Data processing addendum
Preliminary version, pending legal review.
1. Roles
This addendum applies to the personal data the subscribing company (the customer) records in Taboza: investors, vendors, clients, users and others. The customer decides what it records and why (it is the controller; under US state laws, the "business"). Taboza processes that data only on the customer's behalf (it is the processor; under US state laws, the "service provider" or "processor"). This addendum is part of the terms of use and prevails over them on personal data.
2. Instructions
We process the data only to provide the service, under the terms of use, the configuration the customer makes in the system and its written instructions. If an instruction seems unlawful to us, we will say so.
3. What we do not do
We do not sell or share the customer's personal data, use it for our own purposes (including advertising), or combine it with data from other sources, except as the law allows a service provider. If we can no longer meet this addendum, we will notify the customer.
4. Confidentiality and access
Everyone who works on Taboza is bound by confidentiality and accesses a customer's data only when needed. Support access to a company's data requires authorization by its administrator, inside the system, for a limited time, and is logged.
5. Security
We maintain appropriate technical and organizational measures: encrypted connections (TLS), encrypted database and backups, tax IDs (SSN, EIN, CPF, CNPJ) encrypted field by field, isolation of each company's data in the database, two-step verification, an audit trail, daily backups and monitoring with alerts.
6. Subprocessors
We use the subprocessors on the list published on this site. We notify the customer's administrator by e-mail at least 30 days before adding or replacing one; if the customer objects on reasonable grounds and we cannot find a solution, it may cancel the subscription without penalty. Each subprocessor takes on data protection obligations equivalent to this addendum.
7. Requests from individuals
The system gives the customer's administrator the tools to answer individuals' requests: the report with a person's data, correction, anonymization and the full export. If a person contacts us directly, we forward the request to the customer.
8. Security incidents
We notify the customer without undue delay, and within 72 hours after confirming that its personal data was affected, with what we know by then, and keep it informed. We help the customer with the notices the law requires of it.
9. End of the contract
When the account is suspended or canceled, the data is kept for 90 days, during which the customer can ask for a full export or reactivate the account. It is then permanently deleted, and it leaves the backups within 90 days. We keep only our own billing records.
10. Demonstrating compliance
We answer reasonable security questionnaires and provide the information needed to show we meet this addendum. Once we have an independent audit report (such as SOC 2), it replaces on-site audits.
11. Where the data is
The data is stored at Amazon Web Services, in the us-east-1 region (Virginia, United States). The Taboza team may access it from Brazil, for support and operations, under this addendum.