Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between SlabBoard ("SlabBoard") and the subscribing shop (the "Shop"). It applies to personal information in the Shop Data that SlabBoard processes for the Shop.

1. Roles and instructions

The Shop controls the Shop Data and decides why and how it is used. SlabBoard acts as the Shop's service provider and processes Shop Data only to provide SlabBoard, following the Terms, this DPA and the Shop's documented instructions given through the product or in writing. SlabBoard will not sell Shop Data, use it for advertising, or combine it with other data except as needed to provide the service.

2. People with access

Only personnel who need access to provide or support SlabBoard can reach Shop Data, and they are bound by confidentiality obligations.

3. Security

SlabBoard maintains a written information security program consistent with the Massachusetts standards for the protection of personal information (201 CMR 17.00), including:

• Separation of each shop's data, enforced in the application and tested automatically.
• Encryption of data in transit (TLS) and encrypted storage of credentials and secrets.
• Role-based access for shop users, and least-privilege access for our own personnel.
• Single-purpose links for the Shop's customers, instead of customer accounts.
• An audit trail of changes to records.
• Backups, security updates, and monitoring of the service.

4. Subprocessors

The Shop authorizes SlabBoard to use the subprocessors listed in the Privacy Policy. SlabBoard binds each one to data protection terms at least as protective as this DPA and remains responsible for them. SlabBoard will announce new subprocessors at least 30 days in advance; the Shop may object on reasonable data protection grounds and, if we cannot resolve the objection, cancel without penalty.

5. Security incidents

SlabBoard will notify the Shop without undue delay, and within 72 hours, after confirming a breach of security affecting Shop Data. The notice will describe what happened, the data involved and the steps taken, and SlabBoard will help the Shop meet its own notice duties, including under Massachusetts General Laws chapter 93H and the breach notice laws of other states where its customers live.

6. Requests from individuals

If a customer or employee of the Shop asks SlabBoard to access, correct or delete their information, we will refer them to the Shop. SlabBoard will help the Shop answer such requests, mainly through the product's own tools.

7. Return and deletion

At the end of the subscription the Shop has 30 days to export its data. SlabBoard then deletes the Shop Data, and backup copies are erased within 90 days, unless the law requires SlabBoard to keep something, in which case it stays protected under this DPA.

8. Information and audits

On request, and no more than once a year unless there has been an incident, SlabBoard will answer the Shop's reasonable security questionnaire and provide the information needed to show compliance with this DPA.

9. Location

Shop Data is hosted in the United States.

10. Contact

Questions about this DPA, or a signed copy for your records: [email protected].