Saber Feedback's Data Processing Agreement

This document lays out the responsibilities of Barbary Software SL (Spain company number B65915647), hereafter referred to as Saber Feedback, to its customers with regards to data protection in general and the European Union’s General Data Protection Regulation (GDPR) specifically.

1. Saber Feedback as Data Processor, Definitions

2. Processing of Personal Data

  1. Use of the service implies that Saber Feedback may process personal data on behalf of the Data Controller in accordance with the requirements of Data Protection Laws. The Data Controller will ensure that instructions to their users for the processing of personal data comply with Data Protection Laws. The Data Controller has sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which it acquires personal data.
  2. The data supplied to the Saber Feedback Service by the Data Controller’s users are stored only to the degree necessary for the purpose of providing the core functionality of the Saber Feedback service.
  3. The data supplied to the Saber Feedback Service is stored in a centralised database. Data may also be stored on other services where required to adequately perform the service’s functionality.
  4. Saber Feedback lays out a full and accurate description of its data protection practices on its website at /gdpr/. This description is updated from time to time as and when practices change.

3. Rights of Data Subjects

  1. Saber Feedback ensures that the necessary consent is collected from Data Subjects to allow Saber Feedback to process personal data on behalf of the Data Controller.
  2. Saber Feedback will, to the extent legally permitted, promptly notify the Data Controller if it receives a request from a Data Subject for access to, or deletion of, that person’s personal data. Saber Feedback will not respond to a Data Subject request without the Data Controller’s prior written consent except to confirm that the request relates to the Data Controller. The Data Controller is solely responsible for completing such request as required by law.

4. Personnel

  1. Saber Feedback ensures that its personnel engaged in the processing of personal data are informed of the confidential nature of the personal data, have received appropriate training on their responsibilities and have agreed to confidentiality obligations that survive the termination of that persons’ employment or engagement by Saber Feedback.
  2. Saber Feedback shall take commercially reasonable steps to ensure the reliability of any Saber Feedback personnel engaged in the processing of personal data and that access to personal data by Saber Feedback is limited to those Saber Feedback personnel who require such access to perform the Services.
  3. We believe that, according to the GDPR, Saber Feedback does not require a data protection officer. However, you can contact us by email with data protection enquiries at [email protected].

5. Sub-Processors

  1. The Data Controller agrees Saber Feedback may engage third-party Sub-processors to provide the Services and such Sub-processors may access personal data, and appoint additional levels of Sub-processors, only for purposes of providing the services Saber Feedback retained them to provide and not for any other purpose.
  2. Saber Feedback agrees to be liable for the acts and omissions of its Sub-processors to the same extent Saber Feedback would be liable if performing the services of each Sub-processor directly under the terms of this agreement.

6. Security

  1. Saber Feedback agrees to implement and maintain the administrative, technical, and physical safeguards of personal data stored using the Services.

7. Security Breach Management and Notification

  1. If Saber Feedback becomes aware of unlawful access to the Data Controller’s personal data stored through the Services, or unauthorized access to the Services resulting in loss, disclosure, or alteration of the Data Controller’s personal data (“Security Breach”), Saber Feedback will promptly: (a) notify the Data Controller of the Security Breach; (b) investigate the Security Breach and provide the Data Controller with information known to Saber Feedback about the Security Breach; and (c) follow its policies and procedures to mitigate the effects and to minimize any damage resulting from the Security Breach.
  2. The Data Controller agrees that an unsuccessful Security Breach attempt will not be subject to Section 7.1 above. An unsuccessful Security Breach attempt is one that results in no unauthorized access to the Data Controller’s personal data or to the Services storing the Customer’s Personal Data, and may include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond IP addresses or headers) or similar incidents.
  3. Notification(s) of Security Breaches, if any, will be delivered to one or more of the Customer’s business, technical or administrative contacts by any means Saber Feedback selects, including via email. It is the Customer’s sole responsibility to ensure it maintains accurate contact information on Saber Feedback’s support systems at all times.
  4. Saber Feedback’s report of and/or response to a Security Breach under this Section will not be construed as an admission by Saber Feedback to fault or liability with respect to the Security Breach.

8. Deletion of Customer Data

  1. Saber Feedback agrees to delete Customer personal data in accordance with Saber Feedback’s procedures and Data Protection Laws.
  2. At a Customer’s request, Saber Feedback will provide the Customer with a certification of deletion of personal data.
  1. This agreement comes into effect from the 1st of April 2020 for all existing customers, or from the time of purchase of a Saber Feedback subscription. It expires with cessation of the Customer’s Saber Feedback subscription.