This Data Processing Addendum ("DPA") forms part of the Spaceboy User Agreement between Spaceboy, Inc. ("Spaceboy") and the customer organization that accepts it ("Customer"), and applies where Spaceboy processes personal data on Customer's behalf in providing the Service.
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person that Spaceboy processes on Customer's behalf as part of Customer Data. "Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws. "Subprocessor" means a third party engaged by Spaceboy to process Personal Data on Customer's behalf. Terms such as "controller," "processor," "processing," and "data subject" have the meanings given in Data Protection Laws.
2. Roles and Scope
2.1 Customer is the controller (or a processor acting for another controller) of Personal Data contained in Customer Data; Spaceboy is a processor.
2.2 Spaceboy processes Personal Data only on Customer's documented instructions, including the instructions embodied in Customer's use and configuration of the Service, unless required otherwise by law. Spaceboy will inform Customer if it believes an instruction infringes Data Protection Laws.
2.3 The subject matter, duration, nature, and purpose of processing, and the categories of data subjects and Personal Data, are described by the Service itself: source code, repository metadata, prompts and chat messages, configuration, logs, and end-user data of applications Customer deploys, processed for as long as Customer maintains an account.
3. Confidentiality and Personnel
Spaceboy ensures that persons authorized to process Personal Data are bound by appropriate confidentiality obligations and receive appropriate training on data protection.
4. Security
Spaceboy implements and maintains appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described on the Spaceboy Trust & Security page. Spaceboy may update those measures provided the updates do not materially reduce the overall level of protection.
5. Subprocessors
5.1 Customer generally authorizes Spaceboy to engage Subprocessors. The current list is published on the Spaceboy Trust & Security page.
5.2 Spaceboy will update the published list before adding or replacing a Subprocessor. If Customer reasonably objects to a change on data-protection grounds and the parties cannot resolve the objection, Customer may terminate the affected services and receive a pro-rata refund of prepaid fees.
5.3 Spaceboy imposes data-protection obligations on Subprocessors that are no less protective than those in this DPA and remains liable for their performance.
6. Data Subject Requests
Taking into account the nature of the processing, Spaceboy will assist Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from data subjects exercising their rights. If a data subject contacts Spaceboy directly regarding Customer's data, Spaceboy will promptly redirect the request to Customer.
7. Personal Data Breach
Spaceboy will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Data, and will provide information reasonably available to Spaceboy to help Customer meet its own notification obligations.
8. Assistance
Spaceboy will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to Spaceboy.
9. International Transfers
Where Spaceboy transfers Personal Data originating from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Module 2: controller to processor, and Module 3: processor to processor, as applicable), completed by the descriptions in Section 2.3 and the security measures referenced in Section 4. For UK transfers, the UK International Data Transfer Addendum applies.
10. Return and Deletion
Upon termination of the Service, Spaceboy will delete Personal Data in accordance with the retention terms of the User Agreement and Privacy Policy, unless retention is required by law. Customer may export Customer Data before termination using the Service's export features.
11. Audits
Spaceboy will make available information reasonably necessary to demonstrate compliance with this DPA, including the documentation on the Trust & Security page. Where Data Protection Laws grant Customer an audit right that cannot be satisfied by that documentation, Spaceboy will respond to reasonable written audit requests no more than once annually.
12. Order of Precedence and Term
This DPA is incorporated into and subject to the User Agreement. In case of conflict regarding the processing of Personal Data, this DPA prevails. This DPA is effective from the date Customer accepts it in the dashboard and remains in force for as long as Spaceboy processes Personal Data on Customer's behalf.
13. Contact
Spaceboy, Inc.
272 Citrus Drive, Summerville SC 29486
Email: legal@spaceboy.ai
Privacy: privacy@spaceboy.ai