Data Processing Addendum

This addendum forms part of the terms of service between you (the controller) and us (the processor). Where they conflict on the processing of personal data, this document wins.

1. Scope of processing

Subject matter. Providing the Gamify Work service: receiving events describing work, aggregating them, ranking them and awarding cards.

Duration. For as long as your organization exists with us, plus the deletion period in section 7.

Categories of data subject. Your personnel and contractors whose work is recorded, and the administrators who configure the service.

Categories of personal data. Name, work email address, source-system account identifiers, and records of work activity (timestamps, repository and channel identifiers, event types and the metrics derived from them).

Special categories. None. Do not send us any. The service has no field that expects them and no control designed for them.

2. Our obligations

• Process personal data only on your documented instructions, of which this addendum and your configuration of the service are the whole.
• Tell you if an instruction appears to us to breach applicable data protection law.
• Ensure everyone we authorise to process it is under an obligation of confidentiality.
• Not sell it, and not use it to train models.

3. Security measures

The specific measures are described, with the mechanism behind each, on the security page, which is part of this addendum by reference. In summary:

• Tenant isolation enforced by row-level security in the database, not by application code.
• Secrets encrypted with AES-256-GCM, with the tenant bound in as additional authenticated data so a ciphertext cannot be moved between organizations and still decrypt.
• An append-only audit log, enforced by database permission rather than by convention.
• Encryption in transit throughout, and at rest by our infrastructure providers.
• Inbound webhooks authenticated by signature over the raw request body, with a freshness window that defeats replay.

We are not SOC 2 or ISO 27001 certified. We will complete a security questionnaire and put specific commitments in writing where you need them.

4. Subprocessors

You authorise the subprocessors listed on the security page, which is the current list and the only one we maintain. Each is bound by terms no less protective than these, and we remain responsible for their performance.

We will give you at least 30 days’ notice before adding or replacing one. If you reasonably object on data protection grounds, tell us within that period and we will work with you; if we cannot resolve it, you may terminate the affected part of the service without penalty.

5. International transfers

Personal data is processed in the United States. For transfers from the United Kingdom or the European Economic Area, the parties incorporate the European Commission’s standard contractual clauses (module two, controller to processor) and, for the UK, the Information Commissioner’s international data transfer addendum. You are the data exporter and we are the importer.

6. Assistance

Data subject requests. The product includes export and deletion, so most requests you receive can be answered without us. Where they cannot, we will help, at no charge for a reasonable volume.

Breach notification. We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time and updates as we learn more. We will not wait until we have a complete picture to tell you.

Impact assessments. We will provide the information reasonably needed for a data protection impact assessment or a prior consultation with a supervisory authority.

7. Deletion and return

You can export your data and delete your organization from within the product at any time. On termination we will delete personal data within 30 days, except where we are required to keep it by law. Backups expire on their own schedule and are not restored selectively; anything in them remains subject to this addendum until it does.

Note that raw events are deleted on a rolling thirteen-month schedule during normal operation, independently of anything either of us does.

8. Audit

We will make available the information reasonably necessary to demonstrate compliance with this addendum, and will answer a security questionnaire once a year. Where you require an on-site audit, we will agree scope and timing in advance, and it is at your cost unless it finds a material breach.

9. Liability

The limitations in the terms of service apply to this addendum, except where data protection law does not permit them to.

10. Signing this

Accepting the terms of service accepts this addendum, and for most customers nothing further is needed. If your procurement process needs a countersigned copy, or you would rather work from your own paper, write to [email protected] and we will get it done.