Data Processing Terms

These Data Processing Terms are part of the Terms of Service between AppGena (“AppGena”, “we”) and the customer company (“you”). They apply whenever we process personal information in Customer Data on your behalf. If you need a signed copy for your records, email support@appgena.com.

1. Roles

For personal information in Customer Data, you are the controller (or “business”) and we are your processor (or “service provider” / “contractor”). You decide what your apps collect and why. Account and billing information about your users is covered by our Privacy Policy, where we act as controller.

2. What we process

• Purpose: to provide, secure and support AppGena for you, as set out in the Terms.
• Duration: while your account is open, plus the deletion periods in section 9.
• People involved: your users, and the people your apps collect information about — for example property owners, tenants, claimants, customers, drivers and workers.
• Kinds of information: whatever your apps ask for, typically names, contact details, addresses, policy or claim numbers, vehicle details, photos, signatures, locations, notes and readings. You agree not to collect sensitive information (such as health, financial-account or government ID numbers) unless we have agreed it in writing.

3. Your instructions

We process Customer Data only on your documented instructions. The Terms, these Data Processing Terms, and the way you set up and use AppGena are your instructions. We will tell you if we believe an instruction breaks the law. You are responsible for having a lawful basis for the processing and for giving the notices and getting the consents your apps need.

4. United States privacy laws

Where US state privacy laws apply (such as the California Consumer Privacy Act), we will not:

• sell or share Customer Data, or use it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than providing the service to you, or outside our direct business relationship with you;
• combine it with personal information we get from others, except as the law allows a service provider to do.

We will comply with those laws, give the same level of privacy protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop and fix any unauthorized use.

5. Confidentiality and staff

Only staff who need access to run or support the service can reach Customer Data, and they are bound to keep it confidential. Staff access to your workspace uses a time-limited support mode, recorded in your Activity Log under the staff member’s own name.

6. Security

We keep appropriate technical and organizational measures in place to protect Customer Data, described on our Security page. We may improve them over time but will not reduce the overall level of protection.

7. Subprocessors

You agree that we may use the subprocessors listed on our Security page. We hold each one to data-protection terms at least as protective as these, and we remain responsible for their work. We will update that list at least 30 days before a new subprocessor starts handling Customer Data. If you object on reasonable data-protection grounds, tell us within that period; we will try to find a solution, and if we can’t, you may close your account and receive a refund of unused prepaid funds.

8. Helping you

• Requests from people: if someone asks us about information your company collected, we will pass the request to you rather than answer it ourselves, unless the law requires otherwise. AppGena’s search, record editing, deletion and exports let you answer most requests yourself; for anything else we will help within reason.
• Breaches: we will tell you without undue delay, and within 72 hours, after we become aware of a breach affecting your Customer Data. We will share what we know, what we are doing about it, and what you may need to do, and update you as we learn more.
• Assessments: we will give you reasonable information you need for data protection impact assessments or questions from regulators.

9. Return and deletion

You can export your Customer Data at any time while your account is open. When your account closes, you have 30 days to download it. We then delete it within 90 days of closing, and it rolls out of our backups within a further 30 days, unless the law requires us to keep part of it. Billing records are kept as described in the Privacy Policy.

10. Information and audits

On request, we will answer reasonable written security and privacy questionnaires up to once a year, and give you the information you need to show that these terms are being met. If a regulator requires more, or after a breach, we will cooperate with a reasonable audit on agreed dates, at your cost, under confidentiality.

11. Where data is processed

We process Customer Data in the United States. If you are subject to laws that restrict transfers there (for example the GDPR or UK GDPR), email us and we will put the appropriate transfer terms, such as the European Commission’s Standard Contractual Clauses, in place with you.

12. Which terms win

If these Data Processing Terms conflict with the Terms of Service about personal information, these Data Processing Terms win. The limits of liability in the Terms apply to these terms too.