This Data Processing Addendum ("DPA") forms part of the Terms of Service between DiBeasi Global Investments LLC, doing business as SeatReaper ("SeatReaper", "we"), and the customer that holds the SeatReaper workspace ("Customer", "you"). It applies whenever SeatReaper processes Customer Personal Data. If this DPA and the Terms conflict on data protection, this DPA wins.
1. Definitions
- Customer Personal Data: personal data that SeatReaper processes on your behalf through the service, including data from the tools you connect (for example user names, email addresses, license assignments, sign-in dates and device names of your clients' employees).
- Data Protection Laws: the privacy and data protection laws that apply to that processing, which may include the GDPR and UK GDPR, Canada's PIPEDA, and US state laws such as the CCPA.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Terms such as controller, processor, data subject and processing have the meaning given in the Data Protection Laws.
2. Roles
You are the controller (or a processor acting for your clients, who are the controllers), and SeatReaper is your processor (or subprocessor). You are responsible for having a lawful basis to connect your clients' tools and for any notices your clients need to give their employees. SeatReaper is a "service provider" under the CCPA and does not sell or share Customer Personal Data, or use it for any purpose other than providing the service.
3. Processing on your instructions
We process Customer Personal Data only to provide, secure and support SeatReaper as described in the Terms and the documentation, and on your documented instructions, including the settings you choose in the app. We tell you if we believe an instruction breaks Data Protection Laws. Details of the processing are in Annex 1.
4. Confidentiality
Everyone at SeatReaper who can access Customer Personal Data is bound by confidentiality. SeatReaper staff can see a workspace only through a time-limited, read-only view that an owner of that workspace has granted, and every such view is recorded in the workspace's audit log.
5. Security
We keep the technical and organizational measures in Annex 2 and may improve them over time, but will not reduce the overall level of protection.
6. Subprocessors
You authorize the subprocessors listed on the Subprocessors page. We bind each one by written terms that protect Customer Personal Data at least as well as this DPA, and we stay responsible for their work. We give at least 30 days' notice before adding or replacing a subprocessor, and you may object as described on that page.
7. Helping you
Taking into account the nature of the processing, we help you respond to data subject requests (most can be handled directly in the app, for example by disconnecting a tool, which deletes everything synced from it), and with security, data protection impact assessments and consultations with authorities where required.
8. Security Incidents
We notify you without undue delay, and no later than 72 hours after we confirm a Security Incident affecting your Customer Personal Data. The notice goes to the workspace owners by email and describes what happened, the data and people affected, what we have done, and what you may need to do. We update you as we learn more.
9. Deletion and return
At any time an owner can download all workspace data (Settings), export the audit log, and delete synced data by disconnecting tools. Cancelling a paid plan does not delete anything; the workspace moves to the free plan. When an owner closes the workspace (Settings), or you ask us to delete it, we delete Customer Personal Data within 90 days (a closure an owner makes in Settings takes effect after 30 days), except where law requires us to keep it. Any copies held by our providers are removed on their normal cycle and stay protected until then.
10. Audits
We make available the information reasonably needed to show compliance with this DPA, including written answers to security questionnaires once a year (or after a Security Incident). If that is not enough to meet a requirement of Data Protection Laws, you may audit us, at your cost, with 30 days' notice, during business hours, at most once a year, and under confidentiality.
11. International transfers
Customer Personal Data is stored in Canada. Our subprocessors may process it in other countries, including the United States. Where Data Protection Laws require a transfer mechanism (for example for data from the EU or UK), the EU Standard Contractual Clauses (module two or three, as applicable) and the UK Addendum are incorporated by reference, with SeatReaper as data importer.
12. Term and liability
This DPA lasts as long as we process Customer Personal Data. Each side's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow those limits.
Annex 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Finding unused software licenses, devices and seats across the tools the Customer connects, and supporting the Customer's offboarding and reporting |
| Duration | While the Customer's workspace exists, plus up to 90 days after it is closed |
| Nature | Reading data from connected tools; storing, comparing and reporting on it; sending emails the Customer turns on; and, only when a Customer owner turns on removals, making the changes the Customer's members confirm (blocking sign-ins, removing licenses, lowering subscription quantities) |
| Data subjects | The Customer's users of SeatReaper; employees and contractors of the Customer's clients whose accounts and devices appear in the connected tools |
| Personal data | Names, work email addresses and user principal names, account status, license and seat assignments, last sign-in and last activity dates, device names and last-seen dates, last signed-in device user, and audit log entries |
| Special categories | None intended. The service does not read email content, files, chats or calendars |
Annex 2: Technical and organizational measures
- Data location: database and authentication in Canada (Montreal); application hosting in Montreal.
- Encryption: all traffic uses TLS. Data at rest is encrypted by our providers. Credentials for connected tools are additionally encrypted with AES-256-GCM using a key kept outside the database, and each is bound to its workspace so it cannot be read in another.
- Isolation: every table is protected by row-level security in the database, so each workspace can only ever read its own data, whatever the application does.
- Least privilege: connectors use read-only access. Changes are possible only when a Customer owner turns on removals, through access each client approves separately, and every change is logged. Customer roles (owner, tech, viewer) limit what each person can do.
- Authentication: two-step verification for every user, which owners can require; Sign in with Microsoft, which owners can require; both enforced by the database. SeatReaper staff access requires two-step verification.
- Accountability: an append-only audit log of every change, including every SeatReaper staff action and its reason; email security alerts to owners; optional real-time audit log streaming to the Customer's own systems.
- Support access: only while an owner has granted it, for a limited time, read-only, and logged.
- Secure development: every change goes through a pull request with automated checks, including tests of the database access rules, before it reaches production; dependencies are checked for known vulnerabilities.
- Incident response: a written process to contain, investigate and notify, as in section 8.
Contact
Data protection questions and requests: support@seatreaper.com, DiBeasi Global Investments LLC, doing business as SeatReaper, Lombard, Illinois.