These terms apply when TalkingSuites processes personal data that is part of your organization’s content — the data inside your servers, containers, databases, buckets and systems — on your behalf. They are part of our terms of service. Enterprise customers can ask us for a signed copy of these terms.
How we handle the personal data of the people who use our service — account holders and members — is described in our privacy policy, where TalkingSuites decides how that data is used.
Roles
For personal data in your content, your organization is the controller — it decides what is processed and why — and TalkingSuites is the processor, acting on your behalf. You are responsible for having a lawful basis for that data and for what your organization instructs us to do with it.
What we do with it
We process your content only to provide the service you use — running, storing, backing up, transmitting and securing it as the platform’s features do when you use them — and on your documented instructions, which are these terms and the way you configure the service. We do not use your content for any other purpose, and we do not sell it.
Everyone at TalkingSuites who can access your content is bound to keep it confidential, and access is limited to what their work requires. Actions our staff take on your organization are recorded in its audit log.
Security
We protect your content with the technical and organizational measures described on our security page — among them isolation between organizations, encryption of secrets, access control by role and permission, a review of what runs before it runs, and a record of every change — and we keep them up to date.
Subprocessors
We use other companies to help provide the service. The categories are:
- Infrastructure — hosting of the platform, and of the servers and buckets you create, in the locations you choose.
- Payments — Stripe, for card payments (which concerns your billing details rather than your content).
- Email delivery — for the emails the platform sends.
- Code hosting — GitHub, only when you connect it.
We require each subprocessor to protect the data at least as well as these terms do. The current list of subprocessors is available on request, and we will tell you before we add or replace one, so you can object on reasonable grounds.
Transfers
Where your content is transferred to a country that the law does not consider adequate, we protect the transfer with appropriate safeguards, such as standard contractual clauses. The servers and buckets you create stay in the locations you choose for them.
Helping you
We help you respond to requests from people exercising their rights over personal data in your content, and with security assessments and consultations the law requires, taking into account what we can reasonably know. Many requests you can answer yourself with the platform’s own tools.
Personal data breaches
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data in your content, we will tell you without undue delay, with what we know and what we are doing about it, and keep you updated.
Deletion and return
You can export your content at any time — download files, take backups and dumps into your own buckets, and reach your buckets with any S3 tool. When your organization is deleted, it can be restored for 7 days; after that, its content is deleted, except where the law requires us to keep something.
Audits
We make available the information you reasonably need to show that these terms are being met, and answer security questionnaires. We do not hold third-party certifications yet; when we do, they will be listed on our security page.
Contact
Questions about these terms, and requests for the list of subprocessors or a signed copy, go to [email protected].
Also: Privacy · Terms · Acceptable use · Cookies