Data processing agreement
Terms under Art. 28 GDPR for personal data your team enters in TeamRituals.
1. Parties and scope
This agreement is between the organisation that uses TeamRituals (“controller”) and ANANTHAM KRITHRIMAM TECHNOLOGIES (OPC) PRIVATE LIMITED (“processor”). It applies to personal data the controller’s team enters in TeamRituals and forms part of the terms of service.
2. Subject matter and duration
| Item | Details |
|---|---|
| Purpose | Providing TeamRituals: team membership, tasks, questions, rituals, adherence records, leave dates, calendar feed and optional Slack summary |
| People concerned | The controller’s employees, contractors and other people it invites |
| Kinds of data | Name, work e-mail address, time zone, role; content of tasks and comments; ritual ticks and times; leave dates and optional notes |
| Special categories | None intended. The controller tells its team not to record health details in leave notes |
| Duration | For as long as the team exists, then deletion as set out in section 8 |
3. Instructions
The processor processes the data only on the controller’s documented instructions, which are these terms and the settings the controller’s admins choose in the app, unless the law requires otherwise. In that case the processor informs the controller first, unless the law forbids it.
4. Confidentiality
Everyone at the processor who can access the data is bound to confidentiality.
5. Security measures
- Hosting in the EU (Frankfurt) with encryption in transit (TLS) and at rest (to be confirmed before launch).
- Separation of every team’s data by row-level security in the database; changes only through checked server functions (to be confirmed before launch).
- Sign-in with one-time codes; no passwords stored (to be confirmed before launch).
- Least-privilege access to production with two-factor authentication; access is logged (to be confirmed before launch).
- Daily backups; documented incident response (to be confirmed before launch).
6. Sub-processors
The controller authorises the sub-processors listed in the privacy policy. The processor binds each to equivalent data protection terms and tells the controller’s owners by e-mail at least 30 days before adding or replacing one, so the controller can object. If the objection cannot be resolved, the controller may cancel with a pro-rata refund.
7. Assistance
The processor helps the controller answer requests from data subjects (the export and deletion functions in the app cover most of them), and with security, breach notification and data protection impact assessments as far as its processing is concerned.
8. Deletion and return
Owners can export all data at any time and delete the team, which removes its data at once (backups roll over within 30 days, to be confirmed before launch). After a plan has ended, the processor deletes the team’s data 12 months after it became read-only, after notice to the owners.
9. Breaches
The processor notifies the controller without undue delay, and within 72 hours (to be confirmed before launch), after becoming aware of a personal data breach affecting the controller’s data, with the information the controller needs for its own notifications.
10. Audits
The processor provides the information needed to show compliance with this agreement and allows audits by the controller or an auditor it appoints, on reasonable notice and no more than once a year unless there is a breach.
11. Transfers
Team data is hosted in the EU. Where a sub-processor or the processor’s own staff outside the EU can access data, the processor ensures appropriate safeguards such as the EU Standard Contractual Clauses.