Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (the "DPA") applies when a PRO account holder (the "Controller") uses AI360Feedback to run 360-degree feedback campaigns for other people, such as coaching clients or employees. For that personal data, the Controller decides why and how it is processed and the operator of AI360Feedback (the "Processor") processes it on the Controller's behalf, as required by Article 28 of the General Data Protection Regulation (GDPR).

This DPA forms part of the terms of use for PRO accounts and applies automatically, with no signature needed. Where it conflicts with other terms on the processing of personal data, this DPA prevails. Individuals who run a 360 on themselves are not covered: for them, AI360Feedback is the controller under the privacy policy.

2. Subject matter, duration, nature and purpose

The Processor hosts the campaigns the Controller sets up, sends invitations and reminders on the Controller's request, collects self-assessments and reviewers' answers, uses AI to write reports from the answers, shows results in the Controller's dashboard and, if the Controller connects one, sends notices to the Controller's own Slack, Microsoft Teams or Google Chat. Processing lasts as long as the Controller's campaigns exist, until they are deleted as described in section 9.

3. Personal data and data subjects

• Data subjects: the people being reviewed (participants), their reviewers, and the Controller's own users.
• Personal data: names and email addresses of participants and, when the Controller asks us to invite them by email, of reviewers; optional profile information (such as role, sector or team size); ratings, comments and self-assessments; AI-written reports; development goals and check-ins.
• The service is not designed for special categories of personal data (such as health data). The Controller should tell participants and reviewers not to include them in comments.

4. Instructions

The Processor processes the personal data only on the Controller's documented instructions, which are given through the settings and actions of the service (creating campaigns, inviting reviewers, choosing questionnaires, deleting campaigns), unless EU or member-state law requires otherwise; in that case the Processor informs the Controller first unless the law forbids it. The Processor tells the Controller if, in its opinion, an instruction breaks data protection law.

5. Confidentiality

Only people who need access to run and support the service can access the personal data, and they are bound by confidentiality. The Processor does not sell the data and does not use it to train AI models.

6. Security

• Encrypted connections (HTTPS) for all traffic.
• Restricted access to servers and the administration area, with login rate limits, lockouts and automatic blocking of abusive traffic.
• The AI receives answers and comments only, never names or email addresses; the AI providers used do not train on this data.
• Anonymity safeguards: results only appear from 3 reviewers, each statement only from 3 ratings, small rater groups are merged, and comments are shuffled and rewritten by the AI.
• Daily database backups; copies kept away from the server are encrypted.
• Automated security checks and dependency updates.

7. Sub-processors

The Controller authorises the Processor to use the sub-processors listed below. The Processor binds each of them to data protection obligations equivalent to this DPA and remains responsible for them. The Processor will update this list at least 14 days before a new sub-processor processes the Controller's personal data; if the Controller objects on reasonable data protection grounds, it may stop using PRO and delete its campaigns.

8. Helping the Controller

The Processor helps the Controller answer requests from data subjects (access, correction, deletion and others), mainly through the service itself: the Controller can view and delete campaigns from its dashboard, and can contact support for anything else. The Processor also gives reasonable help with security, data protection impact assessments and consultations with supervisory authorities, taking into account the information available to it.

9. Deletion

The Controller can delete a campaign at any time: it is hidden at once and erased for good, with its answers and invitations, 30 days later. Campaigns with no activity for 12 months are erased automatically. Backup copies are replaced on a rolling basis, so deleted data leaves the backups within about 30 days. At the end of the service the Controller can delete its campaigns, and can download reports and CSV exports before doing so.

10. Personal data breaches

The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations, and takes reasonable steps to contain it.

11. Transfers outside the EEA

Some sub-processors may process personal data outside the European Economic Area, mainly in the United States. The Processor only uses sub-processors that offer the safeguards required by Chapter V of the GDPR for such transfers, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

12. Information and audits

On request, the Processor gives the Controller the information needed to show that this DPA is respected, in writing. Where that is not enough, the Controller may ask for a review of a specific point, at its own cost, with reasonable notice, and without access to other customers' data.

13. Contact

Questions about this DPA or about personal data: use the support form. Please mention "DPA" in the message.

Support · Full Privacy Policy