Data processing agreement

1. Parties and scope

This agreement is between the business that holds a Backlabel account (the controller, “you”) and Blok Consulting (the processor, “we”). It’s part of the terms of service and covers the personal data we process for you in Backlabel, as article 28 of the General Data Protection Regulation (GDPR) requires. Words such as personal data, processing and personal data breach mean what they mean in the GDPR. Where this agreement and the terms differ about personal data, this agreement applies.

2. The processing

Annex 1 describes the processing: its subject and purpose, its duration, the people concerned and the kinds of data. You’re responsible for having a legal ground for it and for informing the people concerned.

3. Your instructions

• We process the data only on your documented instructions, also for transfers outside the European Economic Area. These terms, this agreement and what you do in Backlabel are those instructions; you can give further ones in writing.
• If EU or Belgian law obliges us to process the data otherwise, we tell you first, unless that law forbids it.
• If we think an instruction breaks data protection law, we tell you.

4. Confidentiality and security

• Everyone at Blok Consulting with access to the data is bound to confidentiality.
• We protect the data with the measures in annex 2, and keep them up to date with the state of the art.

5. Subprocessors

• You allow us to use the subprocessors in annex 3.
• We tell the account’s owners by email at least 30 days before we add or replace one. If you object on reasonable grounds within that time and we can’t meet them, you can end the terms before the change applies.
• Each subprocessor is bound by a written contract to the same data protection obligations as we are. We remain fully liable to you for how they perform them.

6. Requests from the people concerned

Most requests can be handled in Backlabel itself: correcting details, removing members, deleting a user, exporting the account. Where they can’t, we help you answer. If someone sends such a request to us, we pass it on to you without answering it ourselves, unless you ask us to.

7. Personal data breaches

We tell the account’s owners about a personal data breach that affects your data without undue delay, and at most 48 hours after we become aware of it. We say what happened, which data and people are concerned, the likely consequences, and what we do about it, and add to that as we learn more. We document every breach.

8. Help with your obligations

Taking into account what we know, we help you with security, with notifying breaches, with data protection impact assessments and prior consultations, and with questions from supervisory authorities, where reasonable.

9. Requests from authorities

If an authority asks us for your data, we tell you first unless the law forbids it, ask the authority to turn to you, challenge a request we consider unlawful, and disclose no more than we must.

10. Where the data is, and transfers

• Your database and files are stored in Cloudflare’s EU jurisdiction. The service runs on Cloudflare’s worldwide network, so data is processed close to whoever uses it, and published pages are copied across that network so they open quickly everywhere.
• Where a subprocessor processes data outside the European Economic Area, it’s covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses (annex 3).
• Against access by authorities outside the EU that would conflict with EU law, we rely on section 9, on the encryption and access controls in annex 2, and on our subprocessors’ contractual commitments to challenge such requests.

11. Audits

We give you the information needed to show that we keep this agreement, including our subprocessors’ audit reports and certifications where they share them. If that isn’t enough, you or an independent auditor bound to confidentiality may check it once a year, at your cost and with 30 days’ notice, without access to other customers’ data. We also keep a record of our processing for you.

12. At the end

• You can export the account’s data at any time (terms, section 7).
• While your published pages stay online after the terms end (terms, section 6), we keep processing what’s needed for them under this agreement.
• When the account is deleted (terms, section 6), we delete your personal data, in our database, files, public copies and backup copy. Database backups that still contain it expire within 30 days and technical logs within 7 days; a cached public page can remain until its cache expires. We keep only a record that the account was deleted, when and at whose request, and what the law obliges us to keep.

13. Liability and duration

The liability limits of the terms of service apply between us; they don’t limit the rights of the people concerned under the GDPR. This agreement applies as long as we process personal data for you.

Annex 1: the processing

• Subject and purpose: providing Backlabel under the terms: managing your team’s access, storing your products, versions, lots, recalls and to-dos, publishing your public pages and their backup copy, making labels and sheets, sending emails for your account (invitations, reminders, requests to check), and exporting and importing your data.
• Nature: storing, organising, publishing, sending, exporting and deleting.
• Duration: as long as the account exists, and for published pages as long as section 6 of the terms keeps them online.
• People concerned: your staff and others you give access or invite, people to whom you assign to-dos, and anyone named in what you publish or upload, such as producers, bottlers, importers or contacts in a recall.
• Data: names, email addresses, roles, the account’s log of who did what, to-dos and their assignees, trade names and addresses, and any personal data in your content and in files you import. Don’t put special categories of personal data in Backlabel; none are expected.
• Kept: the account’s log and imported files stay with the account; export downloads expire after 7 days; everything goes when the account is deleted (section 12).

Annex 2: security measures

• Database and files stored in the EU, encrypted in transit and at rest.
• No passwords: sign-in with codes by email, passkeys, or Google and Microsoft accounts.
• Sessions are checked on every request, so signing a device out or removing a member applies at once.
• Every request is limited to the active account; roles per account, and only owners and admins manage the team, billing and exports.
• Support access only on request, for at most an hour, shown in the account’s log; while signed in as a customer, support can’t delete the user, change its email, passkeys or links, or leave an account.
• An account log of what people do, which is never edited, and a security log of sign-ins and sign-in changes per person.
• Rate limits and bot protection on sign-in.
• Access to production limited to the people at Blok Consulting who need it, with two-factor authentication on the accounts at our providers.
• Point-in-time recovery of the database for 30 days, a nightly check that the public pages match the database, and a nightly copy of all public pages at a second provider.

Annex 3: subprocessors

Not subprocessors, because they act as independent controllers: Stripe, which sells paid plans as merchant of record, and Google and Microsoft, which receive data only for users who choose to sign in with them.