Data processing agreement

1. Parties and scope

This agreement is between the business that holds a Backlabel account (the controller, “you”) and Blok Consulting (the processor, “we”). It’s part of the terms of service and covers the personal data you put in Backlabel, as article 28 of the GDPR requires. It applies as long as we process such data for you.

2. The processing

• Purpose: providing Backlabel: managing your team’s access, storing your products and versions, and publishing your public pages.
• People concerned: your staff and others you give access, and anyone named in what you publish or upload.
• Data: names, email addresses, roles, sign-in and activity logs, and any personal data in your content. Don’t put special categories of personal data in Backlabel.

3. What we commit to

• We process the data only on your instructions. These terms and the way you use Backlabel are those instructions. If we think an instruction breaks the law, we tell you.
• Everyone at Blok Consulting with access to the data is bound to confidentiality.
• We protect the data with the measures in annex 2.
• We help you answer requests from the people concerned. Most can be handled in Backlabel itself: correcting details, removing members, exporting the account.
• We tell you about a personal data breach that affects your data without undue delay, and at most 48 hours after we become aware of it, with what we know and what we do about it.
• We help you with data protection impact assessments and with questions from authorities, where reasonable.
• At the end, you can export everything. We delete your data within 30 days after the account is deleted, except what the law obliges us to keep, and remove it from backups as they expire.
• We give you the information needed to show that we keep this agreement. Once a year, you or an auditor bound to confidentiality may check it, at your cost and with 30 days’ notice.

4. Subprocessors

You allow us to use the subprocessors in annex 1. We tell account owners at least 30 days before we add or replace one. If you object for good reasons and we can’t meet them, you can end the terms before the change applies. Our subprocessors are bound to the same obligations as we are.

5. Outside the EU

Your database and files are stored in the EU. Where a subprocessor processes data outside the European Economic Area, it’s covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. Liability and term

The liability limits of the terms of service apply. This agreement ends when we no longer process your data.

Annex 1: subprocessors

Google and Microsoft receive data only for users who choose to sign in with them.

Annex 2: security measures

• Database and files stored in the EU, encrypted in transit and at rest.
• No passwords: sign-in with codes by email, passkeys, or Google and Microsoft accounts.
• Sessions are checked on every request, so signing a device out or removing a member applies at once.
• Roles per account; only owners and admins manage the team, billing and exports.
• Support access only on request, for at most an hour, and shown in the account’s log.
• An account log of what people do, and a security log of sign-ins and sign-in changes per person.
• Rate limits and bot protection on sign-in.
• Point-in-time recovery of the database for 30 days, and a nightly copy of all public pages at a second provider.