Data Processing Agreement
This Data Processing Agreement ("DPA") applies to team and business customers when IMARA DIGITAL HOLDINGS LLC processes personal data on the customer's behalf in connection with MakeStoryboard.
1. Parties and Incorporation
This DPA forms part of the agreement governing the customer's use of the MakeStoryboard service (the "Agreement") between the customer identified in the Agreement ("Customer") and IMARA DIGITAL HOLDINGS LLC, a Florida limited liability company, 2850 University Square Dr, Tampa, FL 33612, United States ("Provider").
This DPA applies when Provider processes Customer Personal Data on behalf of Customer in connection with the Service. By entering into the Agreement or using the Service after the Effective Date, each party agrees to this DPA. If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA controls. The Standard Contractual Clauses control over conflicting commercial terms to the extent required by those clauses.
2. Definitions
| Term | Meaning |
|---|---|
| Applicable Data Protection Law | Privacy and data-protection laws applicable to the processing, including the GDPR, UK GDPR, Swiss Federal Act on Data Protection, and applicable U.S. state privacy laws. |
| Customer Personal Data | Personal data contained in Customer Content or otherwise processed by Provider on Customer's behalf under the Agreement. |
| Data Subject Request | A request by an individual to exercise a right under Applicable Data Protection Law. |
| GDPR | Regulation (EU) 2016/679. |
| Personal Data Breach | A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. |
| Processor | A person or entity that processes personal data on behalf of a controller, including a service provider or contractor under applicable U.S. law. |
| SCCs | The European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914, as amended or replaced. |
| Subprocessor | A third party engaged by Provider to process Customer Personal Data on Customer's behalf. |
Capitalized terms not defined in this DPA have the meanings given in the Agreement or Applicable Data Protection Law.
3. Roles and Scope
Customer is the controller or processor, as applicable, of Customer Personal Data. Provider is the processor or subprocessor, as applicable. Each party is responsible for complying with the obligations applicable to its role.
Provider acts as an independent controller for account administration, billing, fraud prevention, service security, legal compliance, and business communications to the extent Provider determines the purposes and means of that processing. That independent-controller processing is governed by the MakeStoryboard Privacy Policy, not this DPA.
The subject matter, duration, nature, purpose, categories of data, and categories of data subjects are described in Annex A.
4. Customer Instructions and Responsibilities
Provider will process Customer Personal Data only on documented instructions from Customer, including instructions contained in the Agreement, Customer's use and configuration of the Service, and this DPA, unless processing is required by law. If law requires other processing, Provider will inform Customer before processing unless prohibited by law.
Provider will promptly inform Customer if, in Provider's opinion, an instruction infringes Applicable Data Protection Law. Provider may suspend the affected processing while the parties work in good faith to resolve the issue.
Customer represents that it has provided required notices, obtained required rights and permissions, identified a lawful basis, and issued lawful instructions for Provider's processing. Customer will not submit regulated health, financial-account, government-identity, biometric, special-category, or children's data unless the use is lawful, the Service is appropriate for the data, and any additional safeguards required by law or agreement are in place.
5. Confidentiality and Personnel
Provider will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations. Access will be limited to personnel who need it to provide, secure, support, or maintain the Service.
6. Security Measures
Provider will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures are described in Annex B. Provider may update those measures as the Service evolves, provided that the overall level of protection is not materially reduced.
7. Subprocessors
Customer gives Provider general written authorization to engage Subprocessors. Provider will maintain a current Subprocessor List and make it available to Customer on request at donovan@makestoryboard.com. Provider will impose data-protection obligations on each Subprocessor that are appropriate to the services performed and no less protective, in material respects, than the relevant obligations in this DPA. Provider remains responsible for each Subprocessor's performance to the extent required by law.
Provider will use commercially reasonable efforts to give Customer at least 15 days' advance notice before a new Subprocessor begins processing Customer Personal Data, unless an emergency or security need makes advance notice impracticable. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable solution. If no solution is available, Customer may terminate the affected Service before the new Subprocessor begins processing and, where applicable, receive a refund of prepaid fees for the unused terminated period.
8. International Transfers
Provider will not transfer Customer Personal Data from the EEA, United Kingdom, or Switzerland to a country that does not provide an adequate level of protection unless an approved transfer mechanism applies.
If Provider is certified and the relevant transfer is covered, the parties may rely on the EU-U.S. Data Privacy Framework, UK Extension, or Swiss-U.S. Data Privacy Framework. Otherwise, the SCCs are incorporated into this DPA as follows:
- Module Two applies when Customer is a controller and Provider is a processor.
- Module Three applies when Customer is a processor and Provider is a subprocessor.
- Clause 7 (docking) applies. For Clause 9, Option 2 applies with the notice period in Section 7. The optional language in Clause 11 does not apply.
- For Clause 17, the SCCs are governed by the laws of Ireland. For Clause 18, the parties submit to the courts of Ireland.
- For UK Restricted Transfers, the then-current UK International Data Transfer Addendum is incorporated using the information in this DPA and Annex C.
- For Swiss transfers, the SCCs apply with the adaptations required by Swiss law.
The competent supervisory authority is determined in accordance with Clause 13 of the SCCs and applicable law. Provider will reasonably cooperate with Customer in assessing the effectiveness of the applicable transfer mechanism and implementing appropriate supplementary measures.
9. Data Subject Requests
Taking into account the nature of processing, Provider will provide reasonable assistance through appropriate technical and organizational measures so Customer can respond to Data Subject Requests. If Provider receives a request relating to Customer Personal Data, Provider will notify Customer and will not respond except on Customer's documented instructions or as required by law. Provider may direct the requester to Customer.
10. Personal Data Breaches
Provider will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and will provide information reasonably available to Provider concerning the nature of the breach, affected data and individuals, likely consequences, and mitigation. Information may be provided in phases as it becomes available.
Provider will take reasonable steps to contain, investigate, and remediate the breach and will reasonably cooperate with Customer's legally required notifications. Provider's notice is not an admission of fault or liability. Customer is responsible for determining whether notification to individuals or authorities is legally required unless law assigns that duty to Provider.
11. DPIAs, Consultation, and Compliance Information
Provider will provide reasonable assistance with data-protection impact assessments and prior consultations required for Customer's use of the Service, taking into account the nature of processing and information available to Provider. Provider will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, legal, and privilege restrictions.
12. Audits
Customer may request information reasonably necessary to demonstrate Provider's compliance with this DPA. The parties will first use available security summaries, questionnaires, third-party reports, and remote review where those materials reasonably address the request. If an audit is legally required or the available materials are insufficient, Customer may conduct an audit no more than once per 12-month period, and additionally following a material Personal Data Breach or regulator request, on reasonable notice, during normal business hours, without unreasonable disruption, and subject to confidentiality and security requirements. Customer will bear its audit costs, and Provider may charge reasonable fees for assistance beyond ordinary compliance support unless the audit identifies a material breach by Provider.
13. Return and Deletion
Upon termination or expiration of the Agreement, Provider will, at Customer's choice and subject to Service functionality and applicable law, return or delete Customer Personal Data. Unless Customer requests an available export before termination, Provider may delete production data within 30 days after termination. Residual copies may remain in backups for up to 90 days and will be protected and unavailable for ordinary use until overwritten or deleted. Provider may retain data required by law solely for the required purpose and period.
14. U.S. Service-Provider Commitments
To the extent applicable U.S. privacy law treats Provider as a service provider, contractor, or processor, Provider will not sell Customer Personal Data or retain, use, or disclose it outside the direct business relationship except as permitted by law. Provider will not combine Customer Personal Data with personal data received from another person or collected through Provider's independent interactions except as legally permitted and reasonably necessary to provide, secure, support, or improve the Service.
Provider will notify Customer if it determines it can no longer meet an applicable obligation and will permit reasonable steps to stop and remediate unauthorized use.
15. Term, Liability, and General Terms
This DPA remains in effect while Provider processes Customer Personal Data. Liability under this DPA is subject to the exclusions and limitations in the Agreement, except to the extent prohibited by Applicable Data Protection Law or the SCCs. The governing law and dispute-resolution provisions of the Agreement apply, except where the SCCs or mandatory data-protection law require otherwise.
Annex A - Details of Processing
| Item | Description |
|---|---|
| Subject matter | Hosting, organizing, editing, sharing, commenting on, exporting, securing, backing up, supporting, and otherwise providing the MakeStoryboard Service. |
| Duration | For the term of the Agreement plus the deletion and backup periods described in Section 13. |
| Nature of processing | Collection, recording, organization, storage, alteration, retrieval, consultation, transmission, display, sharing at Customer's direction, restriction, backup, deletion, and support access. |
| Purposes | Provide and secure the Service, enable customer-selected collaboration and sharing, troubleshoot, support users, prevent abuse, and comply with documented instructions. |
| Data subjects | Customer personnel, contractors, clients, collaborators, invitees, storyboard subjects, and other individuals whose data Customer includes in Customer Content. |
| Personal data | Names, business contact data, account identifiers, role and team information, images, voice or audiovisual material, comments, project information, user-generated text, IP addresses, and other content submitted by Customer. |
| Special-category data | Not intentionally required. Customer must not submit special-category or sensitive data unless lawful and appropriate safeguards have been agreed. |
| Frequency | Continuous or as initiated by Customer and authorized users. |
Annex B - Technical and Organizational Measures
| Control area | Measures |
|---|---|
| Governance | Documented security responsibilities, vendor review, confidentiality obligations, incident-response procedures, and periodic policy review. |
| Access control | Role-based or function-based access where supported, least privilege, unique accounts, password controls, restricted administrative access, and periodic access review. |
| Authentication | Secure password hashing, protected authentication tokens, and multi-factor authentication for privileged infrastructure accounts where supported. |
| Encryption | TLS or equivalent encryption in transit; encryption at rest where provided by hosting, database, storage, and backup platforms. |
| Infrastructure | Environment separation as appropriate, firewall and network controls, hosting-provider protections, monitoring, patching, and vulnerability remediation based on risk. |
| Logging and monitoring | Authentication, application, infrastructure, error, and security logging with access restrictions and retention limits appropriate to the Service. |
| Availability and resilience | Backups, restoration procedures, service monitoring, capacity management, and business-continuity practices appropriate to the Service. |
| Secure development | Code review, dependency and vulnerability management, change control, secrets management, and separation of development credentials from production credentials. |
| Data minimization and deletion | Collection limited to service needs, configurable sharing, account-deletion processes, retention schedules, and backup expiry. |
| Incident response | Detection, triage, containment, investigation, remediation, documentation, and customer notification procedures. |
Annex C - International Transfer Information
| Field | Selection / Information |
|---|---|
| Data exporter | Customer and any affiliates identified in the Agreement. |
| Data importer | IMARA DIGITAL HOLDINGS LLC, 2850 University Square Dr, Tampa, FL 33612, United States; donovan@makestoryboard.com. |
| Modules | Module Two and/or Module Three, depending on Customer's role. |
| Categories and purposes | As described in Annex A. |
| Sensitive-data safeguards | Sensitive data is not intentionally required. Access controls, encryption in transit, restricted support access, and Customer responsibility for lawful submission apply. |
| Frequency and retention | Continuous during the Agreement; retained as described in Section 13. |
| Competent authority | Determined under Clause 13 of the SCCs and applicable law. |
| SCC governing law | Ireland. |
| SCC courts | Courts of Ireland. |
| Supplementary measures | Encryption in transit, access controls, limited U.S. administrative access, vendor transfer safeguards, law-enforcement request review, and documented transfer assessment where required. |
Annex D - Subprocessors
Provider maintains a current list of Subprocessors used to process Customer Personal Data. Customer may request the current list or subscribe to Subprocessor change notices by contacting donovan@makestoryboard.com. Provider may also publish the current list at makestoryboard.com.
Contact
IMARA DIGITAL HOLDINGS LLC
2850 University Square Dr
Tampa, FL 33612
United States
donovan@makestoryboard.com