Data processing agreement (dpa) — Miro

Cited by

Facts read from this source

• DPA effective date Report an error

  “Effective Date: September 17, 2024”

• DPA entity Report an error

  “This Customer Data Processing Addendum ("DPA") is entered into between RealtimeBoard, Inc., dba Miro ("Miro" or "data importer") and the entity identified as the Customer ("Customer" or "data exporter")”

• DPA amendments rejected Report an error

  “If Customer makes any deletions or revisions to this DPA, those deletions or revisions are hereby rejected and invalid, unless agreed by Miro.”

• DPA roles Report an error

  “Customer shall be the Controller and Miro shall process Customer Personal Data as a Processor on behalf of Customer.”

• Subprocessor list URL Report an error

  “including those listed at: https://miro.com/static/legal/Miro-Current-Subprocessors-List.pdf (or such other successor URL) ("Subprocessor List")”

• Subprocessor notification days Report an error

  “If Customer elects to be notified at least ten (10) days prior to Miro engaging a new or replacement Subprocessor, Customer must subscribe to such notifications here”

• Subprocessor objection days Report an error

  “Customer may object to Miro’s appointment of any new or replacement Subprocessor promptly in writing within thirty (30) days after receipt of notice”

• Subprocessor liability Report an error

  “remain liable to Customer for any breach of this DPA caused by an act, error or omission of such Subprocessor.”

• Dpf certified Report an error

  “The parties agree that the DPF applies with respect to Restricted Transfers of Customer Personal Data to the US from the EEA and/or Switzerland as Miro is certified under the DPF program and complies with the DPF Principles when processing such Customer Personal Data.”

• Scc governing law Report an error

  “in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Dutch law, (v) in Clause 18(b), disputes shall be resolved before the courts of the Netherlands”

• UK scc addendum Report an error

  “each party will be deemed to have signed the “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under Section 119 A of the United Kingdom Data Protection Act 2018”

• Security incident notification Report an error

  “In the event of a Security Incident, Miro shall inform Customer without undue delay and will provide written details of the Security Incident to Customer, including the type of data affected and the identity of affected person(s)”

• Audit rights Report an error

  “following a confirmed Security Incident or where a data protection authority requires it, Customer may provide Miro with thirty (30) days’ prior written notice requesting that a third-party conduct an audit of Miro's operations and facilities ("Audit")”

• Audit certifications on request Report an error

  “Upon request, Miro shall provide copies of any certifications, audit report summaries and/or other relevant documentation it holds, where reasonably required by Customer to verify Miro's compliance with this DPA.”

• Dpia assistance Report an error

  “Miro will assist Customer to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities”

• Deletion return Report an error

  “Upon Customer's request during the Agreement Subscription Term and/or at termination or expiry of this DPA, Miro shall delete or return to Customer all Customer Personal Data in its possession in accordance with Miro’s then-current data deletion timelines and policies”

• Deletion confirmation Report an error

  “The parties agree that confirmation of the deletion of Customer Personal Data shall be provided by Miro to Customer upon Customer's written request.”

• CCPA service provider Report an error

  “Customer is a Business and Miro is a Service Provider. Customer’s transfer of Customer Personal Data to Miro is not a Sale”

• No sell or share Report an error

  “Miro shall not “Sell” or “Share” Customer Personal Data”

• No sensitive data Report an error

  “N/A. The data exporter is prohibited from submitting special categories of data to the Services.”

• DPA importer address Report an error

  “Name: RealtimeBoard, Inc. dba Miro (“Miro”) Address: 315 Montgomery Street, Suite 900, San Francisco, CA 94104”

• DPA contact Report an error

  “Contact person’s name, position and contact details: privacy(a)miro.com”

• ISO 27001 Report an error

  “ISO 27001 CERTIFIED”

• SOC 2 Report an error

  “SOC 2 COMPLIANT”

• GDPR Report an error

  “GDPR COMPLIANT”

• Iso42001 Report an error

  “ISO 42001 READY”

• DPA liability cap Report an error

  “Any claim or remedy Customer may have against Miro, its employees, agents and Subprocessors, arising under or in connection with this DPA, whether in contract, tort (including negligence) or under any other theory of liability, shall to the maximum extent permitted by law be subject to the limitations and exclusions of liability in the Agreement.”

• International transfer safeguard Report an error

  “Miro shall not process or transfer Customer Personal Data (nor permit such data to be processed or transferred) outside of EEA, Switzerland or UK, unless it first takes such measures as are necessary to ensure the transfer is in compliance with Data Protection Law.”

Scores citing this record

• The Microsoft 365 Admin European sovereignty
• The Product Team Lead Security, AI controls & deployment
• The Product Team Lead European sovereignty
• The Public-Sector Project Lead European sovereignty
• The Skeptic European sovereignty
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Workshop Facilitator Security, AI controls & deployment
• The Workshop Facilitator European sovereignty