Data Processing Agreement

Description of the processing

• Subject matter: running the apps you publish on Bunbird and storing their data.
• Duration: while the app and your organisation exist, plus the deletion periods in “Deletion” below.
• Nature and purpose: storing, retrieving, backing up and delivering app data to the people you let into the app, sending the notifications the app asks for, and keeping the app secure. Nothing else.
• Types of data: whatever your app’s users enter and your app stores: records, files, who signed in and when, notifications. Special categories of data (Article 9 of the GDPR) and payment card data are not allowed without our prior written agreement.
• Data subjects: the members and guests you let into the app, and the people whose data they enter.

Instructions

We process app data only on your documented instructions. Your instructions are: the app as you published it (what it stores, who may use it, its retention rules), these terms, and what you or your assistant do in the console or through the API. If we believe an instruction infringes the GDPR or other data protection law, we tell you. We do not process app data for our own purposes.

Who may use each app, and with which role, is part of your instructions. Your owners and admins decide it, and keeping it up to date, including removing people who should no longer have access, is your responsibility as controller. Access you gave, or did not remove, is processing on your instructions and not a breach of this agreement by us. A failure of our own security measures remains ours, as “Personal data breaches” below describes.

Confidentiality

Only the people who operate Bunbird can reach app data, only when operating the service requires it, and they are bound to keep it confidential. We do not read app data to learn what is in it.

Security

We apply the measures described in the “Security” section of the Privacy Policy: encryption in transit and at rest, isolation between organisations enforced on every request, secrets in a dedicated encrypted store, signed sessions, a content security policy for every app, least-privilege access for the people who operate the service, and dependency and image scanning in our build pipeline. Daily disk snapshots are kept for 14 days. We may change the measures as long as the level of protection does not go down.

During the preview no restore procedure is maintained and data may be lost, as the Terms of Service say. Keep your own copy of what you cannot afford to lose.

Subprocessors

You authorise us in general terms to use the subprocessors listed in the Privacy Policy under “Who else processes your data”. For app data they are Google Cloud (hosting in europe-west1) and Resend (notifications delivered by email). We tell you at least 30 days before adding or replacing one, by email or in the console; you may object by writing to support@bunbird.com, and if we cannot resolve the objection you may delete the app and end this agreement. We bind every subprocessor to data protection obligations equivalent to these and remain responsible to you for their work.

Location and transfers

App data is stored and processed in the EU (Google Cloud, europe-west1). We do not transfer it outside the EU except as Chapter V of the GDPR allows, and we tell you before any such transfer. The Privacy Policy describes the regions we plan to add; when that happens you will choose where your apps live.

Assistance

We help you meet your obligations as controller. If someone exercises their rights with us about data in your app, we forward the request to you without undue delay and do not answer it ourselves unless you ask us to. We give you the information about the processing that you need for data protection impact assessments and for consultations with a supervisory authority. Your apps let you read, correct and delete the data they hold.

Personal data breaches

If we become aware of a personal data breach affecting app data, we tell you without undue delay, with what we know at the time: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact. We update you as we learn more. Notifying the supervisory authority and the people affected is your decision as controller; we give you the information you need for it.

Deletion

When you delete an app or your organisation, or when this agreement ends, we delete its data on the schedule in the Privacy Policy: a deleted app or organisation is kept, restorable, for the period set by your plan, then permanently deleted, and backups expire after 14 days. Until then you can read the data through the app. We keep nothing afterwards except what the law requires us to keep.

Compliance and audits

On request we give you the information needed to demonstrate that we meet these obligations: this agreement, the Privacy Policy and the description of our security measures. You may audit our compliance once a year, on 30 days’ notice, through written questions or, where that is not enough, a review carried out by you or by an independent auditor bound by confidentiality, at reasonable times and at your cost. We cooperate with the supervisory authorities as the law requires.

Non-compliance and termination

If we cannot meet these obligations, we tell you without undue delay. You may then suspend the processing or delete the app, and end this agreement. This agreement ends when your last app and your organisation are deleted. Liability between us is governed by the Terms of Service, including the section for consumers.

Contact

César Arroba, David Martín Bragado, Pedro Miguel Díaz Peña and Pepe Fagoaga, trading together as Bunbird. C/ Menorca 23, Bajo B, 28290 Las Rozas de Madrid, Madrid, Spain. Email: support@bunbird.com.