Data processing agreement

1. Parties, roles and how this agreement applies

1.1 This agreement is between Techstus Software Solutions Limited, a company registered in Kenya under number PVT-27U5JMEZ, which provides Crowdboard (“we”, the processor), and the organization whose team uses Crowdboard on a paid plan and accepts this agreement (“you”, the controller).

1.2 It forms part of Crowdboard’s terms of service. Where the two differ about personal data that we process for you, this agreement wins.

1.3 It applies when a team owner accepts it in the app for their team, or when both of us sign a copy. It lasts as long as we process personal data for that team.

1.4 Data protection law means every law on personal data that applies to the processing, which may include the EU and UK GDPR, Qatar’s Law No. 13 of 2016 on Personal Data Privacy Protection, Kenya’s Data Protection Act 2019, the UAE’s Federal Decree-Law No. 45 of 2021 and Saudi Arabia’s Personal Data Protection Law. Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning those laws give them.

1.5 Where we’re a controller instead. This agreement covers data we process on your behalf. It doesn’t cover data we decide about ourselves: host accounts’ sign-in details used to run and secure the service, billing (handled by Paddle.com as merchant of record and an independent controller), enquiries and quotes sent to us, and how people found the site. The privacy notice covers those.

2. What we process for you

2.1 Subject matter and purpose. Providing Crowdboard to your team: hosting your games, running live games on a TV and players’ phones, collecting answers to your surveys and your question of the week, keeping your results, and posting to the chat channel you connect. We process the data only for that.

2.2 Duration. While your team uses Crowdboard, and until it’s deleted as section 5.6 describes.

2.3 People the data is about: your hosts (people on your team), people you invite to it or who ask to join it, and people who play your games, answer your surveys or guess your question of the week.

2.4 Kinds of personal data:

• Hosts, invitees and people who ask to join: name, email address, role on the team, and what they make and do (games, questions, results they ran, changes in the team’s activity log).
• Players: the display name they type and the team they pick, held in the live room and forgotten within 24 hours of the room’s last use. Names aren’t kept in results.
• Survey answers: what people type, with no name, email or account.
• Question of the week: the name a person types and their guesses, forgotten 90 days after the question was posted.
• Whatever your hosts choose to type into games, questions and team names.

2.5 No special categories. Crowdboard isn’t meant for health, religious, biometric or other special categories of data, or for data about criminal offences. Please don’t put any in.

2.6 Nature of processing: storing, organizing, displaying, transmitting (to TVs, phones and your chat channel) and deleting.

3. What we promise as processor

3.1 Your instructions. We process the data only on your documented instructions: this agreement, the terms, and what your team’s owners, admins and hosts do in the app. If the law makes us do otherwise, we’ll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we’ll say so.

3.2 Confidentiality. Everyone we allow to process the data is bound to keep it confidential.

3.3 Security. We keep the measures in the Annex, and we may improve them but won’t make them weaker overall.

3.4 People’s requests. If someone asks us to see, correct, delete or move data we hold for you, we’ll pass the request to you rather than answer it ourselves, unless you ask us to. The app lets your owners and admins remove people and delete games, results and surveys, and lets your owners download all your team’s data as one file. Where that isn’t enough, we’ll help you answer within the time the law allows.

3.5 Assessments and authorities. We’ll give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator about Crowdboard.

3.6 Records. We keep the records a processor must keep, and will show a regulator them if asked.

4. Subprocessors

4.1 You allow us to use the subprocessors listed in the Annex. Each is bound by a written contract with data protection terms at least as protective as these, and we remain responsible to you for what they do.

4.2 Changes. We’ll tell your team’s owners by email at least 30 days before we add or replace a subprocessor, and keep the list on this page current. If you object on reasonable data protection grounds, we’ll talk it through. If we can’t resolve it, you may end the affected plan before the change takes effect and we’ll refund what you paid for the time left.

4.3 Not subprocessors. Some services are chosen and controlled by you or your people, and act under their own terms with you: your chat provider (Slack, Microsoft Teams or Google Chat) when you connect a channel, the identity provider your company uses for its sign-in, and Google or Microsoft when a host signs in with them. Paddle.com sells plans as merchant of record and is a controller of the billing data it collects.

5. Breaches, audits, transfers and the end

5.1 Breaches. If we become aware of a personal data breach affecting data we process for you, we’ll tell your team’s owners without undue delay, and within 72 hours of becoming aware. We’ll say what happened, what data and how many people it likely concerns, its likely effects, and what we’re doing about it, adding details as we learn them. Telling you isn’t an admission of fault.

5.2 Proving we comply. We’ll answer a reasonable security or privacy questionnaire once a year, and give you the information needed to show we keep this agreement; the security page is the starting point. An on-site audit happens only where a law or regulator requires it, on 30 days’ notice, during working hours, at your cost, and under confidentiality.

5.3 Transfers. Our providers may process data outside your country, including in the United States and the European Union. Where the law requires a safeguard for such a transfer, we rely on one it accepts, such as the European Commission’s standard contractual clauses, which we and our subprocessors put in place.

5.4 Your part. You’re responsible for having a lawful basis for the data you put into Crowdboard, and for telling your people about it (for example, that a game’s players type a display name).

5.5 Liability. Each party’s liability under this agreement is subject to the limits in the terms of service, except where data protection law doesn’t allow a limit.

5.6 At the end. When your team is closed, or you ask us to, we delete the personal data we process for you within 30 days, and from our backups when they expire (backups are kept 29 days), unless a law requires us to keep it. Before that, your owners can download all your team’s data as one file from the Team page, and games and results can be exported from the app.

5.7 Law. This agreement follows the law and courts chosen in the terms of service, except where data protection law requires another.

Annex: security measures and subprocessors

Security measures

• Encryption in transit: every page, API call and live game over HTTPS or secure WebSockets, with HSTS for 365 days on crowdboard.app and its subdomains.
• Sign-in: no passwords. One-time email codes that last 10 minutes and 5 tries, stored only as hashes, at most 8 an hour per address and rate-limited per network address; Google, Microsoft or company sign-in (OpenID Connect with PKCE) as alternatives. Sessions end 30 days after last use.
• Separation and roles: every request is checked against the signed-in host’s team; a team’s data reaches only its members. Owner, Admin and Host roles, with an activity log of membership, role, plan, sign-in and branding changes.
• Secrets: company sign-in secrets stored encrypted; card details never reach Crowdboard.
• Players: no account, email, phone number or location; a room forgets its players within 24 hours.
• Backups: nightly, to separate encrypted storage (Cloudflare R2), checked row by row, kept 29 days; restores rehearsed on every staging release; point-in-time restore of the database as well.
• Browser: security headers that block framing and switch off camera, microphone and location; error reports strip email addresses and long numbers.
• Certifications: Crowdboard holds none of its own yet. Cloudflare holds SOC 2 Type II and ISO 27001.

Subprocessors

• Cloudflare, Inc.

  What it does

  Hosts the app, its database, the live game rooms and the backups; sends email when Resend can’t

  Data it handles

  Everything listed in section 2

  Where

  Worldwide network; the database in Eastern Europe, its backups in eastern North America

• Resend

  What it does

  Sends emails: sign-in codes, invitations, and the emails a team turns on

  Data it handles

  Hosts’ and invitees’ names and email addresses, and the email’s content

  Where

  United States

• Anthropic, PBC

  What it does

  Drafts a game from a topic, and translates a game’s questions and answers into Arabic, when a host asks

  Data it handles

  Only the text sent: the topic, or the questions and answers. Nothing about players or accounts

  Where

  United States

Questions about this agreement, or a copy to sign: write to support@crowdboard.app.