Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between LinkedTeams and the business that runs a company workspace in LinkedTeams (the "Customer"). It applies when LinkedTeams processes personal data on the Customer's behalf and the EU General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection applies to that processing. It takes effect when the Customer accepts the Terms of Service, without a separate signature. If you need a countersigned copy, email hello@linkedteams.co.

1. Definitions

"Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Data Protection Law" means the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, as they apply. "Customer Personal Data" means personal data in the Customer's workspace that LinkedTeams processes on the Customer's behalf, as described in Annex 1. "Sub-processor" means a provider that LinkedTeams engages to process Customer Personal Data.

2. Roles

For Customer Personal Data, the Customer is the controller and LinkedTeams is the processor. The Customer is responsible for having a lawful basis for the personal data it puts into its workspace, including the details of the team members it invites, and for giving those people any information the law requires.

LinkedTeams is an independent controller, not a processor, for the information described in its Privacy Policy that it uses for its own purposes: user accounts and sign-in, billing and subscription records, product usage events, security logs, support messages and marketing preferences. Paddle, which processes payments as LinkedTeams' merchant of record, is also an independent controller.

3. Instructions

LinkedTeams processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use and configuration of LinkedTeams are those instructions. LinkedTeams will tell the Customer if it believes an instruction breaks Data Protection Law. If the law requires LinkedTeams to process Customer Personal Data in another way, it will tell the Customer first, unless the law prohibits that.

4. Confidentiality

LinkedTeams ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, and gives access only to those who need it to provide, support or secure the service.

5. Security

LinkedTeams applies appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing and its risks. The current measures are listed in Annex 2. LinkedTeams may update them, as long as the overall level of protection is not reduced.

6. Sub-processors

The Customer gives LinkedTeams general authorisation to engage sub-processors. The current sub-processors are listed in Annex 3. LinkedTeams will notify the Customer's workspace admin by email, and update Annex 3, at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end its subscription before the change takes effect.

LinkedTeams engages each sub-processor under a written contract with data protection obligations that offer at least the same level of protection as this DPA, and remains responsible to the Customer for its sub-processors' performance of those obligations.

7. Helping the Customer

Taking into account the nature of the processing and the information available to it, LinkedTeams will:

• help the Customer respond to requests from data subjects to exercise their rights, and pass on to the Customer any such request it receives about Customer Personal Data;
• help the Customer meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with supervisory authorities.

8. Personal data breaches

LinkedTeams will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. LinkedTeams will provide further information as it becomes available and take reasonable steps to contain the breach and reduce its effects.

9. Deletion and return

When the Customer's subscription ends, its workspace stays available read-only, so the Customer can reactivate it. On the Customer's written request at any time, LinkedTeams will provide a copy of Customer Personal Data in a common machine-readable format and, at the Customer's choice, delete it within 30 days. Copies in our providers' backups are overwritten in their normal cycle. LinkedTeams may keep Customer Personal Data where the law requires it, and will continue to protect it under this DPA while it does.

10. Information and audits

LinkedTeams will make available the information reasonably needed to demonstrate compliance with this DPA and Article 28 of the GDPR, including by answering reasonable written security and privacy questionnaires. If that information is not enough, or a supervisory authority requires it, the Customer, or an independent auditor bound by confidentiality, may audit LinkedTeams' compliance with at least 30 days' written notice, during normal business hours, no more than once a year (unless after a personal data breach or at a supervisory authority's request), and at the Customer's cost.

11. International transfers

LinkedTeams is based in the Philippines, and its sub-processors may process data in other countries, including the United States. Where Customer Personal Data is transferred from the European Economic Area to LinkedTeams, the parties agree to the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (the "SCCs"), Module Two (controller to processor), which are incorporated into this DPA by reference, as follows:

• Clause 7 (docking clause) does not apply;
• for Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 6 of this DPA;
• the optional wording in Clause 11 does not apply;
• for Clause 13, the competent supervisory authority is the one determined by Clause 13(a) based on the Customer's establishment or representative;
• for Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner applies, completed with the information in this DPA, and either party may end it as allowed by its Section 19. For transfers from Switzerland, the SCCs apply with the necessary changes: references to the GDPR are to the Swiss Federal Act on Data Protection, the competent supervisory authority is the Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland so that data subjects there can enforce their rights where they live.

LinkedTeams makes sure that onward transfers to sub-processors are covered by a recognised safeguard, such as an adequacy decision, the EU–US Data Privacy Framework for certified providers, or the SCCs.

12. Liability, term and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law or the SCCs do not allow such limits. This DPA lasts for as long as LinkedTeams processes Customer Personal Data. If this DPA conflicts with the Terms of Service, this DPA prevails; if the SCCs conflict with this DPA, the SCCs prevail.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption: all connections to the app and between LinkedTeams and its providers use TLS. The database is encrypted at rest by the hosting provider.
• Separation of customers: database row-level security keeps each workspace's data separate, and each person sees only what their role (admin or member) allows.
• Authentication: passwords are stored by the authentication provider in hashed form and are never visible to LinkedTeams. Email addresses are verified before a workspace can be activated.
• Access by LinkedTeams: limited to the people who need it to provide, support or secure the service. Service credentials are kept in the hosting provider's secret store, not in source code.
• Data minimisation: product usage events never contain the text of users' posts. Demo accounts are deleted automatically 30 days after the demo ends.
• Integrity: incoming payment notifications are verified by signature, and demo AI actions and support requests are limited to prevent misuse.
• Availability: the hosting provider runs the database with regular backups.
• Providers: LinkedTeams uses established providers that offer data processing terms, and reviews a provider before adding it.
• Incidents: suspected incidents are investigated and contained, and personal data breaches are handled as set out in section 8.

Annex 3: Sub-processors

When a user chooses to publish a post, LinkedIn receives it as the user's own post under LinkedIn's terms, as an independent controller and not as a sub-processor.