English
Sign in

Legal

Data processing agreement

Last updated:

This agreement is between the organization that uses Fumi (the “controller”) and Binary Code LLC, Dr Jovana Erdeljanovića 10, Pančevo, Serbia (in Serbian: Binary Code DOO; company registration number 22184997, tax ID 115626224) (the “processor”, “we”, “us”). It governs the personal data we process on the organization’s behalf, in line with Article 45 of the Serbian Law on Personal Data Protection and, where it applies, Article 28 of the EU General Data Protection Regulation (GDPR).

This agreement forms part of our Terms of service. When an organization accepts the terms of service, it also accepts this agreement; no separate signature is needed.

1. Subject matter and duration

This agreement covers the processing of personal data needed to provide Fumi to the organization. It applies for as long as the organization uses the service, and afterwards until we have deleted its data (section 10).

2. Nature and purpose

We store, organize, display and transfer data to the users the organization has given access, scan files for viruses, send e-mail from the app, and delete data — only to provide the service, never for our own purposes.

3. Types of data and data subjects

  • Data subjects: the organization’s users (employees, associates and anyone else it invites) and people whose data appears in the documents the organization stores.
  • User data: name, e-mail address, language, role, group memberships and sign-in data.
  • Content: the data in files and in their names, paths and tags. The organization decides what the content includes, including any special categories of personal data, and must have a legal basis for processing them.

4. The controller’s instructions

We process data only on the organization’s documented instructions. These are the terms of service, this agreement, and the way the organization configures and uses the service (users, access policies, settings). If we believe an instruction is unlawful, we will tell the organization.

The organization is responsible for the lawfulness of the processing: for having a legal basis for the data it keeps in Fumi, and for informing the people the data is about.

5. Confidentiality

Only people who are bound by confidentiality and need access to provide the service can access the data. We do not access the content of files, except when needed to fix a problem the organization reports to us or when the law requires it.

6. Security measures

We apply technical and organizational measures appropriate to the risk, in particular:

  • all connections are encrypted (HTTPS);
  • passwords are stored only as hashes (scrypt), and keys and secrets are encrypted (AES-256-GCM);
  • access tokens are valid for 15 minutes, and the refresh token changes every time it is used;
  • each organization has separate file storage, and download links are short-lived;
  • access rights (roles and policies) are checked on every request;
  • files are scanned for viruses before they can be downloaded, unless the organization turns this off;
  • servers and storage are located in a data centre in the European Union.

We may change these measures, but not in a way that lowers the level of protection.

7. Sub-processors

The organization gives us general authorization to engage sub-processors. They currently are:

  • UpCloud Ltd (Finland) — servers, database and file storage, in a data centre in Frankfurt, Germany;
  • Fastmail Pty Ltd (Australia) — sending e-mail from the app: invitations, password resets and infected-file notices.

Our contracts with sub-processors bind them to protect data at least as well as this agreement does, and we remain responsible for them. We will notify the organization’s owner of a new sub-processor at least 30 days in advance. If the organization has a reasonable objection and we cannot find a solution, it may terminate before the change takes effect.

Google and Microsoft are not sub-processors: signing in with them is the user’s choice, and they then act as independent controllers.

8. Transfers outside the EU

Data is stored in the European Union. Where a sub-processor processes it in a country without an adequate level of protection — for example when sending e-mail — the transfer relies on standard contractual clauses or other safeguards required by law.

9. Assisting the controller

  • Data subject requests: administrators can view, correct, download and delete data in the app. If we receive a request directly, we will pass it on to the organization and help it respond.
  • Personal data breaches: we will notify the organization of a breach affecting its data without undue delay, and no later than 48 hours after becoming aware of it, with what we know at that point about its nature, likely consequences and the measures taken.
  • Impact assessments and prior consultation: we will provide the information we have if the organization needs it for a data protection impact assessment or for consulting the supervisory authority.

10. Deletion and return of data

The organization can download its files at any time. When it stops using the service, it has a transition period to export them, after which we delete its data, except what we must keep by law.

11. Information and audits

On request, we will provide the information needed to show that we comply with this agreement. If that is not enough, the organization, or an auditor it appoints who is bound by confidentiality, may carry out an audit with at least 30 days’ notice, at most once a year (except after a breach) and at the organization’s expense. Send requests to contact@binnry.com.

12. Liability and precedence

The limitations of liability in the terms of service apply, to the extent permitted by law. On matters of personal data protection, this agreement takes precedence over the terms of service. This agreement is governed by the law of the Republic of Serbia.

If the organization needs a signed copy of this agreement, write to us at contact@binnry.com.