Data processing terms

Roles

The customer is the controller. Curact is the processor and acts only on the customer's documented instructions, which are the agreement, these terms and the settings the customer makes in the product.

Subject matter and duration

We process personal data for as long as the customer has a workspace, plus any retention period the customer configures. On deletion of the workspace, data is erased.

Categories of data and data subjects

• Data subjects: the customer's employees, invited contributors and meeting participants.
• Data: names, work e-mail addresses, roles and teams, Slack identifiers, meeting contributions, answers and reactions, and content from sources the customer connects.
• No special categories of data are requested by the service. The privacy filter blocks common patterns of sensitive data from being indexed.

Security measures

• Row-level access control in the database so a workspace can only reach its own data.
• Connector credentials encrypted at rest with AES-256-GCM; keys held only on the server.
• Encrypted transport (TLS) for all traffic.
• Role-based access inside the product, with staff access to customer workspaces logged in an audit trail and defaulting to read-only.
• Automatic deletion according to the customer's retention settings.

Subprocessors

The customer gives general authorisation for the subprocessors listed on the subprocessors page. We will tell customers before adding a new one, and the customer may object.

Assistance and breach notification

We help the customer answer requests from data subjects with the export and deletion tools in the product, and support impact assessments on request. We notify the customer without undue delay after becoming aware of a personal data breach.

Return and deletion

At the end of the agreement the customer can export its data from the product. When the workspace is deleted, all copies are erased apart from records we must keep by law.

Audit

We provide the information needed to demonstrate compliance and allow an audit once per year, at the customer's cost, with reasonable notice.