Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Ivacode SRL ("Ivacode", the processor) and the customer who has bought IvaBoard (the "Customer", the controller). It applies automatically when you buy IvaBoard and ends when the Terms end. You do not need to sign it. If you need a signed copy, write to support@ivaboard.com.

It covers the personal data that Ivacode processes on the Customer's behalf under Article 28 of the EU General Data Protection Regulation (GDPR), and under equivalent rules where they apply (the UK GDPR, and Moldova's Law No. 195/2024).

1. What this DPA covers, and what it does not

This DPA covers Customer Personal Data: personal data in the Customer's workspace that relates to the Customer's participants and other people the Customer chooses to put in IvaBoard.

It does not cover data for which Ivacode is a controller. That includes the Customer's own staff accounts, billing and order data, website data, and the shared sign-in account that a participant can use across portals (email, display name, how they sign in, and sign-in sessions). The Privacy Policy explains these. For the shared sign-in account, the Customer stays the controller of what the participant does in the Customer's portal.

2. Roles

• The Customer is the controller of Customer Personal Data. The Customer decides what is collected and why, and is responsible for having a legal basis and for informing participants.
• Ivacode is the processor. It processes Customer Personal Data only to provide IvaBoard, following the Customer's documented instructions.
• If the Customer is itself a processor for its own customer, the Customer confirms it has the authority to give these instructions and agrees that Ivacode acts as a subprocessor. The Customer passes on any instructions from the ultimate controller.

3. Details of the processing

4. The Customer's instructions

Ivacode processes Customer Personal Data only on the Customer's documented instructions. These Terms, this DPA, the Customer's use of the console, API and settings, and written requests to support@ivaboard.com are the instructions. Ivacode will tell the Customer if it thinks an instruction breaks data protection law. Ivacode may process data without instruction where the law requires it, and will tell the Customer first unless the law forbids it.

5. Confidentiality

Ivacode makes sure that everyone with access to Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it to run and support the service.

6. Security

Ivacode puts in place technical and organisational measures that fit the risk, as Article 32 GDPR requires. These are the measures in place now.

Isolation and access

• Each workspace's data is separated by the application and again by PostgreSQL row-level security, so one customer's data cannot be read through another customer's account.
• The service uses separate database roles with limited rights (for example a read-only backup role and a separate role for deletion).
• Staff of the Customer sign in to a separate authentication system from participants. Owners and admins must use two-factor sign-in, and sensitive actions require a fresh sign-in.
• Roles and product grants limit what each staff member can see. Grants can expire.
• Passwords are stored only as hashes. Second-factor secrets are encrypted at rest. API keys are stored as hashes and shown once. Webhook signing secrets are encrypted at rest.

In transit and at the edge

• Connections to the service use TLS (https).
• Outgoing webhooks are signed (HMAC-SHA256 over timestamp and body), and delivery is blocked to private, loopback and metadata addresses.
• Requests that change data are protected against cross-site request forgery. Sign-in, posting, voting and exports are rate limited.

Content and files

• Content is restricted Markdown or plain text. Raw HTML and scripts are not accepted.
• Only PNG, JPEG and WebP images are accepted. The real file type is checked, each image is decoded and re-encoded, which removes EXIF and other metadata, and it is stored privately. Images are served only after a fresh access check, with short-lived links.

Availability, backups and deletion

• The database and stored files are backed up daily. Every backup copy is removed within 30 days. Backup files are protected with restricted file permissions.
• The service has monitoring and alerts. Monitoring data contains no tenant content.
• Important actions are written to an audit log that records identifiers, not personal content.

Organisation

• Production access is limited to the people who run the service. Dependencies and container images are scanned, and security patches are applied promptly.
• Ivacode will review these measures as the service changes. It will not make them weaker in a way that lowers the protection of Customer Personal Data.

7. Subprocessors

• The Customer gives Ivacode general authorisation to use subprocessors. The current list, with their purpose and location, is on the Subprocessors page.
• Ivacode has a written contract with each subprocessor that gives it data protection duties no less protective than this DPA, and Ivacode stays responsible for them.
• Changes. Ivacode will update the Subprocessors page and email the workspace owner at least 30 days before a new subprocessor starts to process Customer Personal Data. The Customer may object on reasonable data protection grounds by writing to support@ivaboard.com within that time. Ivacode and the Customer will try to find a solution. If none is found, the Customer may end the affected service and receive a refund for the unused part of an annual term.
• Ivacode may replace a subprocessor at once in an emergency (for example a security incident at the provider) and will tell the Customer as soon as it can.

8. Requests from participants

Ivacode helps the Customer answer requests from people exercising their rights (access, correction, erasure, restriction, portability and objection), taking into account the nature of the processing.

• The Customer can use the console to correct, hide, delete and export content.
• Participants can request erasure of their own account from the portal settings. There is a fixed 30-day window in which they can cancel it. After that, their name and email are replaced by "Erased participant", their ideas and comments remain without an author name, their votes remain without a name, and the images they uploaded are deleted. This is built into the service.
• If Ivacode receives a request about Customer Personal Data, it will not answer it itself except to point the person to the Customer, unless the law requires otherwise. It will pass the request to the Customer without undue delay.

9. Personal data breaches

Ivacode will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and aims to do so within 72 hours. The notice will, as far as known, describe what happened, the kinds and approximate number of people and records affected, the likely effects, and what Ivacode has done and recommends. Ivacode will keep the Customer updated and help it meet its own duty to notify authorities and people. Ivacode does not need to be named in the Customer's notices.

10. Other help

Taking into account the nature of the processing and the information it has, Ivacode will give reasonable help with the Customer's data protection impact assessments and with consultations with supervisory authorities. Ivacode will give the Customer the information needed to show that it follows this DPA.

11. International transfers

• The service is hosted by OVH in Germany, and the website in the United Kingdom (see the Subprocessors page). Ivacode SRL is in the Republic of Moldova, and its team can access the systems from there.
• Where Customer Personal Data that is subject to the GDPR is transferred to Ivacode in Moldova, or to another country that does not have an adequacy decision, and no other lawful basis applies, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated here by reference with these choices: Clause 7 (docking) applies; Clause 9(a) option 2 (general authorisation) with the 30-day period in section 7; Clause 11 optional language does not apply; Clause 17 governing law: the law of Germany; Clause 18 courts: the courts of the same country. Annex I is section 3 of this DPA, and Annex II is section 6. The competent supervisory authority is the one in the country where the Customer is established.
• Where the UK GDPR applies, the UK International Data Transfer Addendum to those clauses applies in the same way. Where Swiss law applies, the clauses apply with the changes Swiss law requires.
• Ivacode will not move Customer Personal Data to a different country for storage without telling the Customer, as in section 7.
• If the transfer rules change, or a court or authority decides these safeguards are no longer enough, the parties will work together in good faith to put an alternative in place.

12. Deletion and return of data

• During the term the Customer can export its data from the console (for example CSV) and delete content at any time.
• Workspace deletion. An owner can delete the workspace in the console. It is frozen for 14 days (the portal is offline and changes are refused) and any owner can cancel. After the window the workspace and its data are deleted and stored files are removed. Copies in backups expire within 30 days. A backup is not a way to undo a deletion.
• End of the Terms. When the Terms end, the Customer can ask for an export within 30 days. After that, or when the workspace is deleted, Ivacode deletes Customer Personal Data as above, unless the law requires it to keep some. Ivacode will tell the Customer if it must keep anything and will protect it.
• On request, Ivacode will confirm in writing that deletion has taken place.

13. Audits

Ivacode will give the Customer the information needed to show that it follows this DPA, and will allow and help with audits, including inspections, by the Customer or an auditor the Customer appoints, as Article 28(3)(h) GDPR requires. To keep this reasonable: the Customer gives at least 30 days' written notice, no more than once a year (or sooner after a breach), during business hours, with a confidentiality agreement, and without access to other customers' data. Ivacode may meet the request first with written answers and documents. Each party bears its own costs, and the Customer pays for Ivacode's time beyond a reasonable amount.

14. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service, to the extent the law allows. Nothing limits liability to a data subject or any liability that cannot be limited by law, and nothing changes the Standard Contractual Clauses, which prevail if there is a conflict with them.

15. Customer's duties

The Customer will use IvaBoard lawfully. It will give participants the information the law requires (including that IvaBoard is a processor and, where needed, a link to our Privacy Policy), have a legal basis for the data it collects, set a sensible retention policy using the tools provided, and not ask Ivacode to process data in a way that breaks the law.

16. Order of precedence and term

If this DPA conflicts with the Terms about the processing of personal data, this DPA applies. If it conflicts with the Standard Contractual Clauses, the Clauses apply. This DPA lasts as long as Ivacode processes Customer Personal Data, even after the Terms end.

17. Contact

Ivacode SRL, str. Alba-Iulia 21/1, MD-2051, Chișinău, Republic of Moldova
Email: support@ivaboard.com