Data Processing Agreement

This agreement is part of the Terms of Service. It applies when you use HarnessIM to process personal data on behalf of your organization.

1. Roles. Your organization is the controller, and HarnessIM is the processor.
2. Instructions. We process personal data only to provide the service, and only as your use of it and your settings direct.
3. Confidentiality. Everyone who can access the data is bound to keep it confidential.
4. Security. We keep appropriate technical and organizational measures in place. They're summarized on the Security page.
5. Subprocessors. You authorize the providers on the Subprocessors page. We'll email owners 30 days before we add or replace one. If you object, you can terminate and get a prorated refund of prepaid fees.
6. Help with requests. We'll help you respond to data-subject requests, mainly through the export and delete tools in the app.
7. Breaches. We'll notify your organization's owners within 48 hours of confirming a breach that affects your data.
8. Deletion. When your account is deleted, we delete your data as described in the Privacy Policy.
9. Transfers. Data is stored in the United States. Transfers from the EU, the UK and Switzerland rely on the standard contractual clauses and the UK addendum, which are incorporated by reference.
10. Audits. On request, we'll provide the information you reasonably need to show compliance.

Enterprise customers can ask for a signed copy.