Data Processing Addendum

1. Definitions

1.1 Applicable Privacy Law

“Applicable Privacy Law” means any United States federal or state privacy or data-protection law of general application, or Canadian federal or provincial private-sector privacy law, that applies to xBoard’s Processing of Customer Personal Data under the Agreement.

Applicable Privacy Law may include, where applicable:

• The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”);
• The Personal Information Protection and Electronic Documents Act (“PIPEDA”);
• The Quebec Act respecting the protection of personal information in the private sector; and
• Other applicable United States state privacy laws or Canadian provincial privacy laws.

For clarity, “Applicable Privacy Law” does not include sector-specific laws or regulatory regimes, including HIPAA, GLBA, COPPA, FERPA, or similar laws governing regulated health, financial, educational, or children’s data, unless xBoard expressly agrees to such Processing in a separate written agreement.

For clarity, “Applicable Privacy Law” does not include the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation, the Swiss Federal Act on Data Protection, or the privacy or data-protection laws of any other jurisdiction outside the United States and Canada, unless xBoard expressly agrees in a separate written addendum signed by an authorized representative of xBoard.

1.2 Customer Personal Data

“Customer Personal Data” means Personal Data that xBoard Processes on behalf of Customer through the Services.

Customer Personal Data does not include information for which xBoard independently determines the purposes and means of Processing, such as xBoard’s own account administration, billing, security, website analytics, and business-contact information processed under the xBoard Privacy Policy.

1.3 Personal Data

“Personal Data” means information relating to an identified or reasonably identifiable individual, household, or consumer and includes “personal information,” “personal data,” and similar terms defined by Applicable Privacy Law.

1.4 Process or Processing

“Process” and “Processing” mean any operation performed on Personal Data, including collecting, receiving, accessing, organizing, storing, displaying, transmitting, searching, modifying, securing, backing up, deleting, or otherwise using Personal Data.

1.5 Security Incident

“Security Incident” means an actual or reasonably suspected unauthorized access to, acquisition, use, disclosure, alteration, loss, or destruction of Customer Personal Data.

Where Quebec privacy law applies, Security Incident also includes an attempted violation of an obligation concerning the confidentiality of Customer Personal Data.

Except for an attempted violation that must be reported under applicable Quebec privacy law, Security Incident does not include routine unsuccessful attempts or activities that do not compromise Customer Personal Data, such as unsuccessful login attempts, blocked network attacks, port scans, or similar events.

1.6 Services

“Services” means the xBoard application, website, customer portal, collaboration tools, storage, search, Smart Tagging, support, and related services provided under the Agreement.

1.7 Subprocessor

“Subprocessor” means a third party engaged by xBoard to Process Customer Personal Data in connection with the Services.

Back to contents

2. Scope and Roles

2.1 Scope

This DPA applies only to Customer Personal Data Processed by xBoard on behalf of Customer in connection with the Services. The details of the Processing are described in Schedule 1. This DPA is intended to address Processing governed by privacy and data-protection laws of the United States and Canada.

2.2 Customer’s Role

Customer determines:

• What Customer Personal Data is submitted to the Services;
• The individuals whose Personal Data is submitted;
• The purposes for which that information is Processed;
• Which Customer users may access the information; and
• How long Customer Personal Data should be retained, subject to the Agreement and applicable law.

Customer is the controller, business, organization, or equivalent party responsible for Customer Personal Data under Applicable Privacy Law.

2.3 xBoard’s Role

xBoard Processes Customer Personal Data on Customer’s behalf as a processor, service provider, contractor, or equivalent service provider under Applicable Privacy Law.

xBoard does not acquire ownership of Customer Personal Data.

2.4 Independent Processing

xBoard may act as an independent business, controller, or organization when Processing information for its own legitimate business operations, including:

• Managing Customer accounts and subscriptions;
• Processing payments;
• Communicating with Customer representatives;
• Preventing fraud and misuse;
• Protecting the security and integrity of the Services;
• Meeting legal obligations; and
• Producing aggregated or de-identified service analytics that cannot reasonably identify Customer or an individual.

Such Processing is governed by the Agreement and xBoard Privacy Policy rather than this DPA.

Back to contents

3. Customer Responsibilities

Customer represents and warrants that:

1. Customer has the legal authority to provide Customer Personal Data to xBoard;
2. Customer’s instructions comply with Applicable Privacy Law;
3. Customer has provided all required privacy notices and obtained all required permissions or consents;
4. Customer will use the Services only for lawful purposes;
5. Customer will configure permissions and access controls appropriately;
6. Customer will respond to privacy requests for which Customer is responsible; and
7. Customer will not instruct xBoard to Process Customer Personal Data in violation of Applicable Privacy Law; and
8. Customer will not use the Services to Process Personal Data primarily governed by privacy or data-protection laws outside the United States or Canada without xBoard’s prior written authorization; and
9. Customer will provide and maintain accurate contact information for its designated privacy and security contacts.

Customer is responsible for the accuracy, quality, legality, and content of Customer Personal Data.

Back to contents

4. Processing Instructions

4.1 Documented Instructions

xBoard will Process Customer Personal Data only:

• To provide, operate, maintain, secure, and support the Services;
• As described in the Agreement and this DPA;
• As configured or directed by Customer and its authorized users;
• To prevent fraud, abuse, security threats, and unlawful activity;
• As required by applicable law; or
• As otherwise authorized in writing by Customer.

The Agreement, this DPA, Customer’s use and configuration of the Services, and instructions submitted through authorized support channels constitute Customer’s documented instructions.

4.2 Unlawful Instructions

If xBoard reasonably believes that a Customer instruction violates Applicable Privacy Law, xBoard may suspend the affected Processing and notify Customer.

xBoard is not required to perform an instruction that would violate applicable law, undermine the security of the Services, expose another customer’s data, or require xBoard to develop functionality not included in the Services.

4.3 Legally Required Processing

If xBoard is legally required to Process or disclose Customer Personal Data outside Customer’s instructions, xBoard will notify Customer before doing so unless the law prohibits notice.

Back to contents

5. Restrictions on Use

xBoard will not:

1. Sell Customer Personal Data;
2. Share Customer Personal Data for cross-context behavioral advertising;
3. Use Customer Personal Data to advertise third-party products or services;
4. Retain, use, or disclose Customer Personal Data for purposes unrelated to providing the Services;
5. Retain, use, or disclose Customer Personal Data outside the direct business relationship between xBoard and Customer, except as permitted by Applicable Privacy Law;
6. Combine Customer Personal Data with Personal Data received from another customer or collected from xBoard’s independent interaction with an individual, except where permitted by Applicable Privacy Law and reasonably necessary to provide, secure, maintain, or improve the Services;
7. Attempt to re-identify information that has been properly de-identified, except to test whether xBoard’s de-identification processes comply with Applicable Privacy Law; or
8. Use Customer Personal Data to train or fine-tune any machine-learning or artificial-intelligence model, whether operated by xBoard or a third party, unless Customer expressly opts in through a separate written agreement.

xBoard may use aggregated or de-identified information for security, analytics, reliability, product improvement, and other lawful business purposes, provided the information cannot reasonably identify Customer or an individual.

Back to contents

6. Smart Tagging and Automated Features

When Customer enables Smart Tagging or another automated feature, xBoard may Process supported Customer content to provide the requested feature.

Such Processing will be limited to providing, securing, maintaining, and improving the feature for Customer and will remain subject to this DPA.

Customer is responsible for reviewing suggested tags, descriptions, summaries, and other automated output before relying on them. Automated output may be inaccurate. Customer will not use automated output as the sole basis for a decision producing legal or similarly significant effects concerning an individual and will provide meaningful human review and any notices, choices, or rights required by Applicable Privacy Law.

The restriction in Section 5.8 applies to Smart Tagging and all other automated features.

Back to contents

7. Confidentiality

xBoard will ensure that personnel authorized to Process Customer Personal Data:

• Access Customer Personal Data only as necessary to perform their duties;
• Are subject to confidentiality obligations;
• Receive appropriate privacy and security guidance; and
• Are subject to disciplinary or contractual consequences for unauthorized access or use.

xBoard will limit access to Customer Personal Data using role-based access controls and the principle of least privilege.

Back to contents

8. Security Measures

xBoard will maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data against unauthorized access, acquisition, use, alteration, disclosure, loss, or destruction.

The safeguards will be appropriate to:

• The sensitivity of the Customer Personal Data;
• The amount and distribution of the information;
• The nature of the Processing;
• The foreseeable risks;
• The size and complexity of xBoard’s operations; and
• Generally accepted security practices.

The current categories of security measures are described in Schedule 2.

xBoard may update its security measures as technology, threats, and the Services evolve, provided that xBoard does not materially reduce the overall protection of Customer Personal Data during the term of the Agreement.

Back to contents

9. Security Incidents

9.1 Notification

xBoard will notify Customer without undue delay and, in any event, no later than 72 hours after becoming aware of a Security Incident affecting Customer Personal Data.

Where Quebec privacy law applies, xBoard will notify Customer’s designated privacy contact without delay after becoming aware of any violation or attempted violation of an obligation concerning the confidentiality of Customer Personal Data.

Notices under this Section may be sent to Customer’s designated privacy or security contact or, if no such contact has been designated, to Customer’s account owner or primary administrative contact.

9.2 Information Provided

To the extent known and legally permitted, xBoard’s notice will include:

• The nature of the Security Incident;
• The categories of Customer Personal Data affected;
• The approximate number or categories of affected individuals;
• The date or estimated period of the incident;
• Measures taken or planned to contain and remediate the incident;
• Recommended steps Customer may take; and
• Contact information for follow-up questions.

xBoard may provide information in phases as its investigation progresses.

9.3 Cooperation

xBoard will take reasonable steps to:

• Contain and investigate the Security Incident;
• Mitigate reasonably foreseeable harm;
• Restore the security of the affected systems;
• Prevent recurrence; and
• Provide Customer with information reasonably necessary for Customer to meet applicable notification obligations.

9.4 Customer Notifications

Customer is responsible for determining whether notification to individuals, regulators, customers, or other parties is required.

xBoard will not notify individuals or regulators on Customer’s behalf unless legally required or expressly authorized by Customer.

Notification of a Security Incident does not constitute an admission of fault or liability.

Back to contents

10. Privacy Requests

If xBoard receives a request directly from an individual concerning Customer Personal Data, xBoard will, where legally permitted:

• Refer the individual to Customer;
• Notify Customer of the request; or
• Respond according to Customer’s documented instructions.

Taking into account the nature of the Processing and the functionality of the Services, xBoard will provide reasonable assistance to help Customer respond to valid requests to:

• Access Personal Data;
• Correct inaccurate Personal Data;
• Delete Personal Data;
• Obtain a portable copy of Personal Data;
• Restrict or object to Processing; or
• Exercise another right available under Applicable Privacy Law.

Customer remains responsible for verifying the requester’s identity, determining whether the request is valid, and responding within the legally required period.

If fulfilling a request requires material custom development or work outside the ordinary functionality of the Services, xBoard may charge reasonable fees after providing Customer with advance notice.

xBoard may also charge reasonable fees for repetitive, excessive, or unfounded requests, consistent with Applicable Privacy Law.

Back to contents

11. United States State Privacy Terms

Where a United States state privacy law applies to Customer Personal Data:

1. Customer appoints xBoard to Process Customer Personal Data for the limited and specified purposes described in the Agreement, this DPA, and Schedule 1.
2. xBoard will comply with obligations applicable to processors, service providers, and contractors.
3. xBoard will provide the level of privacy protection required of a processor, service provider, or contractor under applicable law.
4. xBoard will Process Customer Personal Data only according to Customer’s documented instructions, except as otherwise permitted or required by law.
5. xBoard will ensure that persons Processing Customer Personal Data are subject to confidentiality obligations.
6. xBoard will maintain reasonable security safeguards.
7. xBoard will require Subprocessors to protect Customer Personal Data through written contractual terms.
8. xBoard will reasonably assist Customer with applicable consumer requests, security obligations, cybersecurity audits, risk assessments, data-protection assessments, automated-decisionmaking obligations where applicable, and regulatory inquiries, taking into account the nature of the Processing and the information available to xBoard.
9. xBoard will notify Customer if xBoard determines that it can no longer meet its obligations under Applicable Privacy Law.
10. Customer may take reasonable and appropriate steps, including the measures described in Section 17, to verify that xBoard Processes Customer Personal Data consistently with this DPA and Applicable Privacy Law.
11. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing by xBoard, including after providing notice to xBoard where reasonably practicable.
12. Upon Customer’s reasonable request, xBoard will provide information necessary to demonstrate compliance with this DPA.

For purposes of the CCPA, xBoard is a “service provider” or “contractor” and Customer is the “business” to the extent those terms apply.

Back to contents

12. Canadian Privacy Terms

Where Canadian privacy law applies:

1. Customer remains responsible for Customer Personal Data transferred to xBoard for Processing.
2. xBoard will provide a level of protection reasonably comparable to that required of Customer under applicable Canadian privacy law.
3. xBoard will Process Customer Personal Data only for the purposes described in the Agreement, this DPA, and Customer’s documented instructions.
4. xBoard will use contractual, organizational, and technical measures to protect the confidentiality and security of Customer Personal Data.
5. xBoard will provide reasonable information allowing Customer to understand how Customer Personal Data is handled by xBoard and its Subprocessors.
6. xBoard will reasonably cooperate with Customer’s oversight and compliance activities.
7. Customer is responsible for informing individuals when their Personal Data may be Processed outside their province or outside Canada, when required.

Back to contents

13. Quebec-Specific Terms

Where the Quebec Act respecting the protection of personal information in the private sector applies:

1. This DPA documents the service arrangement between Customer and xBoard.
2. xBoard will protect the confidentiality of Customer Personal Data communicated to it.
3. xBoard will use Customer Personal Data only to perform the Services and fulfill the Agreement.
4. For purposes of this Section 13, the Agreement and this DPA remain in effect through the applicable retrieval and backup-retention periods solely for the storage, protection, retrieval, and deletion of Customer Personal Data. xBoard will not retain Customer Personal Data after those periods except as required by law.
5. xBoard will notify Customer’s designated privacy contact without delay of any violation or attempted violation of an obligation concerning the confidentiality of Customer Personal Data.
6. xBoard will provide information reasonably necessary for Customer’s privacy officer to verify xBoard’s compliance with applicable confidentiality requirements.
7. Customer may conduct reasonable verification in accordance with Section 17 of this DPA.
8. Customer remains responsible for conducting any privacy impact assessment required before communicating Personal Data outside Quebec or engaging a service provider outside Quebec.
9. Upon reasonable request, xBoard will provide information available to it that Customer reasonably requires to complete such an assessment.

Back to contents

14. Subprocessors

14.1 Authorization

Customer generally authorizes xBoard to engage Subprocessors to provide the Services.

14.2 Subprocessor Obligations

Before allowing a Subprocessor to Process Customer Personal Data, xBoard will enter into a written agreement requiring the Subprocessor to:

• Process Customer Personal Data only for the contracted services;
• Protect the confidentiality and security of Customer Personal Data;
• Notify xBoard of relevant Security Incidents;
• Assist with applicable privacy obligations where appropriate;
• Delete or return Customer Personal Data when its services end; and
• Provide protections consistent with this DPA and Applicable Privacy Law.

xBoard remains responsible for its Subprocessors’ performance of their data-protection obligations to the extent required by Applicable Privacy Law.

14.3 Changes to Subprocessors

xBoard will provide at least 15 days’ advance notice before allowing a new Subprocessor to materially Process Customer Personal Data. If advance notice is not reasonably practicable because of an emergency, security risk, legal requirement, or service-continuity issue, xBoard will provide notice as soon as reasonably practicable.

Notice may be provided through:

• The Subprocessor List;
• An in-product notification;
• Email; or
• Another reasonable electronic method.

xBoard’s current Subprocessor List is available at: https://xboard.com/legal/subprocessors

Customer may object to a new Subprocessor based on reasonable and documented data-protection concerns by contacting xBoard within 15 days after notice.

The parties will attempt in good faith to resolve the concern. If no reasonable resolution is available, Customer may stop using the affected portion of the Services or terminate the affected Services, subject to the Agreement.

Back to contents

15. Cross-Border Processing

Customer acknowledges that Customer Personal Data may be Processed in the United States, Canada, and other locations identified in the Subprocessor List.

Customer Personal Data may be subject to the laws and lawful access requirements of the jurisdiction in which it is Processed.

xBoard will use contractual and technical safeguards appropriate to the risks of cross-border Processing and Applicable Privacy Law.

xBoard does not guarantee that Customer Personal Data will remain in a specific country, state, province, or geographic region unless xBoard expressly agrees to a data-residency commitment in a signed order form.

Back to contents

16. Return and Deletion

16.1 During the Subscription

Customer may access and delete Customer Personal Data using functionality made available through the Services. Customer may export or otherwise retrieve Customer Personal Data through the Services’ then-current export or retrieval functionality.

Customer is responsible for exporting any Customer Personal Data it wishes to retain before the applicable deletion period expires.

16.2 Customer Election

At Customer’s choice, and upon a request submitted before the applicable retrieval period expires, xBoard will make all Customer Personal Data available for return through the Services’ then-current export or retrieval functionality or delete all Customer Personal Data, unless retention is required by applicable law.

16.3 After Termination or Expiration

Following termination or expiration of Customer’s subscription:

• Customer Personal Data may remain available for retrieval for up to 90 days, as described in the Agreement;
• xBoard may restrict Customer’s ability to add or modify data during that period; and
• After the applicable retrieval period, xBoard will delete or render inaccessible Customer Personal Data from active production systems unless retention is legally required.

During the applicable retrieval period, the Agreement and this DPA remain in effect solely with respect to the storage, protection, retrieval, and deletion of Customer Personal Data.

16.4 Backups

Backup copies will be deleted or overwritten in the ordinary course according to xBoard’s then-current backup-retention practices.

16.5 Legally Required Retention

xBoard may retain Customer Personal Data to the extent required by law, legal process, or a binding governmental order.

Any retained Customer Personal Data will remain protected under this DPA and will not be used for other purposes.

Back to contents

17. Compliance Information and Audits

17.1 Compliance Information

Upon reasonable written request, xBoard will provide available information reasonably necessary to demonstrate compliance with this DPA.

xBoard may satisfy this obligation by providing:

• Security questionnaires;
• Policies or summaries of policies;
• Independent assessment reports, if available;
• Penetration-test summaries, if available;
• Certifications, if obtained;
• Subprocessor information; or
• Written responses from xBoard’s security or privacy personnel.

17.2 Customer Audit

Where Applicable Privacy Law requires an audit or inspection right, including under the Colorado Privacy Act, xBoard will allow for and contribute to reasonable audits and inspections by Customer or Customer’s designated auditor, subject to the reasonable scope, timing, security, confidentiality, and non-disruption requirements described below.

In other circumstances, if the information provided under Section 17.1 is insufficient to reasonably demonstrate compliance with this DPA or Applicable Privacy Law, Customer may request an audit of controls relevant to Customer Personal Data.

Unless a regulator or Applicable Privacy Law requires otherwise:

• An audit may occur no more than once in any 12-month period;
• Customer must provide at least 30 days’ written notice;
• The audit must occur during normal business hours;
• The audit must not unreasonably disrupt xBoard’s operations;
• The audit must not expose another customer’s information or xBoard’s confidential security information;
• The auditor must be independent, appropriately qualified, and subject to confidentiality obligations;
• Customer and its auditor must sign xBoard’s standard non-disclosure agreement before any audit begins;
• Customer is responsible for its audit costs and xBoard’s reasonable costs of supporting the audit.

xBoard may require the parties to agree on the scope, timing, security controls, and confidentiality requirements before an audit begins.

17.3 Remediation

If an audit identifies a material failure to comply with this DPA, xBoard will take reasonable steps to remediate the failure.

Customer may take reasonable and appropriate steps to stop and remediate unauthorized Processing, including suspending the affected Processing or terminating the affected Services when necessary.

Back to contents

18. Government and Legal Requests

Unless prohibited by law, xBoard will notify Customer if it receives a legally binding request from a governmental authority seeking Customer Personal Data.

xBoard will:

• Review the request for legal validity;
• Take reasonable steps, where appropriate and legally permitted, to challenge or narrow requests that xBoard reasonably believes are unlawful or overbroad;
• Disclose only the Customer Personal Data legally required; and
• Direct the authority to Customer when appropriate.

Customer is responsible for responding to legal requests directed to Customer.

Back to contents

19. Restricted Data

Unless expressly authorized by xBoard in a signed written agreement, Customer will not use the Services to store or Process:

• Protected health information regulated by HIPAA;
• Personal Data collected online from children under 13 in a manner subject to COPPA;
• Education records subject to FERPA;
• Nonpublic personal information subject to GLBA;
• Full payment-card numbers, card verification codes, or magnetic-stripe data;
• Government-issued identification numbers, including Social Security, driver’s-license, state-identification, passport, or personal tax-identification numbers;
• Account passwords or authentication secrets belonging to third-party services;
• Biometric identifiers used for identification;
• Highly sensitive financial-account credentials;
• Information subject to export-control restrictions; or
• Other data requiring security or regulatory controls that the Services are not expressly designed to provide.

xBoard’s acceptance or technical storage of restricted data does not constitute authorization to use the Services for that data.

Back to contents

20. Limitation of Liability

Each party’s liability arising from this DPA is subject to the exclusions, limitations, and disclaimers contained in the Agreement.

Nothing in this DPA limits rights or obligations that cannot legally be limited under applicable law.

Back to contents

21. Order of Precedence

If there is a conflict concerning the Processing of Customer Personal Data, the following order applies:

1. A signed order form or written amendment expressly modifying this DPA;
2. This DPA;
3. The Agreement; and
4. Other incorporated policies or documentation.

The remainder of the Agreement remains unchanged.

Back to contents

22. Changes to This DPA

xBoard may update this DPA to:

• Reflect changes in the Services;
• Address changes in Applicable Privacy Law;
• Improve privacy or security protections;
• Clarify existing obligations; or
• Correct errors.

xBoard will provide reasonable notice of material changes to this DPA. xBoard will not materially reduce the contractual protections applicable to Customer Personal Data during Customer’s then-current subscription term unless required by Applicable Privacy Law or agreed to in writing by Customer. Changes required by law may take effect when legally required.

Back to contents

23. Notices

Notices concerning this DPA may be delivered according to the notice provisions in the Agreement.

Privacy-related notices to xBoard should be sent to:

Back to contents

24. Entire Agreement

This DPA and the Agreement constitute the complete agreement between the parties regarding xBoard’s Processing of Customer Personal Data.

This DPA survives termination of the Agreement for as long as xBoard retains Customer Personal Data.

Back to contents