Data processing addendum

Subject matter and duration

We process personal data to provide the service described in the terms, for as long as your account is open plus the retention period stated in the privacy policy.

Categories of data and data subjects

Typically:

• Your team: names, email addresses, roles, sign-in activity
• Whatever you choose to display: names in a meeting-room calendar, faces in a photograph, anything in a spreadsheet you connect
• Device telemetry from your paired screens

Our obligations

We process personal data only on your documented instructions; keep anyone with access under a duty of confidentiality; apply the technical and organisational measures below; help you respond to data subject requests and to regulators; and delete or return personal data at the end of the agreement.

Technical and organisational measures

In force today:

• TLS for all traffic between browsers, players and the API
• Passwords stored only as hashes; third-party OAuth tokens encrypted at rest with AES-256-GCM
• Organisation-scoped access control, so one customer cannot reach another customer’s data
• Rate limiting on authentication endpoints
• Access to production limited to named administrators

Sub-processors

The list is in the privacy policy. We will give notice before adding one, and you may object on reasonable data protection grounds.

International transfers

Our sub-processors are named in the privacy policy and process data in the European Union and the United States. Where personal data is processed outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision covering that provider, and on a data processing agreement between us and them.

Breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any case within 72 hours of becoming aware of it, with what we know, what we are doing about it, and what you may need to tell a regulator.

Data subject requests

If one of your people writes to us about data we hold for you, we pass the request to you rather than answer it ourselves — you are the controller and the answer is yours to give. The dashboard exports and deletes on your own authority, which is usually faster than asking us.

Audits and evidence

On reasonable written notice, and not more than once a year unless a regulator requires otherwise, we will answer a security questionnaire and provide the information needed to show that this addendum is being met. Where an audit means entering a sub-processor's premises, what we can provide is the sub-processor's own certifications and reports.

Return and deletion at the end

You can export your data from the dashboard at any time, including while an account is in its 30-day grace period. After the agreement ends and the grace period elapses, personal data is anonymised and organisation content is deleted, except where a law requires us to keep something for longer — invoices being the usual case.

Which document wins

Where this addendum and the terms of service disagree about the processing of personal data, this addendum applies. Everything else is governed by the terms.