, data from different Data Controllers’ environments is logically segregated on involve.me’s systems.
involve.me evaluates and responds to incidents that create suspicion of unauthorized access to or handling of Personal Data.
The Customer is informed of such incidents and, depending on the nature of the activity, defines escalation paths and response teams to address those incidents. involve.me will work with the Customer, with the appropriate technical teams and, where necessary, with outside law enforcement to respond to the incident. The goal of the incident response will be to restore the confidentiality, integrity, and availability of the Services environment, and to establish root causes and remediation steps.
involve.me operations staff is instructed on responding to incidents where handling of personal data may have been unauthorized.
involve.me shall notify the Customer without undue delay after becoming aware of a personal data breach. involve.me shall promptly investigate any security breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available, unless prohibited by law, involve.me will provide Data Controller with a description of the security breach, the type of data that was the subject of the breach, and other information Data Controller may reasonably request concerning the affected persons. The parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons.
Except as otherwise required by law, involve.me will promptly notify the Customer of any subpoena, judicial, administrative or arbitral order of an executive or administrative agency or other governmental authority (“demand”) that it receives and which relates to the Personal Data involve.me is Processing on Customer’s behalf. At Customer’s request, involve.me will provide reasonable information in its possession that may be responsive to the demand and any assistance reasonably required for the Customer to respond to the demand in a timely manner. The Customer acknowledges that involve.me has no responsibility to interact directly with the entity making the demand.
The parties agree that on the termination of the provision of data processing services, involve.me will make available for retrieval or otherwise will return Customer’s Personal Data stored in the Platform environment, unless legislation imposed upon the parties prevents it from returning or destroying all or part of the personal data transferred. In that case, the parties warrant that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
This agreement will be governed by Austrian law.