Data processing agreement

1. How it applies

This agreement is part of our Terms of use for every business customer and applies automatically; nothing needs to be signed. If you need a signed copy, write to us. Words such as personal data, processing, controller, processor, data subject and personal data breach mean what the GDPR says they mean.

Your personal data means the personal data in your workspaces that we process for you: the designs, comments, requests, files, versions and history in them, and the details of the people you add. For it, you are the controller (or a processor for your own client) and we are your processor. Where we decide why and how data is processed ourselves, such as for accounts, sign-in, billing, security and our legal duties, we are its controller, and our Privacy policy applies.

If this agreement and the Terms of use disagree about personal data, this agreement wins.

2. Your instructions

We process your personal data only on your documented instructions: these terms, this agreement, and what you and your people do in Repen and ask of it (including through your agents). Other instructions must be in writing and fit the service. If the law requires us to process it otherwise, we tell you first, unless the law forbids that.

We tell you if we think an instruction breaks the GDPR or other data protection law. You are responsible for having a lawful basis for the personal data you put in Repen and for what you tell the people it concerns.

3. What we process

4. Our people

Only Forthbound staff who need it to run, support or secure Repen can reach your personal data. They are bound to confidentiality, and what they do in our back office is recorded.

5. Security

We keep technical and organisational measures that give a level of security appropriate to the risk (GDPR Art. 32). Today they are:

We may improve these measures over time, as long as security doesn’t go down.

6. Sub-processors

You allow us to use the sub-processors on our Sub-processors page. We bind each one by contract to protect personal data at least as this agreement requires, where our contract with it allows that, and we remain responsible to you for them.

Image generation and dictation are optional features that send the prompt or recording to the model provider listed for them, which Cloudflare engages for us as its own sub-processor, under Cloudflare’s data processing agreement. If personal data in your workspace must not reach them, ask your people not to use those features for it.

We tell you at least 14 days before we add or replace a sub-processor, by email to your workspace’s owners and on the Sub-processors page. You can object on reasonable data protection grounds within that time. If we can’t resolve it together, you can end the affected plan before the change, and we refund what you paid for the time after it.

7. Helping you

Taking into account what we process and the information we have, we help you answer requests from data subjects (to see, correct, erase, restrict, move or object to their data), with your security duties, with data protection impact assessments and with consulting a supervisory authority. Much of this you can do yourself in Repen. If a data subject asks us directly about your data, we pass the request to you and don’t answer it ourselves unless you ask us to.

8. Personal data breaches

We tell your workspace’s owners without undue delay, and at the latest within 72 hours, after we become aware of a personal data breach affecting your personal data. We say what we know (what happened, which data and people it concerns, the likely consequences, and what we’re doing about it) and add details as we learn them, so you can meet your own duties. Telling you isn’t an admission of fault.

9. When processing ends

You can export your designs at any time while you use Repen, and for 30 days after our agreement ends. After that, or when you delete a workspace, design or account, we delete your personal data as our Privacy policy describes: for good after any waiting time it states, and from our host’s 30-day recovery 30 days later. We keep only what the law requires us to keep, and only for as long as it does.

10. Information and audits

We give you the information you reasonably need to show that this agreement is kept, including written answers to a security questionnaire once a year. If that isn’t enough, or a supervisory authority asks, you may have an audit done by an independent auditor bound to confidentiality, at your cost, once a year, with 30 days’ notice, during working hours and without disturbing other customers or reaching their data. Our sub-processors’ own audit reports and certifications may be used instead where they cover what you need.

11. Transfers outside the EU

We are in the EU. Where a sub-processor handles your personal data outside the EU, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or on the EU’s standard contractual clauses between us and the sub-processor, as the Sub-processors page says. You allow these transfers. Write to us for a copy of the safeguards.

12. Liability and law

Each party’s liability under this agreement follows the Terms of use, except where the GDPR doesn’t allow it to be limited. Estonian law applies, and disputes go to Harju County Court in Tallinn. This agreement lasts as long as we process personal data for you.