Data Processing Agreement
This Data Processing Agreement (“DPA”) is part of the agreement between your company (the “Customer”) and NeuroForecast under our Terms of Service at neuroforecast.com/legal/terms. It applies whenever we process personal data on the Customer’s behalf. “NeuroForecast” is the company named in section 1 of the Terms: NEUROFORECAST sp. z o.o. for customers in the European Union or the European Economic Area, NeuroForecast LLC for all others.
The Customer is the controller of the personal data that it and its users put into the Service or load from their systems. NeuroForecast is the processor.
In matters of personal data, this DPA prevails over the Terms.
Purpose: to provide the Service: storing and analysing data to produce forecasts, recommendations and plans, support, backups and notifications.
People: the Customer’s users; the Customer’s customers, suppliers, sales representatives and their contact persons; other people whose data the Customer loads.
Data: names, business contact details, job roles, sales and purchase records linked to these people, notes, comments and mentions, and the users’ account data, usage data and logs.
The Customer does not load special categories of data, such as health data, into the Service.
Duration: the term of the agreement and the time until the data is deleted under section 8.
We process personal data only on the Customer’s documented instructions: the agreement, this DPA, and the Customer’s settings and actions in the Service. If the law requires other processing, we tell the Customer first, unless the law forbids it.
We tell the Customer if we believe an instruction breaks data protection law.
Everyone at NeuroForecast and our subprocessors who can access the data is bound by confidentiality.
We apply the measures in the Annex and keep them appropriate to the risk. We may change them, but never lower the overall level of protection.
The Customer authorises us to use subprocessors. The current list is at neuroforecast.com/legal/subprocessors.
We tell the Customer’s administrators by email at least 30 days before we add or replace a subprocessor. The Customer may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the Customer may end the affected part of the agreement, and we refund prepaid fees for the rest of the term.
Each subprocessor is bound by data protection terms at least as protective as this DPA. We remain responsible for its work.
Data of customers in the European Union or the European Economic Area is stored in the Service in data centres in the EU (Poland and the Netherlands).
Transfers to subprocessors or to our group company outside the European Economic Area are covered by the EU–US Data Privacy Framework where the recipient is certified, and otherwise by the European Commission’s standard contractual clauses.
Where a Customer outside the EU is subject to the GDPR, the UK GDPR or the Swiss data protection act, the standard contractual clauses (module 2, with the UK Addendum or the Swiss amendments where they apply) are incorporated into this DPA by reference, with the Customer as exporter and NeuroForecast LLC as importer.
We help the Customer answer requests from people exercising their data protection rights. If we receive such a request directly, we pass it on to the Customer.
We help the Customer with security, data protection impact assessments and consultations with authorities, as far as our part of the processing requires.
Personal data breach: we notify the Customer without undue delay, at the latest within 48 hours of becoming aware of it, with the information we have, and we keep the Customer updated.
8. End of the agreement
The Customer can export its data at any time in the Service. After the agreement ends, the Customer has 30 days to export it. Then we delete it, unless the law requires us to keep it. Copies in backups are deleted as the backups expire.
9. Audits
We provide the information needed to show that we comply with this DPA, such as our security documentation and independent audit reports when we have them. If this is not enough, the Customer may audit us once a year, with 30 days’ notice, at its own cost, during business hours and through an auditor bound by confidentiality, without access to other customers’ data.
10. US state privacy laws
For Customers subject to the California Consumer Privacy Act or similar US state laws, we act as their service provider or processor. We do not sell or share the personal information, and we do not keep, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with the Customer. We do not combine it with personal information from other sources, except as these laws allow. We will tell the Customer if we can no longer meet these obligations, and the Customer may take reasonable steps to stop unauthorised use.
11. Liability
Each party’s liability under this DPA is subject to the limits in the Terms, except where the law does not allow limits.
Annex: Security measures
Encryption of data in transit (TLS 1.2 or higher) and at rest.
Each customer’s data kept in one region, with cloud settings that block resources outside it.
Access by role. Users sign in with one-time codes or with Microsoft or Google. Optional automatic sign-out after inactivity. Sessions end when a user’s role changes or the account is deactivated.
Our staff access customer accounts only when needed. Every access is logged and the record is kept for 24 months.
Server logs kept for 12 months in storage that cannot be altered.
Daily backups within the region, with a restore tested every quarter.
Infrastructure defined in code, review of every change, deployment only from our build pipeline and weekly scanning of the software we depend on.
Rate limits on all interfaces.
A process for reporting vulnerabilities, described at neuroforecast.com/.well-known/security.txt.
Export and deletion of all of a customer’s data on request.