Data processing agreement

This data processing agreement (“DPA”) forms part of the terms of service between you, the developer with a TellsU account (“you”, the controller), and Zilobyte Ltd, a company registered in England and Wales (company number 17576520), trading as TellsU (“TellsU”, “we”, the processor). It applies automatically when you use TellsU; there’s nothing to sign. It meets Article 28 of the UK GDPR and the EU GDPR (together, “data protection law”).

Where this DPA and the terms disagree about personal data, this DPA wins.

1. What we process, and why

Item	Details
Subject matter	Personal data your users send through TellsU feedback pages, and personal data you put into TellsU about others
Duration	While you have an account, and until deletion under section 9
Nature	Collecting, storing, displaying, forwarding, exporting and deleting
Purpose	Providing the service to you, as the terms describe
Data subjects	People who send feedback about your apps; people whose email addresses you add as forwarding destinations
Personal data	Feedback messages and answers to your custom questions; email addresses submitters choose to give; environment details (app version, browser and operating system, host and runtime with versions, release channel, edition, WordPress theme and multisite, screen name, extra values you allow); forwarding email addresses. IP addresses are used briefly for spam protection and rate limits, and not stored with feedback
Special category data	None. The terms forbid asking for it

2. Your instructions

We process personal data only on your documented instructions. Your instructions are these terms and the way you set up and use the service: your apps’ settings, forwarding destinations, retention periods, exports and deletions. If the law requires us to process personal data in some other way, we’ll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we’ll tell you.

Destinations you choose for forwarding (email addresses, Slack, Discord, webhooks) receive data on your instructions; they’re your recipients, not our sub-processors.

3. Your responsibilities

You’re responsible for having a lawful basis for collecting your users’ feedback, for telling them about it (including that TellsU processes it for you), and for the instructions you give us.

4. Confidentiality

Only people who need access to provide the service can reach personal data, and they’re bound to keep it confidential. Today that’s one person, Zilobyte Ltd’s director.

5. Security

We keep appropriate technical and organizational measures to protect personal data, including:

• encryption in transit (TLS) for every connection to the service, and encryption at rest of the database and its backups [to confirm with the hosting provider];
• access to production systems limited to authorized people, with multi-factor authentication;
• every value submitters send capped in length and escaped wherever it’s shown, and values that look like email addresses or long codes masked in links;
• separation of each account’s data, with every request checked against the account it belongs to;
• regular backups, and automatic deletion of feedback after its retention period;
• signed webhook deliveries, and refusal of webhook addresses that point at internal or private networks.

We may improve these measures, but won’t reduce the overall level of protection.

6. Sub-processors

You authorize us to use the sub-processors listed in our privacy notice. We’ll tell you by email at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, tell us within that time; if we can’t resolve it, you can end your subscription and we’ll refund the unused part of any period you’ve paid for.

We put data protection terms in place with each sub-processor that protect personal data at least as well as this DPA, and we remain responsible to you for their work.

7. International transfers

Where personal data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, the transfer is covered by the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.

8. Helping you

• Requests from your users. You can find, export and delete feedback yourself in the dashboard. If one of your users contacts us directly, we’ll pass the request to you without answering it ourselves, and help you respond where we reasonably can.
• Personal data breaches. We’ll tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your users’ personal data, with what we know and what we’re doing about it, and keep you updated.
• Assessments. We’ll give you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities about the service.

9. Deletion

Feedback is deleted automatically at the end of each app’s retention period (12 months at most). You can export and delete your data at any time, and when you delete an app or your account, its personal data is deleted straight away. Copies in our backups are overwritten within [backup retention period]. We don’t keep personal data after that unless the law requires it.

10. Audits

We’ll give you the information you reasonably need to show that we meet this DPA. If that isn’t enough, or a supervisory authority requires it, you may audit our compliance, at your own cost, at most once a year, with 30 days’ notice and under a duty of confidentiality, in a way that doesn’t risk other customers’ data.

11. Liability

Each party’s liability under this DPA is subject to the limits in the terms, except where data protection law doesn’t allow it to be limited.

Contact

Email privacy@tellsu.com, or write to Zilobyte Ltd (TellsU), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.