Data Processing Addendum
Last updated
Introduction
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Asari Inc. (“Ando”) and the customer that owns an Ando workspace (“Customer”). It applies whenever Ando processes Customer Personal Data that is subject to the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or similar data protection law (“Data Protection Law”).
The DPA takes effect when Customer accepts the Agreement, with no separate signature. If Customer needs a countersigned copy, email hello@ando.so.
1. Roles and Scope
Customer Personal Data means personal data in the messages, files, calls, agent instructions, and other content that Customer's members, guests, and agents submit to a workspace.
Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Ando is Customer’s processor, or subprocessor.
Ando is an independent controller of account, billing, security, and website information it collects to run its business, as described in its Privacy Policy. This DPA does not cover that information.
Each party will comply with the Data Protection Law that applies to it. Customer is responsible for having a lawful basis for the content it puts into Ando and for the instructions it gives.
2. Details of Processing
Subject matter and purpose: providing the Ando services under the Agreement: storing and delivering messages and files, running the agents and connected apps Customer enables, search, calls and transcription, notifications, and support.
Duration: the term of the Agreement, plus the deletion period in section 10.
Data subjects: Customer's workspace members and guests, and people whose details appear in the content they share.
Categories of data: names, email addresses, profile details, message and file content, call audio and transcripts, and usage and device information tied to a workspace.
Special categories: none are intended. Customer will not submit special categories of data or data about criminal convictions unless its own legal basis and safeguards allow it.
3. Customer Instructions
Ando processes Customer Personal Data only on Customer’s documented instructions, including to transfer it outside the EEA, unless the law requires otherwise. If it does, Ando tells Customer before processing, unless that law prohibits it.
Customer’s instructions are the Agreement, this DPA, the way Customer configures its workspace, and the requests its members make through the services, including instructions to agents.
Ando tells Customer promptly if it believes an instruction infringes Data Protection Law, and may suspend that processing until Customer confirms or changes the instruction.
Ando does not sell Customer Personal Data, use it for advertising, or use it to train AI models.
4. Confidentiality
Ando limits access to Customer Personal Data to personnel who need it to provide the services or support, and binds them to confidentiality and to Ando's security and privacy training and policies.
5. Security Measures
Ando maintains technical and organizational measures appropriate to the risk, which include:
Encryption of data in transit with TLS and at rest with AES-256 on its infrastructure providers
Access to production limited by role, with single sign-on, multi-factor authentication, and periodic access reviews
Tenant isolation enforced by the backend for every workspace read and write
Audit logging, continuous threat detection with alerting, and vulnerability scanning
Backups, disaster recovery planning, and secure software development with mandatory code review
An independent SOC 2 Type II audit, with the report available on request
Ando may update these measures, but will not reduce the overall level of protection.
6. Subprocessors
Customer authorizes Ando to use the subprocessors listed on the Subprocessors page.
Ando gives at least 30 days’ notice of a new subprocessor by email to workspace owners and subscribers and on that page. Customer may object on reasonable data protection grounds during the notice period. If the parties cannot resolve the objection, Customer may terminate the affected services and receive a refund of prepaid fees for them.
Ando imposes data protection terms on each subprocessor that are at least as protective as this DPA, and remains liable to Customer for its subprocessors’ performance.
7. Data Subject Requests and Assistance
Taking into account the nature of the processing, Ando assists Customer, by appropriate technical and organizational measures, in fulfilling its obligation to respond to requests from data subjects to exercise their rights. Customer can correct and delete content and members, and members can delete their own accounts, in the product.
Where Customer cannot fulfil a request in the product, Ando helps on request, including by exporting or deleting the data concerned.
If Ando receives a request directly from a data subject about Customer Personal Data, it forwards the request to Customer without undue delay and does not respond except to direct the person to Customer, unless Customer authorizes it.
Ando gives Customer reasonable help with data protection impact assessments, prior consultations with supervisory authorities, and its security obligations, using the information available to Ando.
Ando cooperates with a competent supervisory authority on request in relation to Customer Personal Data.
8. Personal Data Breaches
Ando notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
The notice describes, as far as Ando then knows, the nature of the breach, the data and people affected, the likely consequences, and the measures taken or proposed. Ando supplements it as it learns more.
Ando takes reasonable steps to contain and remedy the breach, and helps Customer meet its own notification obligations. Notice is not an admission of fault.
9. Requests from Authorities
If a public authority asks Ando to disclose Customer Personal Data, Ando tries to redirect the authority to Customer, and notifies Customer promptly unless the law prohibits it. If notice is prohibited, Ando seeks a waiver of the prohibition.
Ando discloses Customer Personal Data only in response to a legally binding request, rejects requests that are not legally binding, challenges requests it reasonably considers unlawful or overly broad, and discloses the minimum the request requires.
Ando documents each such request and its response, and gives Customer that record on request where the law allows.
10. Return and Deletion
During the term, Customer can export or delete its content using the services, or ask Ando for help.
Within 90 days after the Agreement ends, Ando deletes Customer Personal Data, unless Customer asks during that period for a copy first or the law requires Ando to keep it. Data in backups is overwritten on the backups’ normal cycle and is not restored to production in the meantime.
On request, Ando confirms the deletion in writing.
11. Audits and Information
Ando makes available the information necessary to demonstrate compliance with this DPA, including its SOC 2 report, security documentation, and answers to reasonable security questionnaires, through the Trust Center or on request.
If that information is not enough to meet a requirement of Data Protection Law or a supervisory authority, Customer may audit Ando’s processing once a year, with 30 days’ notice, during business hours, under confidentiality, and at Customer’s cost, or by an independent auditor Ando reasonably accepts.
12. International Transfers
Ando processes Customer Personal Data in the United States. For a transfer from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the “SCCs”) as follows:
Module Two applies where Customer is a controller, and Module Three where Customer is a processor. Customer is the data exporter and Ando the data importer.
Clause 7 (docking) applies. Under Clause 9(a), Option 2 (general written authorization) applies with the 30-day notice period in section 6. The optional wording in Clause 11 does not apply.
Under Clause 13, the supervisory authority is the one competent for Customer, or for its EU representative where Customer has one. Under Clauses 17 and 18, the SCCs are governed by Irish law and disputes go to the courts of Ireland.
Annex I is completed by section 2 of this DPA, Annex II by section 5, and Annex III by the Subprocessors page.
For transfers from the United Kingdom, the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018 applies, with its tables completed by this section. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
If the SCCs conflict with this DPA or the Agreement, the SCCs prevail.
13. General Terms
Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law or the SCCs do not allow it.
If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data.
Ando may update this DPA to reflect changes in law or its services. Ando will not make a change that materially reduces Customer’s protection without 30 days’ notice.
Questions about this DPA, notices, and requests go to hello@ando.so.