Data processing agreement

This data processing agreement (verwerkersovereenkomst) under article 28 GDPR is part of our terms of service. It applies between the customer who hosts meetings (the controller) and RG-IT (the processor):

RG-IT B.V. · Vlotstraat 20, 6417 CB Heerlen, the Netherlands · KvK 51460602 · VAT NL850028954B01 · hello@leanbrew.app

It is accepted together with the terms when creating an account. You can save or print this page; a signed copy is available on request.

We process personal data only to provide LeanBrew to you: running meetings where participants add topics, vote, discuss and record notes and actions, and delivering minutes, exports, reminders and integrations you enable. The processing lasts as long as you use the service, plus the deletion period below.

• Data subjects: your users, the participants and guests you invite, and people mentioned in meeting content.
• Personal data: names entered by participants, account names and email addresses of members, and whatever personal data appears in topics, notes and actions. Please don't put special categories of personal data (such as health data) into meetings.

We process the data only on your documented instructions, which are these terms and the way you configure and use the service, including with regard to transfers of personal data outside the EEA, unless EU or Dutch law requires otherwise; in that case we inform you beforehand unless that law prohibits it. We tell you if we believe an instruction breaks the law. We don't use the data for our own purposes.

Anyone processing the data for us is bound to confidentiality. We take appropriate technical and organisational measures (article 32 GDPR), including:

• hosting in the EU;
• encryption at rest (Google Cloud and MongoDB Atlas defaults) and TLS encryption in transit;
• passwords stored as salted scrypt hashes;
• secrets kept in Google Secret Manager and least-privilege service accounts;
• a signed (HMAC) guest cookie and rate limiting;
• server logs kept for 30 days.

You give general permission to use these sub-processors:

• Google Cloud — hosting (europe-west4, the Netherlands)
• MongoDB Atlas — database (Google Cloud europe-west1, Belgium)
• Resend — account emails (eu-west-1, Ireland); account data only, not meeting content
• Stripe — payments; account data only, not meeting content

Slack is not our sub-processor: if you connect your own Slack webhook, we send meeting details to it on your instruction; Slack then acts for you under your agreement with Slack.

We bind our sub-processors to equivalent obligations and remain fully liable to you for the performance of our sub-processors' obligations. We announce changes to this list at least 30 days in advance on this page and by email; you may object, and if we can't resolve it you may end your subscription. Transfers outside the EU take place only under an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses.

We help you, as far as reasonable, to respond to requests from data subjects (you can also delete and export data yourself in the app), and with security, data protection impact assessments and prior consultation (articles 32–36 GDPR).

We notify you without undue delay, and where possible within 48 hours after discovery, of a personal data breach affecting your data, with the information you need to meet your own notification duties.

We make available the information needed to demonstrate compliance with this agreement. You may have an audit carried out once a year, at your own cost, with reasonable notice and confidentiality, if the information we provide isn't sufficient.

At your choice, you can export (return) the data yourself before your account ends; you can export your minutes and actions at any time. When your account ends, we then delete the meeting content within 30 days, unless the law requires us to keep it. Backups, where made, are overwritten within 30 days after that.

The liability limits of the terms of service apply. If this agreement and the terms conflict on data protection, this agreement prevails.