Data Processing Agreement

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given to them in the GDPR. "Customer Personal Data" means personal data that Komissio processes on behalf of the Customer when it provides the Service.

Komissio processes Customer Personal Data to provide the affiliate tracking Service described in the Terms of Service. This DPA applies for as long as Komissio processes Customer Personal Data for the Customer, which is normally the life of the Customer's account plus the deletion period in section 11.

Komissio collects, stores, organizes, analyzes, transmits and deletes Customer Personal Data in order to:

• register and manage the Customer's affiliates and team members
• track clicks, referrals, promo code use and conversions and credit them to affiliates
• calculate, approve and report commissions
• send payout instructions through Stripe Connect or produce payout exports
• send emails that the Service generates for the Customer, such as invitations and payout notices
• provide support, security, fraud detection and backups

Komissio processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's settings and use of the Service are the Customer's complete instructions. Komissio will tell the Customer if it believes an instruction breaks data protection law. If the law requires Komissio to process the data in another way, Komissio will inform the Customer first, unless the law forbids this.

The Customer is responsible for having a lawful basis for the processing, for giving data subjects the required information, and for obtaining consent for tracking cookies on its own sites where the law requires it.

Komissio will:

• make sure that everyone authorized to process Customer Personal Data is bound by confidentiality
• protect Customer Personal Data with the measures in section 7
• not sell Customer Personal Data or use it for its own purposes, except to produce anonymous, aggregated statistics that identify neither the Customer nor any person
• keep a record of processing activities as required by Article 30(2) GDPR
• cooperate with supervisory authorities when they ask

Komissio maintains technical and organizational measures appropriate to the risk, including:

• encryption of data in transit with HTTPS (TLS)
• hashed passwords and API keys
• role-based access control, with access limited to staff who need it
• separation of each Customer's data within the application
• regular backups and the ability to restore data
• logging and monitoring of production systems
• keeping software and dependencies up to date

Komissio may update these measures as long as the overall level of protection does not decrease. More detail is on our Security page.

The Customer gives Komissio general authorization to use subprocessors. The current list is on our Subprocessors page.

Komissio will inform the Customer of any new or replacement subprocessor at least 30 days before it starts processing Customer Personal Data, by updating that page and notifying the Customer by email or in the app. The Customer may object on reasonable data protection grounds within that period. If Komissio cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of fees prepaid for the period after it ends.

Komissio requires each subprocessor, by written contract, to meet data protection obligations that are at least as protective as this DPA, and remains responsible to the Customer for its subprocessors.

Taking into account the nature of the processing and the information available to it, Komissio will help the Customer:

• answer requests from data subjects, mainly through features of the Service that let the Customer view, export, correct and delete data. If Komissio receives a request directly, it will forward it to the Customer without undue delay and will not answer it unless the Customer instructs it to.
• meet its obligations on security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR

Komissio may charge reasonable costs for assistance that goes beyond what the Service normally provides.

Komissio will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as is known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Komissio will share further information as it becomes available and will take reasonable steps to contain the breach.

Notifying a breach is not an admission of fault or liability.

While the account is active, the Customer can export its data through the Service. When the Customer's account ends, Komissio will return Customer Personal Data in a common format, such as CSV, if the Customer asks within 30 days, and will delete it within 90 days after the account ends, unless EU or member state law requires Komissio to keep it. Copies in backups are deleted when those backups expire in the normal backup cycle.

Komissio will make available to the Customer the information needed to demonstrate compliance with Article 28 GDPR, mainly through this DPA, our security documentation and written answers to reasonable security questionnaires.

If that information is not enough, or a supervisory authority requires it, the Customer may carry out an audit at its own cost, with at least 30 days' notice, during normal business hours, no more than once a year and under a duty of confidentiality. For subprocessors, audits rely on their own certifications and audit reports.

Komissio is established in the EU. Some subprocessors are located in, or access data from, countries outside the European Economic Area. Where such a transfer takes place, Komissio makes sure it is covered by an adequacy decision of the European Commission, by the EU-US Data Privacy Framework where the recipient is certified under it, or by the Standard Contractual Clauses adopted by the European Commission, together with any additional measures needed.

If the Customer is located outside the EEA, transfers of Customer Personal Data from Komissio to the Customer take place under module four of the Standard Contractual Clauses where they are required.

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the GDPR does not allow such limits. If this DPA and the Terms of Service conflict on data protection, this DPA applies. This DPA is governed by the same law as the Terms of Service, which is Estonian law.