At a glance
- Roles: the Customer is the controller. There is the processor and acts only on the Customer’s instructions.
- Hosting: the database and files are hosted in the European Union. Transfers outside the EU by some sub-processors are covered by the European Commission’s standard contractual clauses.
- AI: Customer data is not used to train AI models. With the Business plan, the Customer can restrict AI models to Mistral AI, which processes data in the EU.
- Data breaches: There notifies the Customer within forty-eight (48) hours of becoming aware of a breach.
- Sub-processors: the list is in Annex 3. Any new sub-processor is announced thirty (30) days in advance, and the Customer can object.
- Audits: There provides the necessary documentation and accepts at most one audit per year, at the expense of the requesting Customer.
- End of the relationship: data export within thirty (30) days on request, then deletion within thirty (30) days when the Customer deletes its organization or asks for it.
- Contact: privacy@there.do.
Article 1 — Purpose and scope
1.1. This Agreement forms an integral part of the Terms of Sale (the “Terms of Sale”), accepted when an organization is created. It applies to every organization, whether on a free or a paid plan, without any separate signature. Administrators of existing organizations are notified of its publication by email. A Customer that wishes to can obtain a signed copy by writing to privacy@there.do. 1.2. The Agreement applies to the personal data that the Customer and its users enter, import, record or share in the Services, and that There processes on the Customer’s behalf (“Customer Data”). 1.3. The Agreement does not apply to data that There processes for its own purposes as a controller, in particular customer relationship management, invoicing, prospecting and audience measurement of its websites. That processing is described in the Privacy Policy. 1.4. If this Agreement conflicts with the Terms of Sale, the Terms of Service or the Privacy Policy, this Agreement prevails for everything relating to the protection of Customer Data. Standard contractual clauses entered into for a transfer prevail over this Agreement within their scope.Article 2 — Definitions
The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given to them in the GDPR. Other capitalized terms have the meaning given to them in the Terms of Sale. “Sub-processor” means any provider engaged by There that processes Customer Data.Article 3 — Roles of the parties
3.1. The Customer acts as controller. There acts as processor. 3.2. Where the Customer itself acts as a processor on behalf of a third party, There acts as a sub-processor. The Customer then warrants that it is authorized to engage There and that its instructions are consistent with those of its own controller.Article 4 — Description of the processing
The subject matter, nature, purpose and duration of the processing, the categories of data and the categories of data subjects are described in Annex 1.Article 5 — Customer instructions
5.1. There processes Customer Data only on documented instructions from the Customer, including with regard to transfers outside the European Union, unless required to do so by law. In that case, There informs the Customer of that legal requirement before processing, unless the law prohibits it. 5.2. The Customer’s documented instructions are: the Terms of Sale, the Terms of Service and this Agreement; the configuration and use of the Services by the Customer and its authorized users, including the features, AI models and integrations they enable; any other written instruction accepted by There. 5.3. There immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. There may then suspend the instruction concerned until the Customer confirms or amends it. 5.4. Subject to Article 5.5, There does not process Customer Data for its own purposes. In particular, There does not sell Customer Data and does not use it to train artificial intelligence models. Its sub-processors providing AI services have contractually committed not to use it for that purpose. 5.5. There processes, as a controller, data relating to the use of the Services: account and connection data, technical logs, usage events and support exchanges. It uses them to provide, secure, maintain and improve the Services, support users and produce statistics, as described in the Privacy Policy. This processing does not cover the content of the Customer’s notes, documents and files, except to the extent needed to diagnose an incident or handle a support request.Article 6 — Customer obligations
The Customer:- ensures that the processing it entrusts to There is lawful and has a legal basis for each processing operation;
- informs data subjects, including people recorded in a voice note (see Informing participants);
- only enters special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) in the Services where strictly necessary, and under its own responsibility;
- manages its users’ access and the visibility of its content in the Services.
Article 7 — Confidentiality
There ensures that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Customer Data is limited to team members who need it to provide, maintain or secure the Services, or to respond to a Customer request.Article 8 — Security
8.1. There implements the appropriate technical and organizational measures required by Article 32 of the GDPR, described in Annex 2. 8.2. There regularly tests, assesses and evaluates the effectiveness of these measures. It may update them, provided that the overall level of security of Customer Data is not reduced.Article 9 — Sub-processors
9.1. The Customer gives There a general authorization to engage sub-processors. The current list of sub-processors is in Annex 3. 9.2. There informs the Customer of any addition or replacement of a sub-processor at least thirty (30) days in advance, by email to the organization’s administrators and by updating Annex 3. Where a replacement is required for an urgent security or service continuity reason, There informs the Customer as soon as possible, and the Customer may object under Article 9.3 from that notice. 9.3. The Customer may object to the change in writing before the notice period expires, on objective and documented grounds relating to the new sub-processor’s ability to comply with data protection law. There may then propose a solution, for example not entrusting Customer Data to that sub-processor or disabling the feature concerned for the organization. If no solution is found within thirty (30) days of the objection, the Customer may, as its sole remedy, cancel its subscription and request the deletion of its organization under Article 14.3, without penalty. There then refunds the prepaid sums for the remaining period. If the Customer does not object within the notice period, the change is deemed accepted. 9.4. There contractually imposes on each sub-processor data protection obligations at least equivalent to those of this Agreement. There remains fully liable to the Customer for the performance of those obligations by its sub-processors. 9.5. Integrations that the Customer enables itself in the Services (for example an email account, a calendar or a document management system) are not sub-processors of There. Data sent to those services is sent on the Customer’s instructions and is governed by the contract between the Customer and their provider.Article 10 — Transfers outside the European Union
10.1. The application database is hosted in Frankfurt, Germany, and files are stored in the European Union. 10.2. Some sub-processors are established outside the European Economic Area or may process Customer Data there, including through remote access. These transfers rely on one of the following mechanisms:- an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, only where the recipient is certified for the service concerned;
- otherwise, the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), Module 3 (processor to processor), together with the necessary supplementary measures.
Article 11 — Assistance to the Customer
11.1. Taking into account the nature of the processing, There assists the Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects exercising their rights. The Services let the Customer view, edit, export and delete most Customer Data. If There receives such a request directly, it forwards it to the Customer without responding itself, unless instructed otherwise. 11.2. Taking into account the information available to it, There assists the Customer in meeting its obligations under Articles 32 to 36 of the GDPR: security of processing, notification of data breaches, data protection impact assessments and prior consultation of the supervisory authority.Article 12 — Personal data breaches
12.1. There notifies the Customer of any personal data breach affecting Customer Data within forty-eight (48) hours of becoming aware of it, including where a sub-processor reports the breach to There. 12.2. The notification is sent to the organization’s administrators. It describes, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Information that is not immediately available is provided as it becomes available: the first notification does not wait for the investigation to be complete. 12.3. There promptly takes the necessary measures to contain the breach and limit its consequences. The Customer decides on notifications to the supervisory authority and communications to data subjects; There only makes them on the Customer’s behalf on instruction or where required by law. A notification is not an admission of liability.Article 13 — Documentation and audits
13.1. There makes available to the Customer the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR: this Agreement and its annexes, the Security and privacy page and answers to the Customer’s reasonable security questionnaires. 13.2. If that information is not sufficient, the Customer may carry out an audit, including an inspection, itself or through an independent auditor who is not a competitor of There and is bound by confidentiality. The audit:- is limited to once per twelve (12) month period, except after a data breach affecting Customer Data or at the request of a supervisory authority;
- is notified at least thirty (30) days in advance, with a scope defined in advance;
- takes place remotely where possible, during business hours, without disrupting the Services or giving access to other customers’ data;
- is carried out at the expense of the requesting Customer, including the time spent by There’s team, on the basis of a prior quote.