Data Processing Agreement

Scope of processing

• Subject matter and purpose: providing Bamboo Insights: analysis of marketing and sales data, an AI assistant, dashboards, content generation and scheduled reports.
• Duration: for the term of the agreement, then until deletion as set out below.
• Data subjects: the Customer's users; individuals whose data appears in connected sources or uploaded files (for example the Customer's clients, their staff, and, to a limited extent, their customers).
• Categories of data: names and business contact details; account identifiers; aggregated marketing and sales metrics; content of conversations, files and generated outputs. Special categories of data aren't required by the service and shouldn't be uploaded.

Processing on instructions

We process personal data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use of the service's features, unless the law requires otherwise, in which case we'll inform the Customer unless the law prohibits it. We'll tell the Customer if we believe an instruction breaks data-protection law.

Confidentiality

Everyone authorized to process the data is bound by confidentiality obligations and accesses it only as needed to provide, support and secure the service.

Security measures

We implement appropriate technical and organizational measures, described on our Security page, including encryption in transit and of credentials at rest, strict separation between customers, role-based access, least-privilege connections, activity logging, sandboxing of generated content, and secure payment processing.

Subprocessors

The Customer authorizes the subprocessors below. We bind each to data-protection terms at least as protective as this DPA and remain responsible for them. We'll give at least 30 days' notice of a new subprocessor on this page or by email; the Customer may object on reasonable data-protection grounds and, if we can't resolve it, terminate the affected service.

Data subject requests and assistance

The service lets the Customer export and delete data. We'll otherwise help the Customer respond to data-subject requests, and with data-protection impact assessments and consultations with authorities, to the extent reasonable given the nature of the processing. Requests we receive directly about Customer data will be forwarded to the Customer.

Personal data breaches

We'll notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Customer data, with the information the Customer reasonably needs to meet its own obligations, and we'll take reasonable steps to contain and remedy it.

International transfers

Where Customer data is transferred outside the EU/EEA, the UK or Israel to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated by reference, or another lawful transfer mechanism.

Deletion and return

The Customer can export its data at any time. When the Customer deletes a workspace or organization, or the agreement ends, we delete the related Customer data from active systems, except where the law requires us to keep it (for example invoices), in which case it's kept confidential and processed only for that purpose.

Information and audits

On request we'll provide the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires. Where that isn't sufficient, the Customer may conduct an audit, at its own cost, with 30 days' notice, at most once a year, in a way that protects other customers' confidentiality.

Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms, except where the law doesn't allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.