Data processing agreement

1. Parties, roles and scope

“Customer” is the organization that accepted the Terms of Service. “xMap” is xMap Ltd. “Service” is xMap Flows. “Data Protection Law” means the laws on privacy and personal data that apply to the processing under this agreement, such as the EU and UK GDPR, the Swiss Federal Act on Data Protection, the Saudi Personal Data Protection Law, the personal data laws of the United Arab Emirates, and the California Consumer Privacy Act.

For personal data that the Customer puts into or collects through its flows (“Customer Personal Data”), the Customer is the controller, or a processor acting for its own customers, and xMap is its processor. For account, billing and security data, and for the business information in xMap data, xMap is a controller, as described in the Privacy Policy; this agreement does not cover that data.

2. What is processed

3. The Customer’s responsibilities

The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions: for having a legal basis, giving the notices and obtaining the consents that Data Protection Law requires, and for choosing which data to put into the Service and whom its flows contact. The Customer will not instruct xMap to process personal data in a way that breaks the law.

4. Instructions

xMap processes Customer Personal Data only on the Customer’s documented instructions: the Terms of Service, this agreement, and what the Customer configures in the Service. xMap will tell the Customer if it believes an instruction breaks Data Protection Law, and may pause that processing until the question is settled. xMap will not process Customer Personal Data for its own purposes, sell it, or use it to train AI models. Unless the Customer switches it off (Settings, Help improve Ask xMap), xMap may use flows that Ask xMap built for the Customer, once every personal and identifying detail is removed (names, email addresses, phone numbers, web addresses, accounts, tables, queries and code), as worked examples and tests for Ask xMap; what remains is no longer Customer Personal Data. If the law requires xMap to process Customer Personal Data in another way, xMap will tell the Customer first, unless the law forbids it.

5. Confidentiality

xMap limits access to Customer Personal Data to people who need it to provide or support the Service and who are bound by a duty of confidentiality. Access by xMap administrators to a Customer’s organization is recorded and shown on that organization’s Activity page.

6. Security

xMap keeps the technical and organisational measures listed in Annex 2 and described on the Security page, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. xMap may change these measures as technology develops, and will not materially reduce the protection they give. The Customer is responsible for using the controls the Service gives it, such as roles, sharing settings and two-step sign-in.

7. Sub-processors

The Customer gives xMap a general authorisation to use sub-processors. The current ones are listed in the Privacy Policy. xMap has written terms with each one that processes Customer Personal Data, protecting it to at least the standard of this agreement, and remains responsible for their work. Providers that receive only a search (a place name, a position or an area) and no Customer Personal Data are listed there for transparency.

xMap will add a new sub-processor to that list at least 30 days before it starts to process Customer Personal Data, and will email notice of the change to any Customer that has asked for it at legal@xmap.ai. Where a replacement is urgently needed to keep the Service secure or running, xMap will give notice as early as it can. The Customer may object on reasonable data protection grounds within 30 days of the notice. If the objection cannot be resolved, the Customer may end the affected part of the Service and receive a refund of prepaid, unused fees for it.

8. International transfers

xMap and its sub-processors process data in the United States and in the other countries named in the Privacy Policy. xMap’s own data services run on Google Cloud and on Amazon Web Services (in Japan), as the Privacy Policy says. Where Data Protection Law requires a mechanism for the transfer of Customer Personal Data to xMap, the following apply and are incorporated into this agreement by reference:

• European Economic Area and Switzerland. The Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914 (the “Clauses”). Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where it is a processor. In the Clauses: the optional docking clause (Clause 7) applies; under Clause 9, Option 2 (general written authorisation) applies with the notice period in section 7 of this agreement; the optional wording in Clause 11 does not apply; the Clauses are governed by the law of Ireland (Clause 17) and disputes are resolved by the courts of Ireland (Clause 18); Annex I is completed with sections 1 and 2 and Annex 1 of this agreement, Annex II with Annex 2, and Annex III with the list of sub-processors. The competent supervisory authority is the one responsible for the Customer. For transfers from Switzerland, references to the GDPR mean the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the supervisory authority.
• United Kingdom. The International Data Transfer Addendum to the Clauses issued by the UK Information Commissioner (version B1.0). Its tables are completed with the information in this agreement, and either party may end the Addendum as its Table 4 allows.
• Saudi Arabia and other countries. The standard contractual clauses or other transfer mechanism that the law of that country requires, such as those issued under the Saudi Personal Data Protection Law. xMap will sign them on request.

If these mechanisms conflict with the rest of this agreement, they prevail. xMap will sign any of them separately on request.

Requests from authorities. If a public authority asks xMap for Customer Personal Data, xMap will direct it to the Customer where it lawfully can, tell the Customer unless the law forbids it, challenge a request it believes to be unlawful, and disclose only what the law requires.

9. Helping the Customer

Taking into account the nature of the processing, xMap will help the Customer, at the Customer’s reasonable request, to answer requests from people exercising their rights, and to carry out data protection impact assessments and consultations with regulators. The Service lets the Customer export, correct and delete its data itself. If xMap receives a request from a person about Customer Personal Data, it will pass it to the Customer without answering it, unless the law requires otherwise.

10. Incidents, return and deletion

Incidents. xMap will notify the Customer without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will go to the organization’s admins by email with the information the Customer reasonably needs to meet its own obligations: what happened, the data and people likely to be affected, and what xMap has done and proposes to do. xMap will take reasonable steps to contain and remedy the breach, and will keep the Customer informed. A notice is not an admission of fault.

Return and deletion. The Customer can export its data at any time. When the Customer’s account or organization is closed, xMap deletes Customer Personal Data within 90 days, except backups, which expire on their normal schedule, and data the law requires xMap to keep. xMap will confirm the deletion in writing on request.

11. Audits

xMap will make available the information reasonably needed to show that it meets this agreement, including summaries of independent reviews of the Service once xMap has them (none has been made yet). Where that is not enough, or a regulator requires it, the Customer may audit xMap’s compliance with this agreement once a year, with 30 days’ notice, at its own cost, during business hours, under a duty of confidentiality, and without access to other customers’ data or to anything that would weaken the security of the Service.

12. California

Where the California Consumer Privacy Act applies, xMap is the Customer’s service provider. xMap will not sell or share Customer Personal Data; will not keep, use or disclose it for any purpose other than providing the Service to the Customer, or outside the direct business relationship between them; and will not combine it with personal data from other sources, except as that Act allows a service provider to do. xMap will tell the Customer if it can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remedy any unauthorised use.

13. General

This agreement lasts as long as xMap processes Customer Personal Data. If this agreement and the Terms of Service conflict about the processing of Customer Personal Data, this agreement prevails. Liability under this agreement is subject to the limits in the Terms of Service, except where the Clauses or Data Protection Law do not allow that. The law and courts named in the Terms of Service apply, unless the Clauses or the UK Addendum require otherwise. Contact: legal@xmap.ai.

Annex 1: the parties and the processing

Annex 2: security measures

• Encryption. All traffic uses HTTPS. The database and its backups are encrypted at rest by the hosting providers. The sign-in details of connected accounts are encrypted again inside the database (AES-256-GCM), are never shown after they are saved, and are never sent to the browser.
• Accounts. Passwords are stored only as salted one-way hashes. Sessions are random tokens in a secure, HttpOnly cookie. Two-step sign-in is available to everyone, can be required by an organization for all its members, and is required for xMap’s own administrators. Repeated wrong passwords or codes are slowed down and then refused.
• Access control. Roles (admin, member, viewer), sharing settings for each flow, and results, maps and runs that follow those settings. Personal connections can be used only by their owner. Access ends when a person leaves an organization.
• xMap’s own access. Limited to people who need it, bound by confidentiality, and recorded. The Customer’s Activity page shows when xMap support opened its organization.
• Application security. Content typed by people is shown as text under a strict Content Security Policy. Calls made for a customer reach only public internet addresses. Requests are rate limited. Credits and payments are processed in single, repeat-safe operations.
• Releases and monitoring. Every change runs the full automatic test suite before release. The live Service is checked after every release and every few minutes, and xMap is alerted when a part of it fails. Third-party packages are pinned and checked for known weaknesses every week.
• Keeping and deleting. Data is kept for the periods in the Privacy Policy and deleted on a schedule. The Customer can export and delete its own data.
• Incidents. Breaches are handled and notified as section 10 describes.

Annex 3: sub-processors

The sub-processors, what each one does and what it receives are listed in the table under Who we share it with in the Privacy Policy, which forms part of this Annex.