This agreement forms part of the Terms of Service between you (the “Controller”) and Skiwo AS (the “Processor”). It governs the personal data we process on your behalf when you use the service, as Article 28 of the GDPR requires. It applies on every plan, Free included, and needs no signature.
You are the controller of the personal data you and your users put into the service. Skiwo AS is the processor. On data protection, this agreement prevails over anything in the Terms that conflicts with it.
Subject matter: providing the service. Duration: your subscription, plus the time it takes to return or delete the data. Nature and purpose: storing, displaying, organising and sending what you put into the service, as its features do. Data subjects: the people whose data you put in, such as your staff, customers and contacts. Categories: typically contact details, the content of documents and messages, and records of use.
We process personal data only on your documented instructions, including those you give through the product, unless the law requires otherwise. If it does, we tell you first where the law allows it.
Everyone we authorise to process personal data is bound by confidentiality and accesses it only as needed to provide the service.
We take appropriate technical and organisational measures, including encryption in transit and at rest, access control, separation between workspaces, logging and tested backups.
You authorise the subprocessors we use to run the service: hosting and file storage in the EU, delivery of email and text messages, and, where a feature uses AI, an AI model provider. A current list is available on request. We give notice before adding or replacing one, and you may object on reasonable data-protection grounds. Each is bound by obligations equivalent to these.
Taking the nature of the processing into account, we help you respond to requests from data subjects, including with the export and deletion tools in the product.
We help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us.
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own notification duties.
Your data is stored in the EU. Where a transfer outside the EEA is necessary, it is covered by the EU Standard Contractual Clauses or another lawful transfer mechanism.
When the service ends, at your choice, we return or delete the personal data and existing copies within the retention period the product states, unless the law requires us to keep it.
We make available the information necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections by an auditor you mandate, on reasonable notice and subject to confidentiality.
The liability terms of the Terms of Service apply to this agreement.
Where a product sells a Best plan, a workspace on it can have a data processing agreement of its own: on your template, or with terms agreed with you. Until one is signed, this agreement applies.
Questions about this agreement: privacy@skiwo.com