Data processing agreement

This agreement applies when you use HappySaid to collect and show testimonials and the testimonials include personal data about other people. It supplements our terms and is meant to satisfy Article 28 of the GDPR. You accept it from Privacy and data in your account settings, and we record the version and the date.

Parties and roles

The customer is the HappySaid account holder (the controller). HappySaid is the processor and processes the personal data in the customer's Spaces only on the customer's documented instructions, which are this agreement, the terms and the customer's use of the product.

For the customer's own account data (sign-in, billing, usage), HappySaid is a controller in its own right. That is explained in the privacy policy.

Subject matter and duration

The subject matter is hosting, showing and exporting the testimonials the customer collects. The agreement lasts for as long as the customer has an account and ends when the account is deleted, subject to the deletion rules below.

Nature and purpose of processing

HappySaid stores testimonials and related files, shows approved testimonials on the customer's collection page, proof page and widgets, sends the emails the product describes, and produces exports. The purpose is to provide the service the customer asked for. We do not sell or share this data, and we do not use it for advertising.

Categories of personal data

• Account data: email address, name, profile photo, plan and billing status.
• Testimonial givers: name, title, company, photo, website, social handle, email address (optional), testimonial text, rating, the consent text they agreed to and when, and a hashed IP address (an irreversible hash, not the address).

Categories of data subjects

• The customer's users who hold an account.
• The people who give testimonials.

Processor obligations

HappySaid will:

• process personal data only on the customer's instructions, and tell the customer if an instruction appears to break the law;
• make sure everyone with access is bound by confidentiality;
• keep the security measures below;
• use sub-processors only as described below;
• delete or return personal data at the end of the service;
• give the customer the information needed to show compliance with this agreement.

Sub-processors and international transfers

The customer agrees to the sub-processors on the sub-processor list. HappySaid has a written agreement with each one that requires protection equal to this agreement. HappySaid emails accepted accounts at least 30 days before adding or replacing a sub-processor, and the customer may object in that time.

Some sub-processors are in the United States. For those transfers, the Standard Contractual Clauses (Module 2, controller to processor, and Module 3, processor to processor) are incorporated by reference, together with this agreement and the security summary below as their annexes.

Security measures

A summary of the measures in place (Annex II):

• Encryption in transit (HTTPS). R2 file storage and backups are encrypted at rest.
• Sign-in by one-time email links or Google, with sessions in a secure, HTTP-only cookie.
• Access to production data limited to named staff, with staff actions recorded in an audit log staff cannot edit.
• Hashed IP addresses and hashed tokens only; sign-in and removal tokens are stored as hashes and expire.
• Private storage for data exports, with short-lived download links.
• Nightly encrypted database backups, kept for 30 days, with a monthly backup kept for 12 months.
• Error and activity logs that exclude emails, names, tokens and testimonial text.

Assistance with data subject requests

The customer can export their data and delete their account themselves. People who gave a testimonial can ask for it to be removed at happysaid.com/remove, and HappySaid passes each request to the customer and acts on it as the product describes. If a person writes to HappySaid directly with another request, HappySaid forwards it to the customer without undue delay and does not respond to it itself, except to confirm receipt.

Personal data breach

HappySaid will tell the customer without undue delay, and within 72 hours of becoming aware of a breach affecting the customer's personal data, with what it knows about the breach, the likely effects and what has been done.

Deletion at the end of the service

When the customer deletes the account, the account and everything in it (Spaces, testimonials, widgets and uploaded files) is deleted after a 7 day grace period during which the customer can cancel. Copies in backups expire on the backup schedule, which is 30 days for daily backups and 12 months for monthly backups. If a backup is restored, deleted data is deleted again before the service reopens. Until then the customer can export everything at any time.

Audits

On written request, once a year, HappySaid will give the customer the information needed to show compliance, and will allow reasonable audits by the customer or an auditor the customer names, with notice, during business hours and without disrupting the service.

Liability

Each party's liability under this agreement is subject to the limits in the terms.