Data Processing Agreement

This agreement is between Broes Consulting BV, Stationsstraat 140A, 8340 Sijsele, Belgium, company number 0761.614.207, VAT BE0761614207 ("we", the processor), and the customer that holds a paid StiqNote plan for a team ("you", the controller). It follows Article 28 of the General Data Protection Regulation (GDPR) and is part of the StiqNote Terms of Service.

You accept it by taking a paid plan. No signature is needed. If you'd like a signed copy, email support@stiqnote.com.

#What we process, and why

• Subject matter: hosting and processing the content your team posts in StiqNote, so your team can review websites together.
• Duration: as long as your team uses StiqNote, and until the data is deleted as described below.
• Nature and purpose: storing, showing, sending and deleting that content, only to provide StiqNote to your team and the guests you invite. When a member asks for it, this includes fetching the public sitemap of a site your team reviews, to pick pages for a review round.
• Types of personal data: names and email addresses of members and guests; comments and replies; screenshots and attachments; screen recordings, including audio if a member turns on the microphone; console and network logs; session replays of the pages your team reviews; on Agency, clients' answers in review rounds (their name, answer, note and time) and the round history, and the logo, colour and name your team shows its clients; and whatever personal data appears on those pages or in that content.
• Categories of people: your team's members and guests (including clients asked to approve work), and people whose data appears on the websites your team reviews.

#Our obligations

• We process the data only on your documented instructions: these terms, your settings in StiqNote, and what your members do in it. If we think an instruction breaks data protection law, we'll tell you.
• Everyone at Broes Consulting BV with access to the data is bound to confidentiality.
• We take the security measures listed below and keep them up to date.
• We help you, as far as we reasonably can, to answer requests from people exercising their rights (access, correction, deletion, portability), and with security, breach notification, data protection impact assessments and prior consultation.
• We tell you without undue delay, and within 48 hours of becoming aware of it, about a personal data breach that affects your data, with what we know and what we're doing about it.
• We give you the information needed to show that we meet this agreement, and allow audits on reasonable request, with at least 30 days' notice, no more than once a year unless there's been a breach, and at your cost.

#Sub-processors

You give general permission for us to use these sub-processors:

We give each sub-processor data protection obligations at least as strict as these. We'll announce a new sub-processor at least 30 days before it starts, by email to the team's owner, and you can object on reasonable grounds. If we can't resolve it, you can cancel and get a refund for the unused prepaid period.

Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework, under which Cloudflare, Stripe, Google, GitHub, Microsoft, Salesforce (Slack), Atlassian, Asana and Automattic are certified, or otherwise on the European Commission's standard contractual clauses.

#Security measures

• All traffic to StiqNote uses TLS (HTTPS and secure WebSockets).
• Sign-in sessions and API keys are stored only as SHA-256 hashes. Sign-in codes expire after 10 minutes, and guesses are limited.
• Every request checks team membership and role. Guests see only the sites they were invited to, and never private comments. Content from other teams answers as "not found".
• Screenshots, files, recordings and replays are served only through signed links that expire after 24 hours (links in GitHub issues stay valid while the thread is linked to that issue). Only a team's branding logo is public, so it can show in emails.
• Session replay masks every form field, records nothing from password and card fields, and can hide all page text when the owner turns that on. It never runs on hosted payment pages.
• Data is stored in Cloudflare D1 (in Western Europe) and Cloudflare R2. The database can be restored to any minute within Cloudflare's point-in-time recovery window.
• Access to production systems is limited to Broes Consulting BV.

#When the agreement ends

When your team is deleted, or its owner deletes their account and no other member is left in it (guests don't count), we delete the team's content, including its files. Deleted data can remain in our database provider's recovery copies for up to 30 days. Before that, your members can export their data through the StiqNote API, and we'll help you get a copy on request. We keep data longer only where the law requires it, such as billing records.

#Law and disputes

This agreement is governed by Belgian law. Disputes go to the courts of Bruges, Belgium (between businesses, the Ghent company court, Bruges division). If this agreement and the Terms of Service conflict about personal data, this agreement wins.

#Contact

support@stiqnote.com, or Stationsstraat 140A, 8340 Sijsele, Belgium.